jaimemorales52/llm-ioc-detection

Spring Boot backend for evaluating Large Language Models on the detection of Indicators of Compromise (IoCs) embedded as secrets in obfuscated JavaScript code. In this implementation, the IoC is an IP address hidden inside transformed JS files. The service exposes REST APIs to query multiple LLM providers and normalize their IoC detection responses

26
/ 100
Experimental

This project helps cybersecurity researchers and analysts evaluate how well different large language models can detect hidden security risks in software code. It takes JavaScript code, embeds a secret like an IP address, applies various obfuscation techniques to hide it, and then sends the altered code to multiple LLMs. The output is a clear 'YES' or 'NO' on whether an IoC was found and the recovered secret if identified, helping assess LLM capabilities in threat detection.

Use this if you are a cybersecurity researcher or a red team analyst looking to test and compare how effective various LLMs are at finding hidden indicators of compromise (IoCs) in obfuscated JavaScript code.

Not ideal if you need a production-ready solution for live code scanning or if your primary goal is to protect sensitive, proprietary code, as this tool is strictly for research and educational evaluation.

cybersecurity-research threat-detection software-security red-teaming LLM-evaluation
No Package No Dependents
Maintenance 10 / 25
Adoption 5 / 25
Maturity 11 / 25
Community 0 / 25

How are scores calculated?

Stars

12

Forks

Language

Java

License

MIT

Last pushed

Mar 04, 2026

Commits (30d)

0

Get this data via API

curl "https://pt-edge.onrender.com/api/v1/quality/llm-tools/jaimemorales52/llm-ioc-detection"

Open to everyone — 100 requests/day, no key needed. Get a free key for 1,000/day.