Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
This report presents the forensic synthetic code analysis of zeek/zeek, a C++ project with 7,771 GitHub stars. SynthScan v2.0 examined 161,591 lines of code across 873 source files, recording 412 pattern matches distributed across 12 syntactic categories. The overall adjusted score of 3.4 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 412 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | CMakeLists.txt | 1 | # When changing the minimum version here, also adapt | COMMENT |
| LOW | CMakeLists.txt | 321 | COMMENT | |
| LOW | tools/gen-zam/Gen-ZAM.h | 1 | // See the file "COPYING" in the main distribution directory for copyright. | COMMENT |
| LOW | tools/gen-zam/Gen-ZAM.h | 101 | COMMENT | |
| LOW | tools/gen-zam/Gen-ZAM.h | 161 | // OP_LOAD_GLOBAL_VV_A). | COMMENT |
| LOW | tools/gen-zam/Gen-ZAM.h | 181 | COMMENT | |
| LOW | tools/gen-zam/Gen-ZAM.h | 261 | COMMENT | |
| LOW | tools/gen-zam/Gen-ZAM.h | 401 | // Helper function that parses "class" specifications. | COMMENT |
| LOW | tools/gen-zam/Gen-ZAM.h | 421 | COMMENT | |
| LOW | tools/gen-zam/Gen-ZAM.h | 601 | COMMENT | |
| LOW | tools/binpac/src/pac_context.h | 1 | // See the file "COPYING" in the main distribution directory for copyright. | COMMENT |
| LOW | tools/binpac/src/pac_expr.h | 41 | ExprType expr_type() const { return expr_type_; } | COMMENT |
| LOW | tools/binpac/src/pac_id.h | 1 | // See the file "COPYING" in the main distribution directory for copyright. | COMMENT |
| LOW | tools/binpac/src/pac_decl-inl.h | 1 | // See the file "COPYING" in the main distribution directory for copyright. | COMMENT |
| LOW | tools/systemd-generator/src/zeek-cluster-config.h | 1 | // See the file "COPYING" in the main distribution directory for copyright. | COMMENT |
| LOW | tools/zeek-cut/zeek-cut.c | 1 | // See the file "COPYING" in the main distribution directory for copyright. | COMMENT |
| LOW | ci/find-current-version.sh | 1 | #!/bin/bash | COMMENT |
| LOW | ci/tsan_suppressions.txt | 1 | # This is a list of suppressions for ThreadSanitizer. Anything listed here will be | COMMENT |
| LOW | ci/tsan_suppressions.txt | 41 | race:zeek::threading::InputMessage<zeek::threading::MsgThread>::Object | COMMENT |
| LOW | ci/tsan_suppressions.txt | 61 | called_from_lib:libzmq.so | COMMENT |
| LOW | ci/tsan_suppressions.txt | 81 | # The T3 thread above is/was a ZMQ IO thread. | COMMENT |
| LOW | ci/container-images-tag-and-push.sh | 1 | #!/bin/bash | COMMENT |
| LOW | testing/btest/misc/udp.sh | 1 | # @TEST-DOC: Check that the Zeek::PacketSourceUDP plugin is available on FreeBSD and Linux | COMMENT |
| LOW | testing/btest/misc/build-info.sh | 1 | # @TEST-DOC: Verify -V and --build-info work | COMMENT |
| LOW | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 221 | # padding → 2 bytes | COMMENT |
| LOW | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 261 | # RFC 2822 message — what Zeek parses via MIME_Entity | COMMENT |
| LOW | testing/btest/Traces/krb/error-preauth-padata.pcap.py | 1 | from scapy.all import IP, UDP, Ether, Raw, wrpcap | COMMENT |
| LOW | …temd-generator/test-zeek-systemd-generator-defaults.sh | 1 | # @TEST-DOC: Use a minimal to check the defaults used. | COMMENT |
| LOW | …rator/test-zeek-cluster-layout-generator-open-error.sh | 1 | # @TEST-DOC: Check that an errno string is included in the error message if -o is used and the file can't be opened. Tri | COMMENT |
| LOW | …tools/systemd-generator/test-interface-substitution.sh | 1 | # @TEST-DOC: Test interpolation of the interface key. | COMMENT |
| LOW | …tools/systemd-generator/test-zeek-systemd-generator.sh | 1 | # @TEST-DOC: Smoke test the zeek-systemd-generator | COMMENT |
| LOW | testing/btest/tools/systemd-generator/test-ext-path.sh | 1 | # @TEST-DOC: Test ext_path setting | COMMENT |
| LOW | testing/btest/tools/systemd-generator/test-cpulist.sh | 1 | # @TEST-DOC: Test a few CPU lists. | COMMENT |
| LOW | testing/btest/tools/systemd-generator/test-cpulist.sh | 21 | # @TEST-EXEC: mkdir dir3 | COMMENT |
| LOW | …ystemd-generator/test-zeek-cluster-layout-generator.sh | 1 | # @TEST-DOC: Smoke test the zeek-cluster-layout-generator tool. | COMMENT |
| LOW | …ng/btest/tools/systemd-generator/test-ext-zeek-path.sh | 1 | # @TEST-DOC: Test ext_path setting | COMMENT |
| LOW | testing/btest/core/sigterm-regular.sh | 1 | # This test verifies that Zeek terminates upon SIGTERM during regular script | COMMENT |
| LOW | testing/btest/core/sigterm-stdin.sh | 1 | # This test verifies that Zeek, while reading stdin to parse scripts, terminates | COMMENT |
| LOW | testing/btest/plugins/bifs-and-scripts.sh | 1 | # @TEST-EXEC: ${DIST}/auxil/zeek-aux/plugin-support/init-plugin -u . Demo Foo | COMMENT |
| LOW | …test/plugins/bifs-and-scripts-install-delete-source.sh | 1 | # @TEST-DOC: Create a plugin, build it, copy its tgz file, delete the source tree, install via the tgz. This ensures the | COMMENT |
| LOW | testing/btest/Files/ws/wstest.py | 281 | # assert self.protocol.state is CLOSED | COMMENT |
| LOW | testing/external/scripts/skel/traces.cfg | 1 | # | COMMENT |
| LOW | doc/redirects.yml | 1 | # This file defines all the HTTP redirects required for the Readthedocs projects | COMMENT |
| LOW | doc/conf.py | 1 | # | COMMENT |
| LOW | doc/conf.py | 41 | # The suffix of source filenames. | COMMENT |
| LOW | doc/conf.py | 101 | # to update the commit-hash for every Zeek commit unless it actually produces | COMMENT |
| LOW | doc/conf.py | 121 | today_fmt = "%B %d, %Y" | COMMENT |
| LOW | doc/conf.py | 221 | # Additional templates that should be rendered to pages, maps page names to | COMMENT |
| LOW | doc/conf.py | 241 | # html_show_copyright = True | COMMENT |
| LOW | doc/conf.py | 261 | COMMENT | |
| LOW | doc/conf.py | 321 | r"^https://zeek\.rtfd\.io", | COMMENT |
| LOW | doc/advanced/devel/cluster/supervisor.sh | 1 | #!/bin/bash | COMMENT |
| LOW | doc/tutorial/scripting/js/api.js | 1 | // api.js | COMMENT |
| LOW | doc/frameworks/management/full-config.ini | 1 | # The instances section describes where you run Management agents | COMMENT |
| LOW | doc/frameworks/management/full-config.ini | 21 | instance = agent-testbox | COMMENT |
| LOW | doc/frameworks/management/full-config.ini | 41 | # | COMMENT |
| LOW | src/Type.h | 1 | // See the file "COPYING" in the main distribution directory for copyright. | COMMENT |
| LOW | src/Type.h | 881 | bool has_redefs = false; | COMMENT |
| LOW | src/ZeekString.h | 1 | // See the file "COPYING" in the main distribution directory for copyright. | COMMENT |
| LOW | src/ZeekString.h | 121 | static constexpr int ZEEK_STRING_LITERAL = // as in a Zeek string literal | COMMENT |
| 280 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …st/Traces/snmp/snmp-oid-subidentifier-too-long.pcap.py | 27 | varbind = tlv(0x30, oid + null) | CODE |
| HIGH⚡ | …g/btest/Traces/dce-rpc/bind-ack-no-inband-null.pcap.py | 160 | # Flow 1: sec_addr = b'ABC' (no null) -> old strips to "AB", new keeps "ABC" | COMMENT |
| HIGH⚡ | …g/btest/Traces/dce-rpc/bind-ack-no-inband-null.pcap.py | 163 | # Flow 2: sec_addr = b'ABC\x00' (null) -> both old and new produce "ABC" | COMMENT |
| HIGH⚡ | …g/btest/Traces/dce-rpc/bind-ack-no-inband-null.pcap.py | 166 | # Flow 3: sec_addr = b'X' (no null) -> old strips to "", new keeps "X" | COMMENT |
| HIGH | testing/btest/Traces/tls/dtls-sequence-number-jumps.py | 51 | compression_field = b"\x01\x00" # length 1, method 0 (null) | CODE |
| HIGH | src/generate-jit-export-def.py | 27 | """Return (defined, undefined, data_syms) sets of external symbols. | STRING |
| HIGH | src/generate-jit-export-def.py | 73 | return defined, undefined, data_syms | CODE |
| HIGH⚡ | src/generate-jit-export-def.py | 264 | defined, undefined, data_syms = _parse_symbols(dumpbin, lib) | CODE |
| HIGH⚡ | src/generate-jit-export-def.py | 266 | f" {lib}: {len(defined)} defined, {len(undefined)} undefined", | CODE |
| HIGH⚡ | src/generate-jit-export-def.py | 270 | all_undefs.update(undefined) | CODE |
| HIGH⚡ | src/generate-jit-export-def.py | 280 | defined, undefined, data_syms = _parse_symbols(dumpbin, lib) | CODE |
| HIGH⚡ | src/generate-jit-export-def.py | 287 | all_undefs.update(undefined) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | ci/tsan_suppressions.txt | 10 | # ===================================================================== | COMMENT |
| MEDIUM | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 31 | # ── tunables ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 44 | # ── read the RFC2822 payload ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 57 | # ── build the SMTP conversation ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 79 | # ── packet construction ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 166 | # ── write PCAP ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 205 | # ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 207 | # ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 243 | # ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 245 | # ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 293 | # ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 295 | # ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 337 | # ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 339 | # ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 359 | # ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 361 | # ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 374 | # ── Code path explanation ───────────────────────────────────────────── | COMMENT |
| MEDIUM | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 420 | # ── Impact calculation ──────────────────────────────────────────────── | STRING |
| MEDIUM | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 470 | # ── Generate the payload ───────────────────────────────────────────── | STRING |
| MEDIUM | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 507 | # ── Save to file ───────────────────────────────────────────────────── | STRING |
| MEDIUM | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 522 | # ── Summary ────────────────────────────────────────────────────────── | STRING |
| MEDIUM | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 549 | # ── Final assertion ─────────────────────────────────────────────────── | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | testing/btest/Traces/icmp/icmp6-mldv2.py | 120 | # Create the packet | COMMENT |
| MEDIUM⚡ | testing/btest/Traces/icmp/icmp6-mldv2.py | 171 | # Create the packet (using unique source address) | COMMENT |
| MEDIUM⚡ | testing/btest/Traces/icmp/icmp6-mldv2.py | 174 | # Create a second packet with zero multicast address records | COMMENT |
| MEDIUM⚡ | testing/btest/Traces/icmp/icmp6-mldv2.py | 179 | # Create a third packet with malformed record: claims 3 sources but only has 2 | COMMENT |
| MEDIUM | testing/btest/Traces/icmp/icmp6-mldv2.py | 191 | # Create a fourth packet with one source and auxiliary data | COMMENT |
| MEDIUM | testing/btest/Traces/icmp/icmp6-mldv2.py | 203 | # Create a fifth packet with malformed aux data: claims aux data length > 0 but no actual data | COMMENT |
| MEDIUM | doc/redirects.yml | 1 | # This file defines all the HTTP redirects required for the Readthedocs projects | COMMENT |
| MEDIUM | doc/conf.py | 4 | # This file is execfile()d with the current directory set to its containing dir. | COMMENT |
| MEDIUM | doc/ext/zeek.py | 100 | # Create a reference | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | AI_POLICY.md | 13 | - **AI generated Pcap files require submission of source code.** Packet captures created by AI-generated scripts/code (e | CODE |
| HIGH | …sting/btest/Traces/portmapper-many-unanswered-calls.py | 3 | Generated by ChatGPT 5.5 to reproduce unbounded calls table. | STRING |
| HIGH | …g/btest/Traces/dce-rpc/bind-ack-no-inband-null.pcap.py | 3 | This was entirely generated by Claude code. | STRING |
| HIGH | testing/btest/Traces/http/query-method.pcap.py | 9 | Generated by Claude Opus 4.6 (Anthropic). | STRING |
| HIGH | …sting/btest/Traces/http/invalid-content-ranges.pcap.py | 8 | Generated by Claude Sonnet 4.6 (Anthropic). | STRING |
| HIGH | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 3 | # This script is entirely AI generated. It uses a user's AI generated script in order to create a | COMMENT |
| HIGH | testing/btest/Traces/sip/invalid-content-length.pcap.py | 7 | Generated by Claude Opus 4.6 (Anthropic). | STRING |
| HIGH | testing/btest/Traces/dns/svcb-alpn-malformed.pcap.py | 6 | Generated by Claude Opus 4.6 (Anthropic). | STRING |
| HIGH | testing/btest/Traces/dns/svcb-port-malformed.pcap.py | 6 | Generated by Claude Opus 4.6 (Anthropic). | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/Dict.h | 293 | // The non-robust case is easy. Just advance the current position forward until you | COMMENT |
| MEDIUM | src/Dict.h | 1556 | // Pending number of iterators on the Dict, including both robust and non-robust. | COMMENT |
| MEDIUM | src/script_opt/Expr.h | 171 | // to leverage. | COMMENT |
| MEDIUM | src/script_opt/ZAM/ZInst.h | 69 | // The following is to support robust operation in the face of potential | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/generate-jit-export-def.py | 53 | # Check if this is a function ("notype ()") or data ("notype" only). | COMMENT |
| LOW | src/generate-jit-export-def.py | 94 | # Check if any path component matches a target dir pattern. | COMMENT |
| LOW | src/generate-jit-export-def.py | 142 | # Check if the symbol belongs to a whitelisted namespace. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ci/collect-repo-info.py | 162 | CODE | |
| LOW | doc/ext/zeek.py | 507 | CODE | |
| LOW | doc/ext/zeek.py | 554 | CODE | |
| LOW | src/generate-jit-export-def.py | 86 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | testing/btest/Files/ws/wstest.py | 240 | def monkey_patch_close_socket(): | CODE |
| LOW | testing/scripts/httpd.py | 6 | class MyRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler): | CODE |
| LOW | doc/ext/zeek.py | 55 | def object_description_transform(app, domain, objtype, contentnode): | CODE |
| LOW | src/generate-jit-export-def.py | 76 | def extract_defined_externals(dumpbin, lib_path): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ci/collect-repo-info.py | 22 | logger = logging.getLogger(__name__) | CODE |
| LOW | doc/ext/zeek.py | 27 | logger = logging.getLogger(__name__) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ci/benchmark.sh | 53 | # If we got a bad status back from the host, we want to make sure to mask the host | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 487 | except Exception: | STRING |
| LOW | …sting/btest/Traces/smtp/mime-header-size-limit.pcap.py | 500 | except Exception: | STRING |