Skip to content

Commit 22b4d38

Browse files
rejahrehimrejahrehim
authored
Merge pull request #284 from prince-7/ids
New Attack Detection Modules for IDS
2 parents 08ee7f5 + 4afb80a commit 22b4d38

12 files changed

Lines changed: 2107 additions & 2863 deletions

File tree

‎ServerApp/requirements.txt‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,6 @@ psutil
33
flask
44
flask_cors
55
flask_sqlalchemy
6-
flask_socketio
6+
Flask-SocketIO==4.3.1
7+
python-engineio==3.13.2
8+
python-socketio==4.6.0

‎gui/package-lock.json‎

Lines changed: 1849 additions & 2862 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎securetea/__init__.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@
2727
from .lib.ids.r2l_rules import ping_of_death
2828
from .lib.ids.r2l_rules import r2l_engine
2929
from .lib.ids.r2l_rules import syn_flood
30+
from .lib.ids.r2l_rules import dns_amp
31+
from .lib.ids.r2l_rules import bgp_abuse
3032
from .lib.ids.r2l_rules.wireless import deauth
3133
from .lib.ids.r2l_rules.wireless import fake_access
3234
from .lib.ids.r2l_rules.wireless import hidden_node

‎securetea/core.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@
3939
from securetea.lib.iot import iot_checker
4040
from securetea.lib.social_engineering.socialEngineering import SecureTeaSocialEngineering
4141
from securetea.lib.history_logger.secureTeaHistoryLogger import SecureTeaHistoryLogger
42+
from securetea.lib.history_logger.historylogger_logger import HistoryLogger
4243
from securetea.modes import server_mode
4344
from securetea.modes import system_mode
4445
from securetea.modes import iot_mode

‎securetea/lib/__init__.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
from .ids.r2l_rules import ping_of_death
2525
from .ids.r2l_rules import r2l_engine
2626
from .ids.r2l_rules import syn_flood
27+
from .ids.r2l_rules import dns_amp
2728
from .ids.r2l_rules.wireless import deauth
2829
from .ids.r2l_rules.wireless import fake_access
2930
from .ids.r2l_rules.wireless import hidden_node

‎securetea/lib/ids/__init__.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@
99
from .r2l_rules import ping_of_death
1010
from .r2l_rules import r2l_engine
1111
from .r2l_rules import syn_flood
12+
from .r2l_rules import dns_amp
13+
from .r2l_rules import bgp_abuse
1214
from .r2l_rules.wireless import deauth
1315
from .r2l_rules.wireless import fake_access
1416
from .r2l_rules.wireless import hidden_node

‎securetea/lib/ids/r2l_rules/__init__.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@
77
from . import ping_of_death
88
from . import r2l_engine
99
from . import syn_flood
10+
from . import dns_amp
11+
from . import bgp_abuse
1012
from .wireless import deauth
1113
from .wireless import fake_access
1214
from .wireless import hidden_node

‎securetea/lib/ids/r2l_rules/bgp_abuse.py‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
# -*- coding: utf-8
2+
u"""BGP Abuse Detection detection module for SecureTea IDS.
3+
4+
Project:
5+
╔═╗┌─┐┌─┐┬ ┬┬─┐┌─┐╔╦╗┌─┐┌─┐
6+
╚═╗├┤ │ │ │├┬┘├┤ ║ ├┤ ├─┤
7+
╚═╝└─┘└─┘└─┘┴└─└─┘ ╩ └─┘┴ ┴
8+
Author: Aman Singh <dun930n.m45732@gmail.com> , June 16 2021
9+
Version: 1.1
10+
Module: SecureTea
11+
12+
"""
13+
14+
import scapy.all as scapy
15+
import scapy.contrib.bgp as bgp
16+
from securetea import logger
17+
18+
class BGP_Abuse(object):
19+
"""BGP Abuse class."""
20+
21+
def __init__(self, debug=False):
22+
"""
23+
Initialize BGP Abuse class.
24+
25+
Args:
26+
debug (bool): Log on terminal or not
27+
28+
Raises:
29+
None
30+
31+
Returns:
32+
None
33+
"""
34+
# Initialize logger
35+
self.logger = logger.SecureTeaLogger(
36+
__name__,
37+
debug=debug
38+
)
39+
40+
def detect_bgp_abuse(self, pkt):
41+
"""
42+
Detect BGP Abuse Attacks by observing set flags and BGPPathAttributes
43+
44+
Types of attack detected:-
45+
1) Blind Disruption
46+
47+
Args:
48+
pkt (scapy_object): Packet to dissect and observe
49+
50+
Raises:
51+
None
52+
53+
Returns:
54+
None
55+
"""
56+
57+
# Blind Disruption Detection
58+
if (pkt.haslayer(scapy.IP)
59+
and pkt.haslayer(scapy.TCP)):
60+
if('RA' in str(pkt[scapy.TCP].flags)):
61+
self.logger.log(
62+
"Possible BGP Abuse,Blind Disruption attack detected.",
63+
logtype="warning"
64+
)
65+

‎securetea/lib/ids/r2l_rules/dns_amp.py‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
# -*- coding: utf-8
2+
u"""DNS Amplification detection module for SecureTea IDS.
3+
4+
Project:
5+
╔═╗┌─┐┌─┐┬ ┬┬─┐┌─┐╔╦╗┌─┐┌─┐
6+
╚═╗├┤ │ │ │├┬┘├┤ ║ ├┤ ├─┤
7+
╚═╝└─┘└─┘└─┘┴└─└─┘ ╩ └─┘┴ ┴
8+
Author: Aman Singh <dun930n.m45732@gmail.com> , June 14 2021
9+
Version: 1.1
10+
Module: SecureTea
11+
12+
"""
13+
14+
import scapy.all as scapy
15+
from subprocess import check_output
16+
import re
17+
from securetea import logger
18+
19+
class DNS_Amplification(object):
20+
"""DNS Amplification class."""
21+
22+
def __init__(self, debug=False):
23+
"""
24+
Initialize DNS Amplification class.
25+
26+
Args:
27+
debug (bool): Log on terminal or not
28+
29+
Raises:
30+
None
31+
32+
Returns:
33+
None
34+
"""
35+
# Initialize logger
36+
self.logger = logger.SecureTeaLogger(
37+
__name__,
38+
debug=debug
39+
)
40+
41+
def detect_dns_amplification(self, pkt):
42+
"""
43+
Detect detect DNS Amplification by observing source,
44+
destination IP & ports.
45+
46+
Args:
47+
pkt (scapy_object): Packet to dissect and observe
48+
49+
Raises:
50+
None
51+
52+
Returns:
53+
None
54+
"""
55+
if (pkt.haslayer(scapy.IP) and
56+
pkt.haslayer(scapy.UDP) and
57+
pkt.haslayer(scapy.DNS)):
58+
59+
source_ip = pkt[scapy.IP].src
60+
dest_dns = [str(pkt[scapy.IP].dst)]
61+
62+
udp_port = pkt[scapy.UDP].dport
63+
ips = check_output(['hostname', '--all-ip-addresses'])
64+
ips = ips.decode("utf-8").split(' ')[:-1]
65+
66+
# dns ips for top public dns servers
67+
dns_dst = ['8.8.8.8','8.8.4.4','9.9.9.9','149.112.112.112','208.67.222.222','208.67.220.220','1.1.1.1','1.0.0.1','185.228.168.9','185.228.169.9','76.76.19.19','76.223.122.150','94.140.14.14','94.140.15.15']
68+
69+
if ((source_ip in ips) and (udp_port == 53)):
70+
for dest in dest_dns:
71+
if(re.search('[a-zA-Z]', dest)):
72+
dest_dns += check_output(['dig', '+short', dest]).decode('utf-8').split('\n')[:-1]
73+
if(dest in dns_dst):
74+
self.logger.log(
75+
"Possible dns amplification attack detected.",
76+
logtype="warning"
77+
)
78+
break

‎securetea/lib/ids/r2l_rules/r2l_engine.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@
1818
from securetea.lib.ids.r2l_rules.ping_of_death import PingOfDeath
1919
from securetea.lib.ids.r2l_rules.syn_flood import SynFlood
2020
from securetea.lib.ids.r2l_rules.land_attack import LandAttack
21+
from securetea.lib.ids.r2l_rules.dns_amp import DNS_Amplification
22+
from securetea.lib.ids.r2l_rules.bgp_abuse import BGP_Abuse
2123
from securetea.lib.ids.r2l_rules.wireless.deauth import Deauth
2224
from securetea.lib.ids.r2l_rules.wireless.fake_access import FakeAccessPoint
2325
from securetea.lib.ids.r2l_rules.wireless.hidden_node import HiddenNode
@@ -49,6 +51,8 @@ def __init__(self, debug=False, interface=None):
4951
self.land_attack = LandAttack(debug=debug)
5052
self.ddos = DDoS(debug=debug)
5153
self.syn_flood = SynFlood(debug=debug)
54+
self.dns_amp = DNS_Amplification(debug=debug)
55+
self.bgp_abuse = BGP_Abuse(debug=debug)
5256
# Wireless
5357
self.deauth = Deauth(debug=debug)
5458
self.fake_access = FakeAccessPoint(debug=debug)
@@ -77,6 +81,8 @@ def run(self, pkt):
7781
self.ping_of_death.detect(pkt)
7882
self.ddos.classify_ddos(pkt)
7983
self.syn_flood.detect_syn_flood(pkt)
84+
self.dns_amp.detect_dns_amplification(pkt)
85+
self.bgp_abuse.detect_bgp_abuse(pkt)
8086
# Wireless
8187
self.deauth.detect_deauth(pkt)
8288
self.fake_access.detect_fake_ap(pkt)

0 commit comments

Comments
 (0)