diff --git a/idps/main.py b/idps/main.py index 664bb47..3a8f88c 100644 --- a/idps/main.py +++ b/idps/main.py @@ -91,10 +91,10 @@ def packet_callback(packet, rules_functions, tcp_packets, db): @param db: Objet database pour envoyer des alertes à la BDD """ - #print(packet) + ##print(packet) if IP in packet and TCP in packet: tcp_packets.add_packet(packet[IP].src, packet[TCP].sport, packet[IP].dst, packet[TCP].dport, packet[TCP].flags, time.time()) - print(tcp_packets[packet[IP].src]) + #print(tcp_packets[packet[IP].src]) check_frame_w_rules(packet, rules_functions['TCP'], tcp_packets, db) tcp_packets.clean_old_packets() diff --git a/idps/rules/TCP/Scan/dataExfiltration.py b/idps/rules/TCP/Scan/dataExfiltration.py index 9eab908..db616b2 100644 --- a/idps/rules/TCP/Scan/dataExfiltration.py +++ b/idps/rules/TCP/Scan/dataExfiltration.py @@ -23,6 +23,8 @@ def rule(packet, _, db): data_transfer[src_ip]["current"] += payload_size data_transfer[src_ip]["daily"] += payload_size + print(data_transfer[src_ip]["current"]) + # Exfiltration de données instantané if data_transfer[src_ip]["current"] > rule.seuil_session: db.send_alert( @@ -32,7 +34,7 @@ def rule(packet, _, db): "Exfiltration de données détectée (instantané)", src_ip, dst_ip, - "TCP", + proto = "TCP", reason="Exfiltration de données détectée (instantané)", act="Alerte" ) @@ -48,7 +50,7 @@ def rule(packet, _, db): "Exfiltration de données détectée (journalière)", src_ip, dst_ip, - "TCP", + proto = "TCP", reason="Exfiltration de données détectée (journalière)", act="Alerte" ) diff --git a/idps/tcp.py b/idps/tcp.py index 0ee21f3..2029ffb 100644 --- a/idps/tcp.py +++ b/idps/tcp.py @@ -34,7 +34,7 @@ class TCP: i, ip = self.find_packet_to_replace(ip_src, port_src, ip_dst, port_dst, "S") if i is not None: - print(f"i: {i}, {ip_src}:{port_src}->{ip_dst}:{port_dst}, paquets: \n{self.packets}") + #print(f"i: {i}, {ip_src}:{port_src}->{ip_dst}:{port_dst}, paquets: \n{self.packets}") self.packets[ip][i][3].append("SA") self.packets[ip][i][4] = timestamp return @@ -48,7 +48,7 @@ class TCP: i, ip = self.find_packet_to_replace(ip_src, port_src, ip_dst, port_dst, "R") if i is not None: - print(f"i: {i}, {ip_src}:{port_src}->{ip_dst}:{port_dst}, paquets: \n{self.packets}") + #print(f"i: {i}, {ip_src}:{port_src}->{ip_dst}:{port_dst}, paquets: \n{self.packets}") self.packets[ip][i][3].append("A") self.packets[ip][i][4] = timestamp return @@ -63,7 +63,7 @@ class TCP: i, ip = self.find_packet_to_replace(ip_src, port_src, ip_dst, port_dst, "S") if i is not None: - print(f"i: {i}, {ip_src}:{port_src}->{ip_dst}:{port_dst}, paquets: \n{self.packets}") + #print(f"i: {i}, {ip_src}:{port_src}->{ip_dst}:{port_dst}, paquets: \n{self.packets}") self.packets[ip][i][3].append("RA") self.packets[ip][i][4] = timestamp return @@ -78,7 +78,7 @@ class TCP: i, ip = self.find_packet_to_replace(ip_src, port_src, ip_dst, port_dst, "S") if i is not None: - print(f"i: {i}, {ip_src}:{port_src}->{ip_dst}:{port_dst}, paquets: \n{self.packets}") + #print(f"i: {i}, {ip_src}:{port_src}->{ip_dst}:{port_dst}, paquets: \n{self.packets}") self.packets[ip][i][3].append("R") self.packets[ip][i][4] = timestamp return @@ -90,7 +90,7 @@ class TCP: i, ip = self.find_packet_to_replace(ip_src, port_src, ip_dst, port_dst, "A") if i is not None: - print(f"i: {i}, {ip_src}:{port_src}->{ip_dst}:{port_dst}, paquets: \n{self.packets}") + #print(f"i: {i}, {ip_src}:{port_src}->{ip_dst}:{port_dst}, paquets: \n{self.packets}") self.packets[ip][i][3].append("F") self.packets[ip][i][4] = timestamp return