Oxbian/SIDPS
1
0
Fork 0
mirror of https://github.com/Oxbian/SIDPS.git synced 2025-07-08 04:43:47 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

update dataExfiltration

Browse Source 
c'est pas encore ça mais il y a de l'idée
This commit is contained in:
SofianeElNaggar
2024-11-20 19:41:46 -05:00
parent 6efbe6e2e4
commit 17a6e3def2
3 changed files with 11 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
idps/rules/TCP/Scan/dataExfiltration.py
View File

@ -23,6 +23,8 @@ def rule(packet, _, db):
data_transfer[src_ip]["current"] += payload_size
data_transfer[src_ip]["daily"] += payload_size
print(data_transfer[src_ip]["current"])
# Exfiltration de données instantané
if data_transfer[src_ip]["current"] > rule.seuil_session:
db.send_alert(
@ -32,7 +34,7 @@ def rule(packet, _, db):
"Exfiltration de données détectée (instantané)",
src_ip,
dst_ip,
"TCP",
proto = "TCP",
reason="Exfiltration de données détectée (instantané)",
act="Alerte"
)
@ -48,7 +50,7 @@ def rule(packet, _, db):
"Exfiltration de données détectée (journalière)",
src_ip,
dst_ip,
"TCP",
proto = "TCP",
reason="Exfiltration de données détectée (journalière)",
act="Alerte"
)