Oxbian/SIDPS
1
0
Fork 0
mirror of https://github.com/Oxbian/SIDPS.git synced 2025-07-07 20:33:51 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update dataExfiltration.py

Browse Source
This commit is contained in:
SofianeElNaggar
2024-11-20 19:02:42 -05:00
parent e19b197acc
commit 6efbe6e2e4
1 changed files with 28 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
idps/rules/TCP/Scan/dataExfiltration.py
View File

@ -1,6 +1,7 @@
from collections import defaultdict
from scapy.all import IP
import time
from datetime import datetime
data_transfer = defaultdict(lambda: {"current": 0, "daily": 0, "last_reset": time.time()})
@ -22,28 +23,37 @@ def rule(packet, _, db):
data_transfer[src_ip]["current"] += payload_size
data_transfer[src_ip]["daily"] += payload_size
# Déclencher une alerte si un seuil est atteint
# Exfiltration de données instantané
if data_transfer[src_ip]["current"] > rule.seuil_session:
alert = {
"type": "Exfiltration de données détectée (instantané)",
"source_ip": src_ip,
"destination_ip": dst_ip,
"volume": data_transfer[src_ip]["current"] / (1024 ** 3),
"threshold": rule.seuil_session / (1024 ** 3),
"time": time.strftime("%Y-%m-%d %H:%M:%S", time.gmtime()),
}
db.save_alert(alert)
db.send_alert(
datetime.now(),
5,
None,
"Exfiltration de données détectée (instantané)",
src_ip,
dst_ip,
"TCP",
reason="Exfiltration de données détectée (instantané)",
act="Alerte"
)
data_transfer[src_ip]["current"] = 0 # Réinitialiser pour les prochaines sessions
print(f"Alerte, data transfer, transfert instantané important")
# Exfiltration de données journalière
if data_transfer[src_ip]["daily"] > rule.seuil_journalier:
alert = {
"type": "Exfiltration de données détectée (journalière)",
"source_ip": src_ip,
"volume": data_transfer[src_ip]["daily"] / (1024 ** 3),
"threshold": rule.seuil_journalier / (1024 ** 3),
"time": time.strftime("%Y-%m-%d %H:%M:%S", time.gmtime()),
}
db.save_alert(alert)
db.send_alert(
datetime.now(),
5,
None,
"Exfiltration de données détectée (journalière)",
src_ip,
dst_ip,
"TCP",
reason="Exfiltration de données détectée (journalière)",
act="Alerte"
)
print(f"Alerte, data transfer, transfert journalier important")
rule.reset_time = 24 * 3600 # 24 heures en secondes
rule.seuil_session = 5 * 1024 * 1024 * 1024 # 5 Go en octets