{"id":13508107,"url":"https://github.com/iqiyi/qnsm","last_synced_at":"2025-04-05T07:04:23.608Z","repository":{"id":45526165,"uuid":"211754556","full_name":"iqiyi/qnsm","owner":"iqiyi","description":"QNSM is network security monitoring framework based on DPDK.","archived":false,"fork":false,"pushed_at":"2021-09-27T05:54:02.000Z","size":987,"stargazers_count":524,"open_issues_count":10,"forks_count":188,"subscribers_count":42,"default_branch":"master","last_synced_at":"2025-03-29T06:03:50.946Z","etag":null,"topics":["anti-ddos","dpdk","kernel-bypass","network-analysis","network-security","security","suricata"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/iqiyi.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-09-30T01:52:02.000Z","updated_at":"2025-03-21T14:20:54.000Z","dependencies_parsed_at":"2022-09-11T15:51:25.536Z","dependency_job_id":null,"html_url":"https://github.com/iqiyi/qnsm","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/iqiyi%2Fqnsm","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/iqiyi%2Fqnsm/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/iqiyi%2Fqnsm/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/iqiyi%2Fqnsm/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/iqiyi","download_url":"https://codeload.github.com/iqiyi/qnsm/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247299831,"owners_count":20916190,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["anti-ddos","dpdk","kernel-bypass","network-analysis","network-security","security","suricata"],"created_at":"2024-08-01T02:00:48.083Z","updated_at":"2025-04-05T07:04:23.591Z","avatar_url":"https://github.com/iqiyi.png","language":"C","funding_links":[],"categories":["C","security"],"sub_categories":[],"readme":"![logo.png](./resources/pic/logo.png)\r\n\r\n# 简介\r\nQNSM(IQIYI Network Security Monitor) 是一个旁路部署的全流量，实时，高性能网络安全监控引擎，基于DPDK开发，集成了DDOS检测和IDPS模块。\r\n\r\n## DDOS检测\r\nDDOS检测功能包括:\r\n- *全流量检测*，可以部署在IDC环境，支持SYN，ACK，RST，FIN，SYNACK，ICMP，UDP FLOOD以及反射攻击(DNS/NTP/SSDP反射...).\r\n- *实时多维度聚合数据*\r\n- *流采样数据*，提供攻击事件未检出后的fall back机制.\r\n- *随时停启的聚合数据输出*\r\n- *数据以json格式输出*，便于数据分析.\r\n- *针对UDP反射攻击，提供DFI/DPI机制*(MEMCACHE，TFTP，CHARGEN，CLDAP，QOTD...).\r\n- *事件过程中dump攻击数据包*.\r\n- *支持IPv4和IPv6*\r\n\r\n## IDPS\r\nIDPS模块基于[Suricata](https://github.com/OISF/suricata)，并新增了如下特性，\r\n* 支持lib化编译安装，基于Suricata 4.1.0版本\r\n* 支持事件以Kafka方式输出，提升事件吞吐量，便于进一步数据分析\r\n\r\n## 部署描述\r\n![deploy.JPG](./resources/pic/deploy.JPG)\r\n\r\n## 架构描述\r\n整体功能模块图如下：\r\n\r\n![qnsm.png](./resources/pic/qnsm.png)\r\n\r\n* 基础模块\r\n\r\n    包含PORT，CPU 消息、配置文件、表项管理接口、调度框架等基础功能模块。\r\n* 流水线模块\r\n\r\n\tSESSM：DDOS检测，负责IPv4和IPv6数据包解析，采样FLOW数据聚合，应用层DFI解析，ACL策略下发。\r\n\t\r\n\tSIP_AGG：DDOS检测攻击源聚合和输出。\r\n\t\r\n\tVIP_AGG：DDOS检测VIP自学习，数据聚合和输出。\r\n\t\r\n\tDUMP：DDOS攻击数据包DUMP并保存为pcap文件。\r\n\t\r\n\tEDGE：类似于broker，输出多维数据至KAFKA。\r\n\t\r\n\tDETECT：IDPS检测。\r\n* 控制面和工具\r\n\r\n\t主要包括Master组件以及相关配置文件。\r\n\t\r\n\tMaster负责接收分析中心的攻击事件策略并下发至相应的转发面组件，包含dump数据包，攻击源，攻击源端口，反射攻击proto DFI。\r\n* IDPS管理服务\r\n\r\n    FM/FR：IDPS 资源管理和回收\r\n    \r\n    CS：IDPS 统计数据\r\n\r\n更多细节参考 [`GUIDE`](./doc/guide.md).\r\n\r\n## 外部会议介绍\r\n* QCon Shanghai 2019 [PPT](https://static001.geekbang.org/con/44/pdf/420097813/file/卢明樊.pdf  \"爱奇艺网络流量安全检测能力建设实践\")\r\n\r\n# 快速启动\r\n## 测试环境\r\n测试环境如下：\r\n- Linux Distribution: CentOS Linux release 7.2.1511\r\n- Kernel: 3.10.0-327.el7.x86_64\r\n- CPU: Intel(R) Xeon(R) CPU E5-2650 v4 @ 2.20GHz\r\n- NIC: Intel Corporation 82599ES 10-Gigabit SFI/SFP+ Network Connection (rev 01)\r\n- Memory: 100G+ with two NUMA node.\r\n- GCC: gcc version 4.8.5 20150623 (Red Hat 4.8.5-4)\r\n\r\n## 依赖安装\r\nCentos：\r\n```bash\r\n$ yum install -y libpcap-devel pcre-devel file-devel libyaml-devel jansson-devel libcap-ng-devel librdkafka-devel nss-devel nspr-devel make gcc\r\n$ yum install -y libxml2-devel\r\n$ yum install -y  python-pip\r\n$ pip install configparser\r\n```\r\n\r\n## DPDK 环境准备\r\n\r\nQNSM没有对dpdk版本有特殊要求，我们使用的稳定版本是dpdk-stable-16.11.2。\r\n\r\n```bash\r\n$ mkdir -p /opt/qnsm_deps/\r\n$ cd /opt/qnsm_deps/\r\n$ wget https://fast.dpdk.org/rel/dpdk-16.11.2.tar.xz   # download from dpdk.org if link failed.\r\n$ tar vxf dpdk-16.11.2.tar.xz\r\n```\r\n\r\n### DPDK 编译安装\r\n\r\n```bash\r\n$ cd dpdk-stable-16.11.2\r\n$ export RTE_SDK=`pwd`\r\n$ export RTE_TARGET=x86_64-native-linuxapp-gcc\r\n$ make install T=${RTE_TARGET} DESTDIR=install\r\n```\r\n\r\n## 编译\r\n\r\n### 下载代码\r\n```bash\r\n$ cd /opt\r\n$ git clone https://github.com/iqiyi/qnsm.git\r\n$ cd qnsm\r\n```\r\n### 运行环境\r\n修改配置文件conf/dpdk_env.cfg，我们这里使用ens7f0和ens7f1两张网卡。\r\n```ini\r\n[NIC1]\r\nname=ens7f0\r\n\r\n[NIC2]\r\nname=ens7f1\r\n```\r\n\r\n运行环境配置脚本。\r\n```bash\r\n$ python ./scripts/setup_dpdk_env.py conf/dpdk_env.cfg\r\n$ ${RTE_SDK}/tools/dpdk-devbind.py --status\r\n\r\nNetwork devices using DPDK-compatible driver\r\n============================================\r\n0000:06:00.0 '82599ES 10-Gigabit SFI/SFP+ Network Connection' drv=igb_uio unused=\r\n0000:06:00.1 '82599ES 10-Gigabit SFI/SFP+ Network Connection' drv=igb_uio unused=   \r\n\r\n$ cat /proc/meminfo | grep Huge\r\nAnonHugePages:   9955328 kB\r\nHugePages_Total:   '11264'\r\nHugePages_Free:        0\r\nHugePages_Rsvd:        0\r\nHugePages_Surp:        0\r\nHugepagesize:      '2048 kB'\r\n```\r\nens7f0（0000:06:00.0）和ens7f1（0000:06:00.0）网卡驱动已经绑定DPDK驱动。\r\n\r\n### 编译安装IDPS lib\r\n\r\n如果已安装IDPS lib，可以跳过该步。\r\n\r\n运行`build_idps.sh`脚本，该脚本会安装patch/suricata-4.1.0/0001-IDPS-make-as-a-lib-support-kafka.patch补丁并编译为lib。\r\n```bash\r\n$ cd scripts\r\n$ sh build_idps.sh\r\n$ ls /usr/local/lib | egrep 'suri|htp'\r\nlibhtp.a  libhtp.la  libhtp.so  libhtp.so.2  libhtp.so.2.0.0  libsuri.a  libsuri.la  libsuri.so  libsuri.so.0  libsuri.so.0.0.0 \r\n$ ls /usr/local/include/ | egrep 'suri|htp'\r\nhtp  suricata\r\n```\r\n\r\n### 编译QNSM\r\n\r\n运行`build_qnsm_lib.sh` shell脚本编译QNSM基础库。\r\n```bash\r\n$ sh build_qnsm_lib.sh \r\n$ ll $RTE_SDK/$RTE_TARGET/lib/libqnsm_service.a\r\n```\r\n\r\n支持编译成debug或者release版本，默认release版本。\r\n\r\ndebug版本提供一些调试命令用于展示运行时数据。如果需要编译debug版本，执行以下命令。\r\n```\r\n$ cat ../config\r\nCONFIG_QNSM_LIBQNSM_IDPS=y\r\nCONFIG_DEBUG_QNSM=n\r\n$ sed -i '/CONFIG_DEBUG_QNSM/s/=n/=y/g' ../config\r\n```\r\n编译qnsm主程序。\r\n```\r\n$ cd ..\r\n$ make\r\n$ make install\r\n$ ls /var/qnsm\r\nsuricata.yaml  qnsm_edge.xml  qnsm-inspect  qnsm_inspect.cfg qnsm_sessm.xml  qnsm-test  qnsm_vip.xml\r\n```\r\nddos、idps、ddos-idps是qnsm支持的三种部署形态，默认以ddos-idps形态安装配置文件；如果以idps形态部署，make install T=idps。\r\n\r\n## 配置文件\r\n\r\n启动QNSM之前，需要依据[`配置手册`](./doc/configure-tutorial.md)修改`/var/qnsm`安装目录下的配置文件。 \r\n\r\n## 启动 QNSM\r\nQNSM日志支持syslog输出，相关配置如下，可以参考[`配置手册`](./doc/configure-tutorial.md)。\r\n```\r\n$ cat /var/qnsm/qnsm_edge.xml \r\n\u003cCONFIG\u003e\r\n...\r\n    \u003clog\u003e\r\n            \u003csyslog\u003e\r\n                    \u003cfacility\u003elocal5\u003c/facility\u003e\r\n                    \u003clog-level\u003eCritical\u003c/log-level\u003e\r\n            \u003c/syslog\u003e\r\n    \u003c/log\u003e\r\n\u003c/CONFIG\u003e\r\n```\r\n\r\n修改syslog配置，日志存储在/var/log/qnsm目录下。\r\n```\r\n$ mkdir -p /var/log/qnsm\r\n$ cp -f conf/qnsm_syslog.conf /etc/rsyslog.d\r\n$ systemctl restart rsyslog.service\r\n$ cp -f conf/qnsm.logrotate /etc/logrotate.d\r\n$ logrotate /etc/logrotate.conf\r\n```\r\n\r\n创建suricata.yaml配置文件中的目录列表，包括规则文件目录，日志目录等。\r\n```\r\n$ mkdir -p /var/log/suricata\r\n```\r\n\r\n启动QNSM。\r\n```bash\r\n$ cd /var/qnsm\r\n$ ./qnsm-inspect -f qnsm_inspect.cfg -c . -p 3\r\n```\r\n* -f 参数指定组件配置文件\r\n* -c 参数指定配置文件目录\r\n* -p 参数指定使用网卡ID的16进制掩码，如果有两张网卡，该值为3（0b0011），依此类推\r\n\r\n另外，可以编写多个部署配置文件（qnsm_inspect_x.cfg），这样的话，可以启动多个QNSM进程。\r\n\r\n## 测试QNSM消息接口\r\nQNSM提供多种kafka消息接口接口与外部交互。消息接口格式参考 [`MSG FORMAT`](./doc/msg.md)。\r\n\r\n### DDOS检测\r\n#### 数据接口\r\n消费`qnsm_vip_agg`，可以基于VIP粒度实现DDOS检测。\r\n\r\n消费`qnsm_sip_agg`，获取DDOS事件的攻击源IP。\r\n\r\n消费`qnsm_vip_dport`, `qnsm_vip_sport`，获取VIP源目的端口的流量数据。\r\n\r\n消费`qnsm_sample_flow`, 可以基于流采样实现DDOS检测。\r\n\r\n#### 控制接口\r\n由于IDC环境带宽大，聚合数据量过大会消耗QNSM本身的资源，因此基于一定策略实现数据输出。\r\n\r\n`qnsm_command` topic用于接收策略消息。\r\n\r\n以DDOS dump数据包为例，基于事件开始和结束策略实现dump数据包。\r\n```bash\r\n$ ./rdkafka_example -P -t qnsm_command -b xxx-kafka:9092\r\n% Type stuff and hit enter to send\r\n{\"id\":0,\"op\":\"ip_dump_pkt_enable\",\"content\":[{\"idc\":\"idc_aaa\",\"proto\":\"any\",\"vip\":\"11.22.33.44\",\"vport\":\"any\"}]}\r\n% Sent 120 bytes to topic qnsm_command partition -1\r\n{\"id\":0,\"op\":\"ip_dump_pkt_disable\",\"content\":[{\"idc\":\"idc_aaa\",\"proto\":\"any\",\"vip\":\"11.22.33.44\",\"vport\":\"any\"}]}\r\n% Sent 121 bytes to topic qnsm_command partition -1\r\n```\r\n\r\n检查日志\r\n```bash\r\n$ cat qnsm_log_qnsm | grep 'master cmd'\r\nQNSM: 1557921514 master cmd msg {\"id\":0,\"op\":\"ip_dump_pkt_enable\",\"content\":[{\"idc\":\"idc_aaa\",\"proto\":\"any\",\"vip\":\"11.22.33.44\",\"vport\":\"any\"}]}\r\n```\r\n\r\n检查pcap文件，默认存储在运行目录下面的dump目录，支持配置修改存储目录。\r\n```bash\r\n$ ls dump\r\nxx.xx.xx.xx-core5-20191018-1522.pcap\r\n```\r\ndump目录配置如下，可以参考[`配置手册`](./doc/configure-tutorial.md)。\r\n```\r\n$ cat /var/qnsm/qnsm_edge.xml \r\n\u003cCONFIG\u003e\r\n...\r\n    \u003cdump-dir\u003e/data/qnsm\u003c/dump-dir\u003e\r\n\u003c/CONFIG\u003e\r\n```\r\n\r\n### IDPS事件\r\n消费`nsm_event` kafka topic，进一步实现实时展示和分析事件。\r\n```json\r\n{\r\n    \"timestamp\":\"2019-08-23T17:06:35.284049+0800\",\r\n    \"flow_id\":1854917666668179,\r\n    \"event_type\":\"alert\",\r\n    \"src_ip\":\"A.B.C.D\",\r\n    \"src_port\":60013,\r\n    \"dest_ip\":\"78.46.222.60\",\r\n    \"dest_port\":457,\r\n    \"proto\":\"TCP\",\r\n    \"alert\":{\r\n        \"action\":\"allowed\",\r\n        \"gid\":1,\r\n        \"signature_id\":2024792,\r\n        \"rev\":4,\r\n        \"signature\":\"ET POLICY Cryptocurrency Miner Checkin\",\r\n        \"category\":\"attack_medium\",\r\n        \"severity\":2,\r\n        \"metadata\":{\r\n            \"updated_at\":[\r\n                \"2018_06_15\"\r\n            ],\r\n            \"created_at\":[\r\n                \"2017_10_02\"\r\n            ],\r\n            \"signature_severity\":[\r\n                \"Minor\"\r\n            ],\r\n            \"deployment\":[\r\n                \"Perimeter\"\r\n            ],\r\n            \"attack_target\":[\r\n                \"Client_Endpoint\"\r\n            ],\r\n            \"affected_product\":[\r\n                \"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"\r\n            ],\r\n            \"former_category\":[\r\n                \"POLICY\"\r\n            ]\r\n        }\r\n    },\r\n    \"flow\":{\r\n        \"pkts_toserver\":3,\r\n        \"pkts_toclient\":1,\r\n        \"bytes_toserver\":401,\r\n        \"bytes_toclient\":66,\r\n        \"start\":\"2019-08-23T17:06:35.065171+0800\"\r\n    },\r\n    \"payload_hex\":\"7B226964223A312C226A736F6E727063223A22322E30222C226D6574686F64223A226C6F67696E222C22706172616D73223A7B226C6F67696E223A2278222C2270617373223A2278222C226167656E74223A22584D5269675C2F322E31332E31202857696E646F7773204E542031302E303B2057696E36343B2078363429206C696275765C2F312E32342E31206D7376635C2F32303137222C22616C676F223A5B22636E5C2F776F77222C22636E5C2F72222C22636E5C2F32222C22636E5C2F31222C22636E5C2F30222C22636E5C2F78746C222C22636E225D7D7D0A\",\r\n    \"stream\":0,\r\n    \"host\":\"sensor-name\"\r\n}\r\n```\r\n\r\n# 性能测试\r\n由于QNSM转发面基于流水线架构，因此需要平衡各个组件分配的CPU资源。\r\n\r\n数据包吞吐可以线性增长，但是瓶颈存在于压力最大的那个组件。\r\n\r\n在我们的测试环境中, 开启超线程， DDOS检测和IDPS混合部署，[performance](doc/performance.md)包含测试方法和数据。\r\n\r\n# 版权说明\r\n\r\n[License](./LICENSE.md)\r\n\r\n# 开源合作\r\n\r\n`QNSM` 由 爱奇艺[iQiYi](https://www.iqiyi.com) 安全团队开发. 已经应用网路安全边界控制等多种场景。\r\n\r\n作为一个开源项目，欢迎更多的合作和贡献。目前，QNSM 项目除了 iQiYi 部署相关的脚本，代码全部托管在 github 上。我们维护 2 个长线分支：\r\n\r\n* master（主干分支）：功能稳定的分支，除了紧急 hot bugfix，不接受直接向该分支提交代码。\r\n* devel（开发分支）：最新的功能会进入该分支，验证稳定后进入 master 分支。\r\n\r\n另外，在每次不向前兼容的更新前（比如更新 DPDK 版本），我们会新建一个 LTS 分支，并维护约一年时间。\r\n\r\nQNSM 开发合作采用 Git workflow 的工作方式，具体可以参考[Contributing](CONTRIBUTING.md)文档，我们欢迎更多的开发者的参与和贡献。\r\n\r\n* 邮件组: qnsm_devel#qiyi.com (请用@替换#).\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fiqiyi%2Fqnsm","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fiqiyi%2Fqnsm","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fiqiyi%2Fqnsm/lists"}