{"id":40943340,"url":"https://github.com/stratosphereips/idps-comparison-tool-scripts","last_synced_at":"2026-01-22T04:37:33.263Z","repository":{"id":223706296,"uuid":"761203135","full_name":"stratosphereips/IDPS-Comparison-Tool-Scripts","owner":"stratosphereips","description":"Contains the scripts needed to extract the information used by our IDPS comparison tool","archived":false,"fork":false,"pushed_at":"2025-01-09T11:44:47.000Z","size":28380,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-09-04T23:54:17.845Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/stratosphereips.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":".github/CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":".github/CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":"CITATION.cff","codeowners":null,"security":".github/SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2024-02-21T12:40:41.000Z","updated_at":"2025-01-09T11:44:33.000Z","dependencies_parsed_at":"2024-11-11T14:27:29.798Z","dependency_job_id":"a87602fc-581d-4134-bc1e-ab0e5aae65f7","html_url":"https://github.com/stratosphereips/IDPS-Comparison-Tool-Scripts","commit_stats":null,"previous_names":["stratosphereips/idps-comparison-tool-scripts"],"tags_count":28,"template":false,"template_full_name":"stratosphereips/awesome-code-template","purl":"pkg:github/stratosphereips/IDPS-Comparison-Tool-Scripts","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stratosphereips%2FIDPS-Comparison-Tool-Scripts","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stratosphereips%2FIDPS-Comparison-Tool-Scripts/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stratosphereips%2FIDPS-Comparison-Tool-Scripts/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stratosphereips%2FIDPS-Comparison-Tool-Scripts/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/stratosphereips","download_url":"https://codeload.github.com/stratosphereips/IDPS-Comparison-Tool-Scripts/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stratosphereips%2FIDPS-Comparison-Tool-Scripts/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28654890,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-22T01:17:37.254Z","status":"online","status_checked_at":"2026-01-22T02:00:07.137Z","response_time":144,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-01-22T04:37:32.535Z","updated_at":"2026-01-22T04:37:33.258Z","avatar_url":"https://github.com/stratosphereips.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Features\n\nThis repo contains the following scripts in scripts/ dir consider this branch a different tool.\n  *  a script for extracting the accumulated threat levels from slips alerts.json\n  *  a script for extracting the ground truth labels for each time window given the conn.log.labeled for a given IP\n  *  a script to determine the best threshold for sips based on the extracted threat levels and ground truth \n\n\n# Installation\n\npip3 install -r requirements.txt\n\n---\n\n\n# Usage\n\n\n```python3 -m pip install -r requirements.txt```\n\n##### command for generating all zeek files in the dataset/\n\n``` zeek -C -r \u003cpcap\u003e  tcp_inactivity_timeout=60mins tcp_attempt_delay=1min```\n\n\n##### command for labeling conn.log files\n\n``` python3 netflowlabeler.py -c labels.config -f /path/to/generated/conn.log ```\n\nNote that the conn.log given to netflowlabeler should be tab-separated, not json.\nnetflow labeler will drop the conn.log.labeled in the same directory of the given conn.log\n\n##### (optional) To label the rest of the Zeek files using an already labeled conn.log file (conn.log.labeled)\n\n```zeek-files-labeler.py -l conn.log.labeled -f folder-with-zeek-log-files```\n\n##### command for extracting max accumulated threat level for all timewindows from an alert.json \n\n```\npython3 -m scripts.max_accumulated_score_extractor_for_slips alerts.json \u003chost_ip\u003e \u003cused_slips_threshold\u003e\n```\n\n\n##### command for getting the best slips threshold given the extracted ground truth labels and max accumulated scores\n\nNote: this script assumes the correct ground truth labels are in scripts/extracted_gt_tw_labels.py\nand the correct max accumulated scores of slips are in scripts/extracted_levels.py \n\nNote: This script completely discards flows and timewindows with any label other than benign or malicious, e.g. background, unknown label, no label etc.\n\n* to print the metrics to cli\n```\npython3 -m scripts.slips_metrics_getter \n```\n\n* to plot the metrics\n```\npython3 -m scripts.slips_metrics_getter  -p\n```\n\nNote: To print and plot the metrics, scripts/extracted_scores/extracted_levels.py must t be updated using the\nmax_accumulated_score_extractor_for_slips.py script\n\n##### command for extracting ground truth labels from a conn.log.labeled file\nnote: we only extract the labels per timewindow per ip\n\n```\npython3 main.py -gtf conn.log.labeled -i \u003chost_ip\u003e\n```\n\n\n* To extract the ground truth timewindow labels\n\n    python3 -m scripts.ground_truth_timewindow_labels_extractor -gtf conn.log.labeled -i 147.32.83.234\n\n\n\n# About\nThis repo was developed at the Stratosphere Laboratory at the Czech Technical University in Prague.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstratosphereips%2Fidps-comparison-tool-scripts","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstratosphereips%2Fidps-comparison-tool-scripts","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstratosphereips%2Fidps-comparison-tool-scripts/lists"}