{"id":13705843,"url":"https://github.com/wrayjustin/yaids","last_synced_at":"2025-05-05T17:30:49.460Z","repository":{"id":40013043,"uuid":"323001463","full_name":"wrayjustin/yaids","owner":"wrayjustin","description":"YAIDS - Yara-Based IDS - Yara as an Intrusion Detection System / Yet Another Intrusion Detection System - An Intrusion Detection System (IDS) utilizing Yara and multi-threading","archived":false,"fork":false,"pushed_at":"2022-10-20T20:15:21.000Z","size":975,"stargazers_count":20,"open_issues_count":4,"forks_count":7,"subscribers_count":3,"default_branch":"main","last_synced_at":"2024-08-03T22:16:14.673Z","etag":null,"topics":["intrusion-detection","libpcap","libyara","multi-threading","network-analysis","pcap","yara"],"latest_commit_sha":null,"homepage":"https://yaids.io","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/wrayjustin.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"COPYING","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null}},"created_at":"2020-12-20T05:36:52.000Z","updated_at":"2023-10-16T10:18:05.000Z","dependencies_parsed_at":"2022-07-27T09:49:12.382Z","dependency_job_id":null,"html_url":"https://github.com/wrayjustin/yaids","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wrayjustin%2Fyaids","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wrayjustin%2Fyaids/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wrayjustin%2Fyaids/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wrayjustin%2Fyaids/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/wrayjustin","download_url":"https://codeload.github.com/wrayjustin/yaids/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":224455937,"owners_count":17314210,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["intrusion-detection","libpcap","libyara","multi-threading","network-analysis","pcap","yara"],"created_at":"2024-08-02T22:00:48.809Z","updated_at":"2024-11-13T13:30:59.216Z","avatar_url":"https://github.com/wrayjustin.png","language":"C","funding_links":[],"categories":["Rules"],"sub_categories":[],"readme":"# YAIDS\nYara-Based IDS\n\nYara as an Intrusion Detection System / Yet Another Intrusion Detection System\n\nAn Intrusion Detection System (IDS), utilizing Yara and multi-threading\n\n[![Build](https://github.com/wrayjustin/yaids/workflows/Build/badge.svg)](https://github.com/wrayjustin/yaids/actions?query=workflow%3ABuild)\n[![Code Analysis](https://github.com/wrayjustin/yaids/workflows/Code%20Analysis/badge.svg)](https://github.com/wrayjustin/yaids/actions?query=workflow%3A%22Code+Analysis%22)\n[![Tests](https://github.com/wrayjustin/yaids/workflows/Tests/badge.svg)](https://github.com/wrayjustin/yaids/actions?query=workflow%3ATests)\n\n[![License](https://img.shields.io/github/license/wrayjustin/yaids?label=License\u0026color=success)](https://github.com/wrayjustin/yaids/blob/main/COPYING)\n[![Latest Version](https://img.shields.io/github/v/tag/wrayjustin/yaids?label=Latest%20Version)](https://github.com/wrayjustin/yaids/tags)\n\n[![Website](https://img.shields.io/badge/Website-yaids.io-success)](https://yaids.io)\n[![Repo](https://img.shields.io/badge/Repo-yaids/main-success)](https://github.com/wrayjustin/yaids/)\n\n-----\n\n## Table of Contents\n\n * [Features](#features)\n * [Installation](#installation)\n   * [Prerequisites](#prerequisites)\n   * [Ubuntu (Quick Install)](#ubuntu-quick-install)\n   * [Other Distributions (Basic Install)](#other-distributions-basic-install)\n   * [Manual/Development Installation](#manualdevelopment-installation)\n   * [Manual (Without AutoTools)](#manual-without-autotools)\n * [Usage](#usage)\n   * [Examples](#examples)\n   * [Command Line Options](#options)\n   * [Output](#output)\n   * [Rules](#rules)\n     * [yaidsc](#yaidsc)\n     * [Packet Headers and Offsets](#packet-headers-and-offsets)\n     * [Offsets](#offsets)\n     * [Offset Examples](#offset-examples)\n     * [Yara External Variables](#yara-external-variables)\n * [Technical Details](#technical-details)\n   * [Threat Priority](#priority)\n   * [Data Queues](#data-queues)\n   * [Flowchart](#flowchart)\n   * [Code Testing](#code-testing)\n     * [Test Suite](#test-suite)\n     * [Automated Testing Workflows](#automated-testing-workflows)\n * [License](#license)\n\n-----\n\n## Features\n\nYAIDS is a Multi-Threaded Intrusion Detection System using Yara.\n\n * Multi-Threaded\n * Network/Stream IDS\n * Performant (written in C)\n * Yara Pattern Matching Engine\n * Supports any PCAP compatible data stream (Network, USB, Bluetooth, etc.)\n * Supports BPF (traffic filtering)\n * Supports all valid Yara rules (including modules)\n * Includes External Variables to build traffic/packet attribute conditions\n * Multiple logging modes (alerts, PCAP data, console, file, etc.)\n\n## Installation\n\n### Prerequisites\n* Development Toolkit (git, gcc, glibc, etc.)\n* libpcap\n* libyara (Version 4.X.X)\n* POSIX Platform (Linux, etc. -- YAIDS has been tested on Ubuntu 18.04 and 20.04)\n\n### Ubuntu (Quick Install)\n1. Review and verify the [`quick-install-ubuntu.sh`](https://raw.githubusercontent.com/wrayjustin/yaids/main/quick-install-ubuntu.sh) file.\n2. Run: `curl \"https://raw.githubusercontent.com/wrayjustin/yaids/main/quick-install-ubuntu.sh\" | bash`\n\n### Other Distributions (Basic Install)\n1. Install Development Tools (git, gcc, glibc, etc.)\n2. Install `libpcap` (including development headers)\n3. Install `libyara` (including development headers)\n4. Checkout the project: `git clone https://github.com/wrayjustin/yaids.git`\n5. Run: `./build.sh`\n\n### Manual/Development Installation\n1. Install Development Tools (git, gcc, glibc, etc.)\n2. Install `libpcap` (including development headers)\n3. Install `libyara` (including development headers)\n4. Checkout the project: `git clone https://github.com/wrayjustin/yaids.git`\n5. Run: `./init.sh`, `./configure`, `make`, and `make install`\n\n### Manual (Without AutoTools)\n1. Install Development Tools (git, gcc, glibc, etc.)\n2. Install `libpcap` (including development headers)\n3. Install `libyara` (including development headers)\n4. Compile (from the `src` directory): `gcc \u003cGCC OPTIONS\u003e yaids.c yaidsconf.c yaidsio.c yaidspcap.c\nyaidsyara.c yaidsthread.c -o yaids -I. -I.. -I../include/ -lpcap -lyara -lpthread -lm \u003cADDITIONAL LIBRARIES\u003e`\n\n### Versioning\nYAIDS uses a three value version number: X.Y.Z. The version number is a modified form of `SemVer` (Semantic Versioning).\n\nGiven the close dependency on `Yara`, the first version value maps to the compatible Major Yara release. While `libpcap`\nis another major dependency of `yaids`, `libpcap` maintains binary compatibility  across releases.\n\nThe YAIDS version fields: YARA_MAJOR.MAJOR.MINOR (For example, 4.0.0)\n\n* YARA_MAJOR - The compatible Yara (Major) version\n* MAJOR - Incremented on significant changes\n* MINOR - Incremented on minor changes or patches\n\nReleases that increment  the _YARA\\_MAJOR_ field are highly likely to be incompatible with differing versions of Yara.\nReleases that increment the _MAJOR_ field may be incompatible with previous `yaids` releases. Whereas _MINOR_ releases\nshould be forwards and backwards compatible within the same _YARA\\_MAJOR\\.MAJOR_ release family.\n\nNote: At present, YAIDS is provided via rolling-release; that is, there is currently only a single line of releases.\nHowever, that may potentially change on the release of the next _major_ Yara version.\n\n## Usage\nYAIDS can run on either an interface (live capture) or stored PCAP files. You can use any Yara supported rules.\n\n### Examples\nWhen running on a live interface, uee the following basic options: `yaids -i \u003cinterface\u003e -y \u003cpath/to/compiled/yara/rules\u003e`.\n\nTo process an exiisting PCAP file, use the following basic options: `yaids -r \u003cpath/to/pcap/file\u003e -y \u003cpath/to/compiled/yara/rules\u003e`.\n\n### Options\nYou can obtain more information from the help message by running: `yaids --help` or `man yaids`\n```\nYAIDS -- 4.0.1\n        Yara as an Intrusion Detection System / Yet Another Intrusion Detection System\n        An Intrusion Detection System (IDS), utilizing Yara and multi-threading\n        COPYRIGHT (C) Justin M. Wray | Licensed: BSD 3-Clause\n─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────\nUsage:\n        yaids\n                -i    \u003cDEVICE\u003e            Interface: The libpcap Interface Device name (-i or -r is required)\n                -r    \u003cFILE\u003e              Read: PCAP Input File (-i or -r is required)\n                -y    \u003cFILE\u003e              Rules: Yara Rules File, compiled (required)\n                -n    \u003cNAME\u003e              Prefix Name: Output files, prefix (optional, defaults to epoch)\n                -w    \u003cPATH\u003e              Output Path: Output path (optional, defaults to current working directory)\n                -f    \u003cFILE\u003e              BPF: BPF (PCAP Filter) File (optional, no traffic filtering)\n                -t    \u003cINT\u003e               Threads: Number of Yara Threads (optional, defaults to 2 + 4 x CPU cores)\n                -l    \u003cINT\u003e               Timelimit: Number of seconds to run, before exiting (optional, defaults to 0 - run until finished or interrupted)\n                -s                        Silent Mode: Write output files, but don't output alerts to STDOUT (optional, incompatible with Output Only Mode)\n                -o                        Output Only Mode: Output alerts to STDOUT only, does not write to files (optional, incompatible with Silent Mode)\n                -x                        Flush Mode: Prevents buffering of file output (optional)\n                -a                        Fast Alert Mode: Skip parsing packet headers for alerts (optional)\n                -d                        Debug Mode: Verbose output (optional)\n                -v                        Version: Show Version\n                -h                        Help: Show Help (this list)\n```\n\n### Output\nBy default, YAIDS processed output to both `stdout` and to log files. The default `stdout` provides alerts\n(rule matches), and two logs are generated - the alerts and PCAP of the triggered packets.\n\nThe alert output contains the following fields:\n * Timestamp (YYYY-MM-DD HH:MM:SS)\n * Rule Name\n * Matching Rule Condition and Trigger Location\n * Matching Packet Data\n * Header Length: Length Yara Processed / PCAP Capture Length / Original Packet Length\n * Protocols: Link-Layer / Network / Transport\n * Layer-2 Source \u003e Layer-2 Destination Addresses\n * Layer-3 Source \u003e Layer-3 Destination Addresses and Layer-4 Ports (Address:Port)\n\nAn example alert:\n\n`2020-12-20 01:01:01 - Metasploit_Download [$s1:0x42:3] {GET /metasploitframework-latest.msi}\n[171:171/171] (ETH/IP/TCP) 10:00:00:00:00:B3 \u003e 10:00:00:00:00:F7 - 198.51.100.12:41309 \u003e 203.0.113.37:80`\n\n### Rules\nYAIDS supports any Yara-compatible rule, including enabled and adequately configured modules.\n\nFor convenience, YAIDS also provides a \"drop-in\" replacement for `yara` (the Yara Rules Compiler).\nIn addition to some feature enhancements, `yaidsc` sets \"external\" variables for various packet offsets.\n\nYou can learn more about writing Yara rules from the Yara documentation: [Writing Yara Rules](https://yara.readthedocs.io/en/stable/writingrules.html).\n\n#### yaidsc\n`yaidsc` is a drop-in replacement for `yarac` using an identical syntax. If needed, you can also pass\nadditional options to `yarac`. Note that `yaidsc` is not a binary replacement for `yarac`; it is a\nwrapper script. The two major feature improvments are:\n * Multi-File Support, including Directories (which will compile all `*.yar` files in the directories provided)\n * External Variables for Packet Fields\n\n```\nUsage:\n        yaidsc \u003cINPUT [NAMESPACE]FILES|DIRECTORIES...\u003e \u003cOUTPUT FILE\u003e \n\n * If the input is a directory, all '.yar' files will be compiled.\n * You can compile multiple files or directories, one ruleset.\n * Namespaces can be provided, but only for individual files (not directories).\n ```\n\n#### Packet Headers and Offsets\nTo provide simple network-related rule creation, without the need to perform complex header parsing and\ncalculations, `yaids` includes a padded string-based header before the PCAP data. This additional data\nis only included during the `yara` scanning (not in the PCAP output, etc.). However, this does mean that\nthe Packet Offsets are modified, specifically by `255` bytes. As a result, the raw packet data (including\nthe unprocessed header) begins at offset `256`.\n\n##### Offsets\nThe processed (string-based) header uses the following format:\n\n| Value                                                              | Offset Location | Field Size |\n| ------------------------------------------------------------------ | --------------- | ---------- |\n| Payload Offset                                                     | 0               | 1 (Byte)   |\n| Original Packet (Length; This is regardless of the Capture Length) | 1               | 5 (Str)    |\n| Frame Protocol                                                     | 6               | 14 (Str)   |\n| Network Protocol                                                   | 20              | 14 (Str)   |\n| Transport Protocol                                                 | 34              | 14 (Str)   |\n| Frane Source Address                                               | 48              | 17 (Str)   |\n| Frame Destination Address                                          | 65              | 17 (Str)   |\n| Network Source Address                                            | 82              | 46 (Str)   |\n| Transport Source (Port)                                            | 128             | 5 (Str)    |\n| Network Destination Address:                                       | 133             | 46 (Str)   |\n| Transport Destination (Port)                                       | 179             | 5 (Str)    |\n\nAgain, the packet data begins at byte `256`.\n\n##### Offset Examples\nOne of the most powerful values of the processed header is the `Payload Offset`.\nThis offset value can be used in a `yara` `condition`, to match payload-specific data.\nKeep in mind, you need to jump an additional `255` bytes to the begining of he packet data,\nin additon to payload offset. For example:\n```yara\nrule example_01 {\n    meta:\n        author = \"YAIDS.io\"\n        description = \"YAIDS Example (HTTP GET Requests)\"\n        more_info = \"https://yaids.io\"\n    strings:\n        $string1 = \"GET\"\n    condition:\n        $string1 at (int8(0) + 255)\n}\n```\n\nThe remaining header offsets provide the ability to perform conditional matching (filtering) on the\nlisted packet attributes (addresses, ports, etc.). For example:\n```yara\nrule example_02 {\n    meta:\n        author = \"YAIDS.io\"\n        description = \"YAIDS Example (HTTP GET Requests)\"\n        more_info = \"https://yaids.io\"\n    strings:\n        $string1 = \"GET\"\n        $frameProtocol = \"ETH\"\n        $netProtocol = \"IP\"\n        $transportProtocol = \"TCP\"\n        $frameSource = \"00:16:47:9D:F2:C2\"\n        $frameDest = \"00:0C:29:89:D0:73\"\n        $networkSource = \"192.168.21.101\"\n        $transportSource = \"80\"\n        $networkDest = \"192.168.202.90\"\n        $transportDest = \"33783\"\n    condition:\n        $frameProtocol at 6 and\n        $netProtocol at 20 and\n        $transportProtocol at 34 and\n        $frameSource at 48 and\n        $frameDest at 65 and\n        $networkSource at 82 and\n        $transportSource at 128 and\n        $networkDest at 133 and\n        $transportDest at 179 and\n        $string1 at (int8(0) + 255)\n}\n```\n\n##### Yara External Variables\nTo simplify using the packet header values, `yaidsc` (the rule compliler) will automatically\nprovide `external variables`. When using `yaidsc` to compile your rules, there's no need to memorize\nthe offset locations.\n\nExternal Variables:\n\n| Value                                                              | Variable          |\n| ------------------------------------------------------------------ | ----------------- |\n| Original Packet (Length; This is regardless of the Capture Length) | headerStart       |\n| Frame Protocol                                                     | frameProtocol     |\n| Network Protocol                                                   | netProtocol       |\n| Transport Protocol                                                 | transportProtocol |\n| Frane Source Address                                               | frameSource       |\n| Frame Destination Address                                          | frameDest         |\n| Network Source Adderess                                            | networkSource     |\n| Transport Source (Port)                                            | transportSource   |\n| Network Destination Address:                                       | networkDest       |\n| Transport Destination (Port)                                       | transportDest     |\n\nCompare the previous two example to this example using the external variables:\n```yara\nrule example_03 {\n    meta:\n        author = \"YAIDS.io\"\n        description = \"YAIDS Example (HTTP GET Requests)\"\n        more_info = \"https://yaids.io\"\n    strings:\n        $string1 = \"GET\"\n        $frameProtocol = \"ETH\"\n        $netProtocol = \"IP\"\n        $transportProtocol = \"TCP\"\n        $frameSource = \"00:16:47:9D:F2:C2\"\n        $frameDest = \"00:0C:29:89:D0:73\"\n        $networkSource = \"192.168.21.101\"\n        $transportSource = \"80\"\n        $networkDest = \"192.168.202.90\"\n        $transportDest = \"33783\"\n    condition:\n        $frameProtocol at frameProtocol and\n        $netProtocol at netProtocol and\n        $transportProtocol at transportProtocol and\n        $frameSource at frameSource and\n        $frameDest at frameDest and\n        $networkSource at networkSource and\n        $transportSource at transportSource and\n        $networkDest at networkDest and\n        $transportDest at transportDest and\n        $string1 at (int8(0) + 255)\n}\n```\n\n#### Supported Protocols\nYAIDS supports all libpcap-compatible data (network or otherwise).\n\nHowever, the header parsing does have some limitations. Only the following protocols will be parsed.\n\n##### Supported Layer-2 / Frame Protocols\n\n| Protocol Name | YAIDS Value |\n| ------------- | ----------- |\n| Ethernet      | ETH         |\n\n##### Supported Layer-3 / Network Protocols\n\n| Protocol Name | YAIDS Value |\n| ------------- | ----------- |\n| IPv4          | IP          |\n| IPv6          | IP6         |\n| 8021AD        | 8021AD      |\n| 8021Q         | 8021Q       |\n| 8021QINQ      | 8021QINQ    |\n| AARP          | AARP        |\n| ARP           | ARP         |\n| ATALK         | ATALK       |\n| DECDNS        | DECDNS      |\n| DECDTS        | DECDTS      |\n| DN            | DN          |\n| IPX           | IPX         |\n| LANBRIDGE     | LANBRIDGE   |\n| LAT           | LAT         |\n| LOOPBACK      | LOOPBACK    |\n| MOPDL         | MOPDL       |\n| MOPRC         | MOPRC       |\n| MPLS          | MPLS        |\n| MPLS_MULTI    | MPLS_MULTI  |\n| NS            | NS          |\n| PPPOED        | PPPOED      |\n| PPPOES        | PPPOES      |\n| PPP           | PPP         |\n| PUP           | PUP         |\n| REVARP        | REVARP      |\n| SCA           | SCA         |\n| SPRITE        | SPRITE      |\n| TEB           | TEB         |\n| TRAIL         | TRAIL       |\n| VEXP          | VEXP        |\n| VPROD         | VPROD       |\n\n##### Supported Layer-4 / Transport Protocols\n\n| Protocol Name | YAIDS Value |\n| ------------- | ----------- |\n| TCP           | TCP         |\n| UDP           | UDP         |\n| ICMP          | ICMP        |\n\nRemember, you can write rules for _any_ traffic type, but if the protocols are not listed above,\n`yaids` will not automatically parse the headers and therefore will not populate the `External Variables`\n\nIn cases where the protocol is unsupported, the default value will be \"UNKN\", which will be used in the\nalert output and the `External Variables`.\n\n## Technical Details\nThe processing flow of YAIDS is straight-forward; data comes in, is processed, and then goes out: *INPUT-\u003ePROCESSING-\u003eOUTPUT*.\n\nThe complexity comes from multi-threading. Although network streams (from a device or file) are serial, the packets' processing\ncan be computationally expensive and long-lived. Put simply, packets traverse the network faster than an IDS can examine.\n\nYAIDS resolves this disadvantage by parallelizing the processing of packets. Thus, the flow is more complex:\n * Input: *INPUT-\u003eINPUT QUEUE*\n * Processing: *IINPUT QUEUE-\u003ePROCESSING-\u003eOUTPUT QUEUE*\n * Output: *OUTPUT QUEUE-\u003eOUTPUT*\n\nTo obtain a better understanding of this processing flow, review the flowchart.\n\n### Priority\nFor live captures, the *INPUT* is prioritized to prevent missing/dropping packets.\nFor offline processing (reading of a PCAP file), the processing is prioritized to optimize the speed.\n\nPriority is achieved through the utilization of a triple `mutex`:\n * Read/Low Priority\n * Next\n * Write/High Priority\n\n### Data Queues\nData queues are created via a series of `structs` with a pointer to the subsequent `struct`.\nThis is combined with a separate \"queue\" `struct` containing pointers to the *first* and *last* data `structs`.\n```\n+-----------------+     +-----------------+     +-----------------+     +-----------------+\n|                 |     |                 |     |                 |     |                 |\n|  DATA           |     |  DATA           |     |  DATA           |     |  DATA           |\n|                 |     |                 |     |                 |     |                 |\n|          Next*--------\u003e          Next*--------\u003e          Next*--------\u003e          Next*--------\u003eNULL\n+------^----------+     +-----------------+     +-----------------+     +------^----------+\n       |                                                                       |\n       |                                                                       |\n+------|-----------------------------------------------------------------------|----------+\n| First*                                                                   Last*          |\n|                                                                                         |\n|                                          QUEUE                                          |\n|                                                                                         |\n+-----------------------------------------------------------------------------------------+\n\n```\n\n### Flowchart\n\n```\n                                    *-----------------*\n                                    |                 |\n                                    |     Packets     |\n                                    |                 |\n                                    |                 |\n                                    *--------v--------*\n                                             |\n                                             |\n                                             |\n                                             |\n                                    #--------v--------#\n                                    |                 |\n                                    |     Input       |\n                                    |     Thread      |\n                                    |                 |\n                                    #--------v--------#\n                                             |\n                                             |\n                                             |\n                                             |\n                                    +--------V--------+\n                                    |                 |\n                                    |     Input       |\n                                    |     Queue       |\n                                    |                 |\n                                    +--v--v-----v--v--+\n         +-----------------------------+  |     |  +------------------------------\n         |                                |     |                                |\n         |                       +--------+     +--------+                       }\n         |                       |                       |                       |\n#--------V--------#     #--------V--------#     #--------V--------#     #--------V--------#\n|                 |     |                 |     |                 |     |                 |\n|    Yara         |     |    Yara         |     |    Yara         |     |    Yara         |\n|    Thread 1     |     |    Thread 2     |     |    Thread 3     |     |    Thread ...   |\n|                 |     |                 |     |                 |     |                 |\n#--------v--------#     #--------v--------#     #--------v--------#     #--------v--------#\n         |                       |                       |                       |\n         |                       +--------+     +--------+                       |\n         |                                |     |                                |\n         +-----------------------------+  |     |  +-----------------------------|\n                                    +--V--V-----V--V--+\n                                    |                 |\n                                    |     Output      |\n                                    |     Queue       |\n                                    |                 |\n                                    +--------v--------+\n                                             |\n                                             |\n                                             |\n                                             |\n                                    #--------V--------#\n                                    |                 |\n                                    |     Output      |\n                                    |     Thread      |\n                                    |                 |\n                                    #---v---------v---#\n                                        |         |\n                                        |         |\n                                 +------+         +------+\n                                 |                       |\n                        *--------V--------*     *--------V--------*\n                        |                 |     |                 |\n                        |      PCAP       |     |      Alert      |\n                        |      File       |     |      File       |\n                        |                 |     |                 |\n                        *-----------------*     *-----------------*\n```\n\n### Code Testing\nYAIDS is tested using both automated and manual processes. The testing conducted covers functional\ntesting, security testing, and code quality analysis.\n\nSome of the tools utilized for testing include:\n * [CodeQL](https://securitylab.github.com/tools/codeql)\n * [valgrind](https://valgrind.org/)\n * [AFL/american fuzzy lop](https://lcamtuf.coredump.cx/afl/)\n * [mutiny](https://github.com/Cisco-Talos/mutiny-fuzzer)\n * [ShellCheck](https://www.shellcheck.net/)\n * [gcc (-Wall and -Werror)](https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html)\n\nIn addition to the third-party tools listed above, `yaids` inclues a [_test suite_](https://github.com/wrayjustin/yaids/tree/main/tests).\n\n#### Test Suite\nThe test suite includes PCAP files and Yara Rules, and verifies that multiple modes of `yaids` return\nthe correct alerts and output.\n\nThe following modes are tested:\n * Output Mode\n * Silent Mode\n * Default Mode / Re-Processing of the Default Mode output\n\nThe following test cases are included in the test suite:\n\n| Test Name | Test Count  | Description                                    |\n| --------- | ----------- | -----------------------------------------------|\n| test_A    | 6           | HTTP Traffic/Rules                             |\n| test_B    | 3           | FTP Traffic/Rules                              |\n| test_C    | 1           | UDP Traffic/Rules                              |\n| test_D    | 9           | Traffic Attributes (Source, Destination, etc.) |\n| test_E    | 1           | Combined Ruleset                               |\n| test_F    | 3           | BPF Test                                       |\n\nAll tests are run three times to ensure consistent results. Additionally, the tests are run using\nboth standard PCAP and PCAPNG files.\n\nNOTE: The PCAP files included for testing purposes are sources from [NETRESEC](https://www.netresec.com/?page=MACCDC).\n\n#### Automated Testing Workflows\nThere are three sets of tests conducted automatically on the [yaids/main](https://github.com/wrayjustin/yaids) branch.\nThe statuses of these tests are displayed at the top of the documentation. Furthermore, you can view the\nhistorical results for these workflows via [GitHub Actions](https://github.com/wrayjustin/yaids/actions).\n\n * [Build Testing](https://github.com/wrayjustin/yaids/blob/main/.github/workflows/build.yml)\n * [Test Suite](https://github.com/wrayjustin/yaids/blob/main/.github/workflows/tests.yml)\n * [Code Quality/CodeQL](https://github.com/wrayjustin/yaids/blob/main/.github/workflows/codeql-analysis.yml)\n\n## License\n```\nCOPYRIGHT (C) 2020 Justin M. Wray - wray.justin@gmail.com / https://www.justinwray.com\nALL RIGHTS RESERVED\n\nRedistribution and use in source and binary forms, with or without modification,\nare permitted provided that the following conditions are met:\n\n1. Redistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer.\n\n2. Redistributions in binary form must reproduce the above copyright notice,\nthis list of conditions and the following disclaimer in the documentation and/or\nother materials provided with the distribution.\n\n3. Neither the name of the copyright holder nor the names of its contributors\nmay be used to endorse or promote products derived from this software without\nspecific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwrayjustin%2Fyaids","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fwrayjustin%2Fyaids","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwrayjustin%2Fyaids/lists"}