https://github.com/stratosphereips/idps-comparison-tool-scripts
Contains the scripts needed to extract the information used by our IDPS comparison tool
https://github.com/stratosphereips/idps-comparison-tool-scripts
Last synced: 6 months ago
JSON representation
Contains the scripts needed to extract the information used by our IDPS comparison tool
- Host: GitHub
- URL: https://github.com/stratosphereips/idps-comparison-tool-scripts
- Owner: stratosphereips
- License: gpl-2.0
- Created: 2024-02-21T12:40:41.000Z (over 2 years ago)
- Default Branch: main
- Last Pushed: 2025-01-09T11:44:47.000Z (over 1 year ago)
- Last Synced: 2025-09-04T23:54:17.845Z (11 months ago)
- Language: Python
- Size: 27.1 MB
- Stars: 1
- Watchers: 3
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Contributing: .github/CONTRIBUTING.md
- License: LICENSE
- Code of conduct: .github/CODE_OF_CONDUCT.md
- Citation: CITATION.cff
- Security: .github/SECURITY.md
Awesome Lists containing this project
README
# Features
This repo contains the following scripts in scripts/ dir consider this branch a different tool.
* a script for extracting the accumulated threat levels from slips alerts.json
* a script for extracting the ground truth labels for each time window given the conn.log.labeled for a given IP
* a script to determine the best threshold for sips based on the extracted threat levels and ground truth
# Installation
pip3 install -r requirements.txt
---
# Usage
```python3 -m pip install -r requirements.txt```
##### command for generating all zeek files in the dataset/
``` zeek -C -r tcp_inactivity_timeout=60mins tcp_attempt_delay=1min```
##### command for labeling conn.log files
``` python3 netflowlabeler.py -c labels.config -f /path/to/generated/conn.log ```
Note that the conn.log given to netflowlabeler should be tab-separated, not json.
netflow labeler will drop the conn.log.labeled in the same directory of the given conn.log
##### (optional) To label the rest of the Zeek files using an already labeled conn.log file (conn.log.labeled)
```zeek-files-labeler.py -l conn.log.labeled -f folder-with-zeek-log-files```
##### command for extracting max accumulated threat level for all timewindows from an alert.json
```
python3 -m scripts.max_accumulated_score_extractor_for_slips alerts.json
```
##### command for getting the best slips threshold given the extracted ground truth labels and max accumulated scores
Note: this script assumes the correct ground truth labels are in scripts/extracted_gt_tw_labels.py
and the correct max accumulated scores of slips are in scripts/extracted_levels.py
Note: This script completely discards flows and timewindows with any label other than benign or malicious, e.g. background, unknown label, no label etc.
* to print the metrics to cli
```
python3 -m scripts.slips_metrics_getter
```
* to plot the metrics
```
python3 -m scripts.slips_metrics_getter -p
```
Note: To print and plot the metrics, scripts/extracted_scores/extracted_levels.py must t be updated using the
max_accumulated_score_extractor_for_slips.py script
##### command for extracting ground truth labels from a conn.log.labeled file
note: we only extract the labels per timewindow per ip
```
python3 main.py -gtf conn.log.labeled -i
```
* To extract the ground truth timewindow labels
python3 -m scripts.ground_truth_timewindow_labels_extractor -gtf conn.log.labeled -i 147.32.83.234
# About
This repo was developed at the Stratosphere Laboratory at the Czech Technical University in Prague.