change the attacker direction of HTTP traffic, C&C channel, and conn …

…to blacklisted IPs detections
stratosphereips · Dec 16, 2023 · 2444830 · 2444830
1 parent 8953556
commit 2444830
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 6 deletions.
diff --git a/modules/http_analyzer/http_analyzer.py b/modules/http_analyzer/http_analyzer.py
@@ -421,7 +421,7 @@ def set_evidence_http_traffic(self, daddr, profileid, twid, uid, timestamp):
         source_target_tag = 'SendingUnencryptedData'
         category = 'Anomaly.Traffic'
         evidence_type = 'HTTPtraffic'
-        attacker_direction = 'dstip'
+        attacker_direction = 'srcip'
         attacker = daddr
         saddr = profileid.split('_')[-1]
         description = f'Unencrypted HTTP traffic from {saddr} to {daddr}.'

diff --git a/modules/rnn_cc_detection/rnn_cc_detection.py b/modules/rnn_cc_detection/rnn_cc_detection.py
@@ -42,7 +42,7 @@ def set_evidence(
 
         tupleid = tupleid.split('-')
         dstip, port, proto = tupleid[0], tupleid[1], tupleid[2]
-        attacker_direction = 'dstip'
+        attacker_direction = 'srcip'
         attacker = dstip
         source_target_tag = 'Botnet'
         evidence_type = 'Command-and-Control-channels-detection'

diff --git a/modules/threat_intelligence/threat_intelligence.py b/modules/threat_intelligence/threat_intelligence.py
@@ -106,7 +106,7 @@ def set_evidence_malicious_asn(
         """
         :param asn_info: the malicious asn info taken from own_malicious_iocs.csv
         """
-        attacker_direction = 'dstip'
+        attacker_direction = 'srcip'
         category = 'Anomaly.Traffic'
         evidence_type = 'ThreatIntelligenceBlacklistedASN'
         confidence = 0.8
@@ -161,16 +161,18 @@ def set_evidence_malicious_ip(
 
         confidence = 1
         category = 'Anomaly.Traffic'
-        if 'src' in attacker_direction:
+        if 'src' in ip_state:
             direction = 'from'
             opposite_dir = 'to'
             victim = daddr
-        elif 'dst' in attacker_direction:
+            attacker_direction = 'srcip'
+        elif 'dst' in ip_state:
             direction = 'to'
             opposite_dir = 'from'
             victim = profileid.split("_")[-1]
+            attacker_direction = 'srcip'
         else:
-            # attacker_dir is not specified?
+            # ip_state is not specified?
             return