1 /* 2 * intrusion_detection.h 3 * 4 * Copyright (C) 2011-21 - ntop.org 5 * 6 * This file is part of nDPI, an open source deep packet inspection 7 * library based on the OpenDPI and PACE technology by ipoque GmbH 8 * 9 * nDPI is free software: you can redistribute it and/or modify 10 * it under the terms of the GNU Lesser General Public License as published by 11 * the Free Software Foundation, either version 3 of the License, or 12 * (at your option) any later version. 13 * 14 * nDPI is distributed in the hope that it will be useful, 15 * but WITHOUT ANY WARRANTY; without even the implied warranty of 16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 17 * GNU Lesser General Public License for more details. 18 * 19 * You should have received a copy of the GNU Lesser General Public License 20 * along with nDPI. If not, see <http://www.gnu.org/licenses/>. 21 * 22 */ 23 24 #ifndef _INTRUSION_DETECTION_H_ 25 #define _INTRUSION_DETECTION_H_ 26 27 /* 28 Code to detect attacks reported in 29 30 https://www.unb.ca/cic/datasets/ids-2017.html 31 https://www.unb.ca/cic/datasets/ids-2018.html 32 */ 33 34 #include <stdio.h> 35 #include <stdlib.h> 36 #include "reader_util.h" 37 #include "ndpi_api.h" 38 39 typedef struct norm_values{ 40 double upper_bound; 41 double lower_bound; 42 double weight; 43 double value; 44 double norm_value; 45 }ndpi_norm_value; 46 47 double normalize(ndpi_norm_value* tresholds); 48 49 double get_flow_score(ndpi_norm_value* scores, int n_metrics); 50 51 /* ********************************** */ 52 53 double Ddos_score(struct ndpi_flow_info* flow); 54 55 double Dos_goldeneye_score(struct ndpi_flow_info* flow); 56 57 double Dos_hulk_score(struct ndpi_flow_info* flow); 58 59 double Dos_slow_score(struct ndpi_flow_info* flow); 60 61 double Ftp_patator_score(struct ndpi_flow_info* flow); 62 63 double Hearthbleed_score(struct ndpi_flow_info* flow); 64 65 double Infiltration_score(struct ndpi_flow_info* flow); 66 67 double Ssh_patator_score(struct ndpi_flow_info* flow); 68 69 #endif /* _INTRUSION_DETECTION_H_ */ 70