1 /*
2  * intrusion_detection.h
3  *
4  * Copyright (C) 2011-21 - ntop.org
5  *
6  * This file is part of nDPI, an open source deep packet inspection
7  * library based on the OpenDPI and PACE technology by ipoque GmbH
8  *
9  * nDPI is free software: you can redistribute it and/or modify
10  * it under the terms of the GNU Lesser General Public License as published by
11  * the Free Software Foundation, either version 3 of the License, or
12  * (at your option) any later version.
13  *
14  * nDPI is distributed in the hope that it will be useful,
15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17  * GNU Lesser General Public License for more details.
18  *
19  * You should have received a copy of the GNU Lesser General Public License
20  * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
21  *
22  */
23 
24 #ifndef _INTRUSION_DETECTION_H_
25 #define _INTRUSION_DETECTION_H_
26 
27 /*
28   Code to detect attacks reported in
29 
30   https://www.unb.ca/cic/datasets/ids-2017.html
31   https://www.unb.ca/cic/datasets/ids-2018.html
32 */
33 
34 #include <stdio.h>
35 #include <stdlib.h>
36 #include "reader_util.h"
37 #include "ndpi_api.h"
38 
39 typedef struct norm_values{
40   double upper_bound;
41   double lower_bound;
42   double weight;
43   double value;
44   double norm_value;
45 }ndpi_norm_value;
46 
47 double normalize(ndpi_norm_value* tresholds);
48 
49 double get_flow_score(ndpi_norm_value* scores, int n_metrics);
50 
51 /* ********************************** */
52 
53 double Ddos_score(struct ndpi_flow_info* flow);
54 
55 double Dos_goldeneye_score(struct ndpi_flow_info* flow);
56 
57 double Dos_hulk_score(struct ndpi_flow_info* flow);
58 
59 double Dos_slow_score(struct ndpi_flow_info* flow);
60 
61 double Ftp_patator_score(struct ndpi_flow_info* flow);
62 
63 double Hearthbleed_score(struct ndpi_flow_info* flow);
64 
65 double Infiltration_score(struct ndpi_flow_info* flow);
66 
67 double Ssh_patator_score(struct ndpi_flow_info* flow);
68 
69 #endif /* _INTRUSION_DETECTION_H_ */
70