d4-project/analyzer-d4-pibs

Passive Identification of BackScatter (analyzer for D4 project)

analyzer-d4-pibs's Issues

ISN=dest ip scanner list

Provide a list of IPs setting the initial sequence number ISN to the destination IP address to identify Mirai or similar bots.

Make pibs to write pcap with Anon dest IP

pibs could rewrite the pcap and anonymize the dst_ip that contains the collector network.
RST and SYN-ACK traffic should be easy to rewrite.

Does pibs extract icmp?

Keep statistics between backscatter versus non-backscatter TCP traffic

Keep statistics between backscatter versus non-backscatter TCP traffic to have an idea on the ratio in a specific pcap (no need to keep the non-backscatter flows).

feature to write csv files

Add feature to write csv files in directories year/month/year-month-day.txt

remove memcpy for handling ip addresses

Evaluate the usage of ipv4->ip_src.s_addr instead of memcpy

Slow scanner detection

Provide a list of slow scanning IP addresses.

add generic preprocessing callback function

Add a callback function before the IPs are inserted in the hash table to give the user access to all packets not only the filtered ones.

Scanner MISP warning list

Provide a MISP warning list of well known network scanners.

Extend IP hashtable with destination IPs

Extend the IP hash table in synseen.c with additional information such as destination IP addresses.

Scanner identification

Create a profile for scanning IPs such that they can be deduced from potential backscatter.

Provide input feed for bgp ranking

Provide a feed of IP addresses potentially under DDOS that can be consumed by bgpranking. Hence, a ranking of AS can be done that are frequently under DDOS.