Network Intrusion Detection using Zeek logs
Project description
AutoZeekWatch
AutoZeekWatch is a real-time, modular, configurable A.I. anomaly detector for Zeek logs. AutoZeekWatch enables you to generate anomaly scores for Zeek logs im real time, and correlate them with the initial 5-tuple and Zeek UID for downstream analysis, automated mitigation, and more.
Table of Contents
- Features
- Installation
- Examples
Features
AutoZeekWatch functions in two distinct phases, training and inference. Under the hood, KitNET, a ensemble of autoencoders, is used to generate anomaly scores for individual logs in a unsupervised manner.
During training, the model must learn the normal distribution from provided data. The user is expected to provide a directory where historical, normal (not malicious) logs are stored. The model then learns this distribution.
During inference, the model provides a score of how anomalous a given log is to the distribution learned from training. This score along with the 5-tuple (Source IP, Destination IP, Source Port, Destination Port, Proto) is then dumped to a file which can be used for downstream tasks or alerting.
It is possible to specify different zeek log types to train on and perform inference on. Currently, the following are available:
- Connection
- HTTP
- DNS
- SSH
- SSL
These can be used modularly, one, many, or all can be used at once.
Installation
...
Examples
Train a Model on Connection Data
python train.py --log-dir <PATH/TO/LOGS> --modules CONN
Start Inference on Incoming Connection Data
python infer.py --log-dir <PATH/TO/LOGS> --modules CONN
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for AutoZeekWatch-0.1.3-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | edfb8cd8ccf0e38c2d13c74bd7b261d8186c550a4dbec8975ba9563a825c2594 |
|
MD5 | 49b57faea8d92dc5298c0b5fb5b131fb |
|
BLAKE2b-256 | dc3ad88bc8b339974f36e5975a8be32c2691d2a9ec5e2621883aeb05d265ef3c |