Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix "non-http port 80 established connections" evidence FP #1230

Merged
merged 46 commits into from
Feb 11, 2025
Merged

Fix "non-http port 80 established connections" evidence FP #1230

merged 46 commits into from
Feb 11, 2025

Conversation

AlyaGomaa
Copy link
Collaborator

closes #1218

@AlyaGomaa
flowalerts.md: document how Non-SSL connections on port 443 works
c216f35
@AlyaGomaa
docs: add missing images
9223691
@AlyaGomaa
flowalerts.md: document how Non-SSL connections on port 443 works
9dc2d80
@AlyaGomaa
docs: add missing images
a146678
@AlyaGomaa
http: add an http.py file to remove the http logic from conn.py to
1ec1d44
@AlyaGomaa
Merge remote-tracking branch 'origin/alya/fix_non_http_port_80_fp' in…
24514ff 
…to alya/fix_non_http_port_80_fp
@AlyaGomaa
flowalerts: delete http.py. all http logic should be in http_analyzer.py
857f28c
@AlyaGomaa
flowalerts: move all http logic to http_analyzer.py
b629c6e
@AlyaGomaa
http_analyzer: avoid FP non http port 80 evidence by waiting for the …
7ac7cc9 
…recognized http flow 5 minutes before and after the pending evidence
@AlyaGomaa
http_analyzer.py: move the function that sets "non-http" evidence fro…
41917bf 
…m flowalerts/ to http_analyzer/
@AlyaGomaa
test15: add a conn.log with 2 flows, one detected as http and the oth…
3e79f47 
…er not, this conn.log shouldnt trigger a "non-http" evidence in slips
@AlyaGomaa
move all functions that just set evidence to http_analyzer/set_evidence
d6ea40f
@AlyaGomaa
update the docs
e950249
@AlyaGomaa
Add unit tests for the new way of detecting "non-http port 80" evidence
2ae038c
@AlyaGomaa
flowmldetection.py: fix having the current real-time timestamp instea…
be6c1c4 
…d of the zeek flow timestamp when setting evidence
@AlyaGomaa
update set_evidence.py unit tests
ea6c7c7
@AlyaGomaa
tests/: fix problem importing SetEvidenceHelper
33ba75f
@AlyaGomaa
evidence_handler.py: remove extra \n at the end of some evidence
8e61fd3
@AlyaGomaa
db: refactor add_mac_addr_to_profile()
a4651d9
@AlyaGomaa
conn: dont detect device changing IPs from link local srcips or "0.0.…
4c2fd95 
…0.0" and "255.255.255.255"
@AlyaGomaa
dns: dont detect invalid dns answers if the query is a local multicas…
405fb44 
…t DNS query
@AlyaGomaa
dns: dont detect invalid dns answers if the query ends with .arpa
8926ed9
@AlyaGomaa
slips_utils: add a function to check if an ip is localhost
c83f5bc
@AlyaGomaa
conn: exclude localhost and special ipv4 ips from "different localnet…
2445832 
… connection" evidence
@AlyaGomaa
test_profile_handler.py: fix calling _is_gw_mac()
e4baa96
@AlyaGomaa
test_profile_handler.py: update unit tests
d7851cc
@AlyaGomaa
test_pcap_dataset.py: remove the test for dataset/test7-malicious.pcap
d45b0cb
@AlyaGomaa
Merge pull request #1233 from stratosphereips/alya/fix_device_changin…
a357722 
…g_ips_detection

Fix "device changing IPs", "Invalid DNS answers" and "different localnet connection" FPs
@AlyaGomaa
flowalerts.md: document how Non-SSL connections on port 443 works
59783f4
@AlyaGomaa
docs: add missing images
b954203
@AlyaGomaa
http: add an http.py file to remove the http logic from conn.py to
ceb81ca
@AlyaGomaa
flowalerts: delete http.py. all http logic should be in http_analyzer.py
6cc069e
@AlyaGomaa
flowalerts: move all http logic to http_analyzer.py
8a5b9e1
@AlyaGomaa
http_analyzer: avoid FP non http port 80 evidence by waiting for the …
3b3fb09 
…recognized http flow 5 minutes before and after the pending evidence
@AlyaGomaa
http_analyzer.py: move the function that sets "non-http" evidence fro…
3122c77 
…m flowalerts/ to http_analyzer/
@AlyaGomaa
test15: add a conn.log with 2 flows, one detected as http and the oth…
24abb9c 
…er not, this conn.log shouldnt trigger a "non-http" evidence in slips
@AlyaGomaa
move all functions that just set evidence to http_analyzer/set_evidence
f595801
@AlyaGomaa
update the docs
8ef5c28
@AlyaGomaa
Add unit tests for the new way of detecting "non-http port 80" evidence
4c222c0
@AlyaGomaa
flowmldetection.py: fix having the current real-time timestamp instea…
d6c1716 
…d of the zeek flow timestamp when setting evidence
@AlyaGomaa
update set_evidence.py unit tests
067ecc8
@AlyaGomaa
tests/: fix problem importing SetEvidenceHelper
fbbe848
@AlyaGomaa
evidence_handler.py: remove extra \n at the end of some evidence
780b4a5
@AlyaGomaa
Merge remote-tracking branch 'origin/alya/fix_non_http_port_80_fp' in…
693f3b8 
…to alya/fix_non_http_port_80_fp
@AlyaGomaa
update .secrets.baseline
1a5b4d8
@AlyaGomaa
flowalerts: fix problem runnner analyze() of all analyzers
f74fc4b
@AlyaGomaa AlyaGomaa merged commit cb7658e into develop Feb 11, 2025
67 checks passed
@AlyaGomaa AlyaGomaa deleted the alya/fix_non_http_port_80_fp branch February 11, 2025 17:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
Slips
Status: Done
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@AlyaGomaa