Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Improvements to metrics. SSH bruteforcing detection now done with metrics framework.

Browse source
This commit is contained in:
Seth Hall 2011-08-16 11:47:49 -04:00
parent 8286fdeea1
commit 82f94881c0
4 changed files with 85 additions and 58 deletions
Download patch file Download diff file Expand all files Collapse all files

69
scripts/base/frameworks/metrics/main.bro
View file

@ -15,6 +15,10 @@ export {
## current value to the logging stream. ## current value to the logging stream.
const default_break_interval = 15mins &redef; const default_break_interval = 15mins &redef;
## This is the interval for how often notices will happen after they have
## already fired.
const renotice_interval = 1hr &redef;
type Index: record { type Index: record {
## Host is the value to which this metric applies. ## Host is the value to which this metric applies.
host: addr &optional; host: addr &optional;
@ -56,7 +60,7 @@ export {
pred: function(index: Index): bool &optional; pred: function(index: Index): bool &optional;
## Global mask by which you'd like to aggregate traffic. ## Global mask by which you'd like to aggregate traffic.
aggregation_mask: count &optional; aggregation_mask: count &optional;
## This is essentially applying names to various subnets. ## This is essentially a mapping table between addresses and subnets.
aggregation_table: table[subnet] of subnet &optional; aggregation_table: table[subnet] of subnet &optional;
## The interval at which the metric should be "broken" and written ## The interval at which the metric should be "broken" and written
## to the logging stream. ## to the logging stream.
@ -69,7 +73,6 @@ export {
## A straight threshold for generating a notice. ## A straight threshold for generating a notice.
notice_threshold: count &optional; notice_threshold: count &optional;
## A series of thresholds at which to generate notices. ## A series of thresholds at which to generate notices.
## TODO: This is not implemented yet!
notice_thresholds: vector of count &optional; notice_thresholds: vector of count &optional;
## If this and a $notice_threshold value are set, this notice type ## If this and a $notice_threshold value are set, this notice type
## will be generated by the metrics framework. ## will be generated by the metrics framework.
@ -78,10 +81,11 @@ export {
global add_filter: function(id: ID, filter: Filter); global add_filter: function(id: ID, filter: Filter);
global add_data: function(id: ID, index: Index, increment: count); global add_data: function(id: ID, index: Index, increment: count);
global index2str: function(index: Index): string;
# This is the event that is used to "finish" metrics and adapt the metrics # This is the event that is used to "finish" metrics and adapt the metrics
# framework for clustered or non-clustered usage. # framework for clustered or non-clustered usage.
global log_it: event(filter: Filter); global log_it: event(filter: Filter);
global log_metrics: event(rec: Info); global log_metrics: event(rec: Info);
} }
@ -98,39 +102,58 @@ type MetricTable: table[Index] of count &default=0;
global store: table[ID, string] of MetricTable = table(); global store: table[ID, string] of MetricTable = table();
# This stores the current threshold index for filters using the # This stores the current threshold index for filters using the
# $notice_thresholds element. # $notice_threshold and $notice_thresholds elements.
global thresholds: table[string] of count = {} &default=0; global thresholds: table[ID, string, Index] of count = {} &create_expire=renotice_interval &default=0;
event bro_init() &priority=5 event bro_init() &priority=5
{ {
Log::create_stream(METRICS, [$columns=Info, $ev=log_metrics]); Log::create_stream(METRICS, [$columns=Info, $ev=log_metrics]);
} }
function index2str(index: Index): string
{
local out = "";
if ( index?$host )
out = fmt("%shost=%s", out, index$host);
if ( index?$network )
out = fmt("%s%snetwork=%s", out, |out|==0 ? "" : ", ", index$network);
if ( index?$str )
out = fmt("%s%sstr=%s", out, |out|==0 ? "" : ", ", index$str);
return fmt("metric_index(%s)", out);
}
function write_log(ts: time, filter: Filter, data: MetricTable) function write_log(ts: time, filter: Filter, data: MetricTable)
{ {
for ( index in data ) for ( index in data )
{ {
local val = data[index]; local val = data[index];
local m: Info = [$ts=ts, local m: Info = [$ts=ts,
$metric_id=filter$id, $metric_id=filter$id,
$filter_name=filter$name, $filter_name=filter$name,
$index=index, $index=index,
$value=val]; $value=val];
if ( m$index?$host && if ( (filter?$notice_threshold &&
filter?$notice_threshold && m$value >= filter$notice_threshold &&
m$value >= filter$notice_threshold ) [filter$id, filter$name, index] !in thresholds) ||
(filter?$notice_thresholds &&
|filter$notice_thresholds| <= thresholds[filter$id, filter$name, index] &&
m$value >= filter$notice_thresholds[thresholds[filter$id, filter$name, index]]) )
{ {
NOTICE([$note=filter$note, local n: Notice::Info = [$note=filter$note, $n=m$value, $metric_index=index];
$msg=fmt("Metrics threshold crossed by %s %d/%d", index$host, m$value, filter$notice_threshold), n$msg = fmt("Metrics threshold crossed by %s %d/%d", index2str(index), m$value, filter$notice_threshold);
$src=m$index$host, $n=m$value, if ( m$index?$str )
$metric_index=index]); n$sub = m$index$str;
} if ( m$index?$host )
n$src = m$index$host;
else if ( filter?$notice_thresholds && # TODO: not sure where to put the network yet.
m$value >= filter$notice_thresholds[thresholds[cat(filter$id,filter$name)]] )
{ NOTICE(n);
# TODO: implement this
# This just needs set to some value so that it doesn't refire the
# notice until it expires from the table or it cross the next
# threshold in the case of vectors of thesholds.
++thresholds[filter$id, filter$name, index];
} }
if ( filter$log ) if ( filter$log )
@ -193,7 +216,6 @@ function add_data(id: ID, index: Index, increment: count)
! filter$pred(index) ) ! filter$pred(index) )
next; next;
local filt_store = store[id, filter$name];
if ( index?$host ) if ( index?$host )
{ {
if ( filter?$aggregation_mask ) if ( filter?$aggregation_mask )
@ -208,8 +230,9 @@ function add_data(id: ID, index: Index, increment: count)
} }
} }
if ( index !in filt_store ) local metric_tbl = store[id, filter$name];
filt_store[index] = 0; if ( index !in metric_tbl )
filt_store[index] += increment; metric_tbl[index] = 0;
metric_tbl[index] += increment;
} }
} }

4
scripts/base/frameworks/metrics/non-cluster.bro
View file

@ -1,10 +1,6 @@
module Metrics; module Metrics;
export {
}
event Metrics::log_it(filter: Filter) event Metrics::log_it(filter: Filter)
{ {
local id = filter$id; local id = filter$id;

64
scripts/policy/protocols/ssh/detect-bruteforcing.bro
View file

@ -11,6 +11,12 @@ export {
## has now had a heuristically successful login attempt. ## has now had a heuristically successful login attempt.
Login_By_Password_Guesser, Login_By_Password_Guesser,
}; };
redef enum Metrics::ID += {
## This metric is to measure failed logins with the hope of detecting
## bruteforcing hosts.
FAILED_LOGIN,
};
## The number of failed SSH connections before a host is designated as ## The number of failed SSH connections before a host is designated as
## guessing passwords. ## guessing passwords.
@ -35,45 +41,47 @@ export {
global password_guessers: set[addr] &read_expire=guessing_timeout+1hr &synchronized; global password_guessers: set[addr] &read_expire=guessing_timeout+1hr &synchronized;
} }
event bro_init()
{
Metrics::add_filter(FAILED_LOGIN, [$name="detect-bruteforcing", $log=F,
$note=Password_Guessing,
$notice_threshold=password_guesses_limit,
$break_interval=guessing_timeout]);
}
event SSH::heuristic_successful_login(c: connection) event SSH::heuristic_successful_login(c: connection)
{ {
local id = c$id; local id = c$id;
# TODO: this should be migrated to the metrics framework. # TODO: This is out for the moment pending some more additions to the
if ( id$orig_h in password_rejections && # metrics framework.
password_rejections[id$orig_h]$n > password_guesses_limit && #if ( id$orig_h in password_guessers )
id$orig_h !in password_guessers ) # {
{ # NOTICE([$note=Login_By_Password_Guesser,
add password_guessers[id$orig_h]; # $conn=c,
NOTICE([$note=Login_By_Password_Guesser, # $n=password_rejections[id$orig_h]$n,
$conn=c, # $msg=fmt("Successful SSH login by password guesser %s", id$orig_h),
$n=password_rejections[id$orig_h]$n, # $sub=fmt("%d failed logins", password_rejections[id$orig_h]$n)]);
$msg=fmt("Successful SSH login by password guesser %s", id$orig_h), # }
$sub=fmt("%d failed logins", password_rejections[id$orig_h]$n)]);
}
} }
event SSH::heuristic_failed_login(c: connection) event SSH::heuristic_failed_login(c: connection)
{ {
local id = c$id; local id = c$id;
# presumed failure # Add data to the FAILED_LOGIN metric unless this connection should
if ( id$orig_h !in password_rejections ) # be ignored.
password_rejections[id$orig_h] = new_track_count();
# Track the number of rejections
# TODO: this should be migrated to the metrics framework.
if ( ! (id$orig_h in ignore_guessers && if ( ! (id$orig_h in ignore_guessers &&
id$resp_h in ignore_guessers[id$orig_h]) ) id$resp_h in ignore_guessers[id$orig_h]) )
++password_rejections[id$orig_h]$n; Metrics::add_data(FAILED_LOGIN, [$host=id$orig_h], 1);
if ( default_check_threshold(password_rejections[id$orig_h]) ) #if ( default_check_threshold(password_rejections[id$orig_h]) )
{ # {
add password_guessers[id$orig_h]; # add password_guessers[id$orig_h];
NOTICE([$note=Password_Guessing, # NOTICE([$note=Password_Guessing,
$conn=c, # $conn=c,
$msg=fmt("SSH password guessing by %s", id$orig_h), # $msg=fmt("SSH password guessing by %s", id$orig_h),
$sub=fmt("%d apparently failed logins", password_rejections[id$orig_h]$n), # $sub=fmt("%d apparently failed logins", password_rejections[id$orig_h]$n),
$n=password_rejections[id$orig_h]$n]); # $n=password_rejections[id$orig_h]$n]);
} # }
} }

6
testing/btest/Baseline/policy.frameworks.metrics.notice/notice.log
View file

@ -1,4 +1,4 @@
# ts uid id.orig_h id.orig_p id.resp_h id.resp_p note msg sub src dst p n peer_descr actions policy_items dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude metric_index.host metric_index.str metric_index.network # ts uid id.orig_h id.orig_p id.resp_h id.resp_p note msg sub src dst p n peer_descr actions policy_items dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude metric_index.host metric_index.str metric_index.network
1313432466.662314 - - - - - Test_Notice Metrics threshold crossed by 6.5.4.3 2/1 - 6.5.4.3 - - 2 bro Notice::ACTION_LOG 4 - - - - - - 6.5.4.3 - - 1313508844.321207 - - - - - Test_Notice Metrics threshold crossed by metric_index(host=6.5.4.3) 2/1 - 6.5.4.3 - - 2 bro Notice::ACTION_LOG 4 - - - - - - 6.5.4.3 - -
1313432466.662314 - - - - - Test_Notice Metrics threshold crossed by 1.2.3.4 3/1 - 1.2.3.4 - - 3 bro Notice::ACTION_LOG 4 - - - - - - 1.2.3.4 - - 1313508844.321207 - - - - - Test_Notice Metrics threshold crossed by metric_index(host=1.2.3.4) 3/1 - 1.2.3.4 - - 3 bro Notice::ACTION_LOG 4 - - - - - - 1.2.3.4 - -
1313432466.662314 - - - - - Test_Notice Metrics threshold crossed by 7.2.1.5 1/1 - 7.2.1.5 - - 1 bro Notice::ACTION_LOG 4 - - - - - - 7.2.1.5 - - 1313508844.321207 - - - - - Test_Notice Metrics threshold crossed by metric_index(host=7.2.1.5) 1/1 - 7.2.1.5 - - 1 bro Notice::ACTION_LOG 4 - - - - - - 7.2.1.5 - -