无人机蜂群>> Simple-DNS-tunneling-detector>> 返回
项目作者： leshark

项目描述 ：
This is a simple DNS tunneling detector written in pure python
高级语言： Python
项目地址: git://github.com/leshark/Simple-DNS-tunneling-detector.git
创建时间： 2020-08-18T15:30:53Z
项目社区：https://github.com/leshark/Simple-DNS-tunneling-detector
开源协议：MIT License
下载


Simple-DNS-tunneling-detector

Python 3.6
GitHub Workflow Status
GitHub repo size
GitHub
PRs Welcome

This is a simple DNS tunneling detector written at Fintech & Security Superhero hackathon


This code works on pure Python 3.7 and uses some simple metrics to detect DNS tunnels (only HTTP traffic supported)

Installation

  • Clone this repository into your local directory
  • Optionally set path to your directories or enable whitelist in config.ini
  • Go to your_directory/dns_tunneling_detector
  • Run python3 -m pip install -r requirements.txt

Now you can run the code with just python3 __main__.py

Installation with Docker

complete the first 3 steps of installation and then run the following:

  1. docker build -t dns-detector .
  2. docker run -v $(pwd):/app dns-detector

Remember to mount necessary directories (if you have changed them in config)

Installation with pip

  • Complete first 2 steps of installation
  • Run pip install -e .
  • Go to your_directory/dns_tunneling_detector
  • Now you can simply do python3 -m dns_tunneling_detector

Working scheme

The script consists of these simple steps:

  1. Traffic dumps are read from the input directory
  2. Every file is processed in parallel with dpkt library
  3. Each packet in the dump is checked according to the filtration algorithm
  4. Results are written in the output directory (CSV) alongside with log file and stats (JSON)

Note that to benefit the most from Python multiprocessing, traffic dumps
should be approximately one size

Filtration algorithm

The filtration algorithm uses simple criteria which are presented in the picture below:


Note that the result CSV will have such headers:
pcap_name | packet_number | probability(100%, high, medium, low(?)) | reason

TODO

Current improvement steps are available here

  • Add some statistical analysis
  • Apply machine learning to find the most suitable detection criteria
  • Rewrite in C++ for better speed

My humble attempt to rewrite it in C++ is here

Acknowledgments

Special thanks to my hackathon teammates:

Things to read