def signature_detect(datetime, eventid, accountname, clientaddr, servicename, processname, objectname, sharedname, securityid):
""" Detect attack using signature based detection.
:param datetime: Datetime of the event
:param eventid: EventID
:param accountname: Accountname
:param clientaddr: Source IP address
:param servicename: Service name
:param processname: Process name(command name)
:param objectname: Object name
:return : True(1) if attack, False(0) if normal
"""
inputLog = InputLog.InputLog(datetime, eventid, accountname, clientaddr, servicename, processname, objectname, sharedname, securityid)
return SignatureDetector.signature_detect(inputLog)
def preds():
global DOMAIN_NAME
response = jsonify()
datetime = request.form.get('datetime', None)
eventid = request.form.get('eventid', None)
org_accountname = request.form.get('accountname', None)
clientaddr = request.form.get('clientaddr', None)
servicename = request.form.get('servicename', None)
processname = request.form.get('processname', None)
objectname = request.form.get('objectname', None)
sharedname = request.form.get('sharedname', None)
datetime = datetime.strip("'")
eventid = eventid.strip("'")
if org_accountname != None:
accountname = org_accountname.strip("'")
accountname = accountname.lower()
accountname = accountname.split('@')[0]
if (accountname.find(DOMAIN_NAME) > -1 or len(accountname) == 0):
return SignatureDetector.RESULT_NORMAL
if clientaddr != None:
clientaddr = clientaddr.strip("'")
if servicename != None:
servicename = servicename.strip("'")
servicename = servicename.lower()
if processname != None:
processname = processname.strip("'")
processname = processname.lower()
if objectname != None:
objectname = objectname.strip("'")
objectname = objectname.lower()
if sharedname != None:
sharedname = sharedname.strip("'")
sharedname = sharedname.lower()
inputLog = InputLog.InputLog(datetime, eventid, accountname, clientaddr,
servicename, processname, objectname,
sharedname)
result = SignatureDetector.signature_detect(inputLog)
print(inputLog.get_eventid() + "," + inputLog.get_accountname() + "," +
inputLog.get_clientaddr() + "," + inputLog.get_processname())
print(result)
return result
def preds(row):
#print(row)
datetime = row[1]
eventid = row[3]
msg = row[5]
item = msg.split("\n")
org_accountname = ""
clientaddr = ""
sharedname = ""
servicename = ""
processname = ""
objectname = ""
securityid = ""
if (eventid in TARGET_EVT):
item_account = [s for s in item if 'Account Name' in s]
org_accountname = item_account[0].split(":")[1]
item_clientaddr = ""
item_clientaddr = [s for s in item if 'Source Address' in s]
if len(item_clientaddr) == 0:
item_account = [s for s in item if 'Client Address' in s]
if len(item_clientaddr) == 0:
item_account = [s for s in item if 'Source Network Address' in s]
if (len(item_clientaddr) >= 2):
clientaddr = item_clientaddr[0].split(":")[1]
item_service = ""
item_service = [s for s in item if 'Service Name' in s]
if (len(item_service) >= 2):
servicename = item_service[0].split(":")[1]
item_process = ""
item_process = [s for s in item if 'Process Name' in s]
if (len(item_process) >= 2):
processname = item_process[0].split("New Process Name:")[1]
item_obj = ""
item_obj = [s for s in item if 'Object Name' in s]
if (len(item_obj) >= 2):
objectname = item_obj[0].split(":")[1]
item_id = ""
item_id = [s for s in item if 'Security ID' in s]
if (len(item_id) >= 2):
securityid = item_id[0].split(":")[1]
if (eventid == SignatureDetector.EVENT_SHARE):
item_sharedname = [s for s in item if 'Share Name' in s]
sharedname = item_sharedname[0].split(":")[1]
else:
return SignatureDetector.RESULT_NORMAL
datetime = datetime.strip("'")
eventid = eventid.strip("'")
if org_accountname != None:
accountname = org_accountname.strip("'")
accountname = accountname.lower()
accountname = accountname.split('@')[0]
if (accountname.find(DOMAIN_NAME) > -1 or len(accountname) == 0):
return SignatureDetector.RESULT_NORMAL
if clientaddr != None:
clientaddr = clientaddr.strip("'")
if servicename != None:
servicename = servicename.strip("'")
servicename = servicename.lower()
if processname != None:
processname = processname.strip("'")
processname = processname.lower()
if objectname != None:
objectname = objectname.strip("'")
objectname = objectname.lower()
if sharedname != None:
sharedname = sharedname.strip("'")
sharedname = sharedname.lower()
# To specify parameter as Object
inputLog = InputLog.InputLog(datetime, eventid, accountname, clientaddr,
servicename, processname, objectname,
sharedname, securityid)
# update start by gam
result = SignatureDetector.signature_detect(inputLog)
# update end
clientaddr = inputLog.get_clientaddr()
processname = inputLog.get_processname()
if (result == SignatureDetector.RESULT_CMD
or result == SignatureDetector.RESULT_MAL_CMD):
if (mode == MODE_ML):
result = ML.preds(eventid, accountname, processname, objectname,
base_dummies_4674, clf_4674, base_dummies_4688,
clf_4688)
else:
processname = processname.strip().strip("'")
result = SignatureDetector.check_cmd_whitelist(processname)
if (result != SignatureDetector.RESULT_NORMAL
and result != ML.RESULT_WARN):
print("attack!!")
#send_alert.Send_alert(result, datetime, eventid, accountname, clientaddr, servicename, processname, objectname, sharedname)
with open(RESULT_FILE, 'a') as f:
writer = csv.writer(f)
writer.writerow([
datetime, eventid, accountname, clientaddr, servicename,
processname, objectname, sharedname, result
])
return result
def preds():
global DOMAIN_NAME
# loading
response = jsonify()
datetime = request.form.get('datetime',None)
eventid = request.form.get('eventid',None)
org_accountname = request.form.get('accountname',None)
clientaddr = request.form.get('clientaddr',None)
servicename = request.form.get('servicename',None)
processname = request.form.get('processname',None)
objectname = request.form.get('objectname',None)
sharedname = request.form.get('sharedname',None)
securityid = request.form.get('securityid', None)
datetime = datetime.strip("'")
eventid = eventid.strip("'")
if org_accountname != None:
accountname = org_accountname.strip("'")
accountname = accountname.lower()
accountname = accountname.split('@')[0]
if (accountname.find(DOMAIN_NAME)> -1 or len(accountname)==0):
return SignatureDetector.RESULT_NORMAL
if clientaddr != None:
clientaddr = clientaddr.strip("'")
if servicename != None:
servicename = servicename.strip("'")
servicename = servicename.lower()
if processname != None:
processname = processname.strip("'")
processname = processname.lower()
if objectname != None:
objectname = objectname.strip("'")
objectname = objectname.lower()
if sharedname != None:
sharedname = sharedname.strip("'")
sharedname = sharedname.lower()
if securityid != None:
securityid = securityid.strip("'")
securityid = securityid.lower()
# To specify parameter as Object
inputLog = InputLog.InputLog(datetime, eventid, accountname, clientaddr, servicename, processname, objectname, sharedname, securityid)
# update start by gam
result = SignatureDetector.signature_detect(inputLog)
# update end
clientaddr = inputLog.get_clientaddr()
processname=inputLog.get_processname()
tactics=''
if (result == SignatureDetector.RESULT_CMD or result == SignatureDetector.RESULT_MAL_CMD):
if(mode==MODE_ML):
result = ML.preds(eventid, accountname, processname, objectname, base_dummies_4674, clf_4674, base_dummies_4688, clf_4688)
else:
processname = processname.strip().strip("'")
result = SignatureDetector.check_cmd_whitelist(processname)
if (result != SignatureDetector.RESULT_NORMAL and result != ML.RESULT_WARN and result != SignatureDetector.WARN):
print(result)
print(inputLog.get_eventid() + "," + inputLog.get_accountname() + "," + inputLog.get_clientaddr() + "," + inputLog.get_processname()+ "," + inputLog.get_sharedname())
tactics=identify_attack.identify_tactics(result,inputLog)
send_alert.Send_alert(result+","+tactics, datetime, clientaddr, eventid, accountname, clientaddr, servicename, processname, objectname, sharedname)
return result+","+tactics
def parse_event(org_row):
global cnt, id, idlist
#print(row)
row = [i.strip('\t') for i in org_row]
datetime = row[1]
eventid = row[3]
msg = row[5]
item = msg.split("\n")
org_accountname = ""
clientaddr = ""
sharedname = ""
servicename = ""
processname = ""
objectname = ""
securityid = ""
if (eventid == EVENT_ST):
cnt = cnt + 1
if (eventid in TARGET_EVT):
item_account = [s for s in item if 'Account Name' in s]
if len(item_account) == 0:
item_account = [s for s in item if 'Logon Account' in s]
org_accountname = item_account[0].split(":")[1]
if eventid == EVENT_LOGIN:
org_accountname = item_account[1].split(":")[1]
item_clientaddr = ""
item_clientaddr = [s for s in item if 'Source Address' in s]
if len(item_clientaddr) == 0:
item_clientaddr = [s for s in item if 'Client Address' in s]
if len(item_clientaddr) == 0:
item_clientaddr = [
s for s in item if 'Source Network Address' in s
]
if len(item_clientaddr) == 0:
item_clientaddr = [s for s in item if 'Source Workstation' in s]
if (len(item_clientaddr) >= 1):
clientaddrs = item_clientaddr[0].split(":")
clientaddr = clientaddrs[len(clientaddrs) - 1]
item_service = ""
item_service = [s for s in item if 'Service Name' in s]
if (len(item_service) >= 2):
servicename = item_service[0].split(":")[1]
item_process = ""
item_process = [s for s in item if 'Process Name' in s]
if (len(item_process) >= 2):
processname = item_process[0].split("New Process Name:")[1]
elif (len(item_process) >= 1):
processname = item_process[0].split("Process Name:")[1]
item_obj = ""
item_obj = [s for s in item if 'Object Name' in s]
if (len(item_obj) >= 2):
objectname = item_obj[0].split(":")[1]
item_id = ""
item_id = [s for s in item if 'Security ID' in s]
if (len(item_id) >= 2):
securityid = item_id[0].split(":")[1]
if (eventid == EVENT_SHARE):
item_sharedname = [s for s in item if 'Share Name' in s]
sharedname = item_sharedname[0].split(":")[1]
datetime = datetime.strip("'")
eventid = eventid.strip("'")
if org_accountname != None:
accountname = org_accountname.strip("'")
accountname = accountname.lower()
accountname = accountname.split('@')[0]
if (accountname.find(DOMAIN_NAME) > -1 or len(accountname) == 0):
return
if clientaddr != None:
clientaddr = clientaddr.strip("'")
if servicename != None:
servicename = servicename.strip("'")
servicename = servicename.lower()
if processname != None:
processname = processname.strip("'")
processname = processname.lower()
if objectname != None:
objectname = objectname.strip("'")
objectname = objectname.lower()
if sharedname != None:
sharedname = sharedname.strip("'")
sharedname = sharedname.lower()
id = ""
id = (accountname + clientaddr + str(id)).strip()
id = id.replace(" ", "").replace("\t", "")
idlist.add(id)
inputLog = InputLog.InputLog(datetime, eventid, accountname,
clientaddr, servicename, processname,
objectname, sharedname, securityid)
create_input_DL(inputLog)
return
def parse_event_jp(org_row):
global cnt, id, idlist
#print(row)
row = [i.strip('\t') for i in org_row]
datetime = row[1]
eventid = row[3]
msg = row[5]
item = msg.split("\n")
org_accountname = ""
clientaddr = ""
sharedname = ""
servicename = ""
processname = ""
objectname = ""
securityid = ""
if (eventid == EVENT_ST):
cnt = cnt + 1
if (eventid in TARGET_EVT):
item_account = [s for s in item if 'アカウント名' in s]
if len(item_account) == 0:
item_account = [s for s in item if 'ログオン アカウント' in s]
org_accountname = item_account[0].split(":")[1]
if eventid == EVENT_LOGIN:
org_accountname = item_account[1].split(":")[1]
item_clientaddr = ""
item_clientaddr = [s for s in item if 'ソース アドレス' in s]
if len(item_clientaddr) == 0:
item_clientaddr = [s for s in item if 'クライアント アドレス' in s]
if len(item_clientaddr) == 0:
item_clientaddr = [s for s in item if 'ソース ネットワーク アドレス' in s]
if len(item_clientaddr) == 0:
item_clientaddr = [s for s in item if 'ソース ワークステーション' in s]
if (len(item_clientaddr) >= 1):
clientaddrs = item_clientaddr[0].split(":")
clientaddr = clientaddrs[len(clientaddrs) - 1]
item_service = ""
item_service = [s for s in item if 'サービス名' in s]
if (len(item_service) >= 2):
servicename = item_service[0].split(":")[1]
item_process = ""
item_process = [s for s in item if 'プロセス名' in s]
if (len(item_process) >= 2):
processname = item_process[0].split("新しいプロセス名:")[1]
elif (len(item_process) >= 1):
processname = item_process[0].split("プロセス名:")[1]
item_obj = ""
item_obj = [s for s in item if 'オブジェクト名' in s]
if (len(item_obj) >= 2):
objectname = item_obj[0].split(":")[1]
item_id = ""
item_id = [s for s in item if 'セキュリティ IDD' in s]
if (len(item_id) >= 2):
securityid = item_id[0].split(":")[1]
if (eventid == EVENT_SHARE):
item_sharedname = [s for s in item if '共有名' in s]
sharedname = item_sharedname[0].split(":")[1]
datetime = datetime.strip("'")
eventid = eventid.strip("'")
if org_accountname != None:
accountname = org_accountname.strip("'")
accountname = accountname.lower()
accountname = accountname.split('@')[0]
if (accountname.find(DOMAIN_NAME) > -1 or len(accountname) == 0):
return
if clientaddr != None:
clientaddr = clientaddr.strip("'")
if servicename != None:
servicename = servicename.strip("'")
servicename = servicename.lower()
if processname != None:
processname = processname.strip("'")
processname = processname.lower()
if objectname != None:
objectname = objectname.strip("'")
objectname = objectname.lower()
if sharedname != None:
sharedname = sharedname.strip("'")
sharedname = sharedname.lower()
id = ""
id = (accountname + clientaddr + str(id)).strip()
id = id.replace(" ", "").replace("\t", "")
idlist.add(id)
inputLog = InputLog.InputLog(datetime, eventid, accountname,
clientaddr, servicename, processname,
objectname, sharedname, securityid)
create_input_DL(inputLog)
return
fo.write("datetime,eventid,accountname,clientaddr,servicename,processname,objectname,sharedname,result_sig,result_ML\n")
for row in f:
datetime=row.get("datetime")
eventid=row.get("eventid")
accountname=row.get("accountname")
clientaddr=row.get("clientaddr")
servicename=row.get("servicename")
processname=row.get("processname")
objectname=row.get("objectname")
sharedname=row.get("sharedname")
#print(datetime+","+eventid+","+accountname+","+clientaddr)
# To specify parameter as Object
inputLog = InputLog.InputLog(datetime, eventid, accountname, clientaddr, servicename, processname, objectname,sharedname)
sig_result=SignatureDetector.signature_detect(inputLog)
#print("sig_result"+sig_result)
result=sig_result
if (sig_result == SignatureDetector.RESULT_CMD or sig_result == SignatureDetector.RESULT_MAL_CMD):
result = ML.ml_detect(eventid, accountname, processname, objectname, base_dummies_4674, clf_4674, base_dummies_4688, clf_4688)
#print("result" + result)
csvlist = []
csvlist.append(datetime)
csvlist.append(eventid)
csvlist.append(accountname)
csvlist.append(clientaddr)
csvlist.append(servicename)
csvlist.append(processname)
def preds(row, file):
global logfile
datetime = ''
eventid = ''
accountname = ''
clientaddr = ''
servicename = ''
processname = ''
objectname = ''
sharedname = ''
result = ''
file = ''
try:
datetime = row[1]
eventid = row[3]
msg = row[5]
item = msg.split("\n")
org_accountname = ""
clientaddr = ""
sharedname = ""
servicename = ""
processname = ""
objectname = ""
securityid = ""
if (eventid in TARGET_EVT):
if eventid == SignatureDetector.EVENT_NTLM:
item_account = [s for s in item if 'ログオン アカウント' in s]
org_accountname = item_account[0].split(":")[1]
else:
item_account = [s for s in item if 'アカウント名' in s]
org_accountname = item_account[0].split(":")[1]
if eventid == SignatureDetector.EVENT_LOGIN:
org_accountname = item_account[1].split(":")[1]
item_clientaddr = ""
item_clientaddr = [s for s in item if '送信元アドレス' in s]
if len(item_clientaddr) == 0:
item_clientaddr = [s for s in item if 'クライアント アドレス' in s]
if len(item_clientaddr) == 0:
item_clientaddr = [s for s in item if 'ソース ネットワーク アドレス' in s]
if len(item_clientaddr) == 0:
item_clientaddr = [s for s in item if 'ソース ワークステーション' in s]
if (len(item_clientaddr) >= 1):
clientaddr = item_clientaddr[0].split(":")[
len(item_clientaddr[0].split(":")) - 1]
item_service = ""
item_service = [s for s in item if 'サービス名' in s]
if (len(item_service) >= 2):
servicename = item_service[0].split(":")[1]
item_process = ""
item_process = [s for s in item if 'プロセス名' in s]
if (len(item_process) >= 2):
processname = item_process[0].split("新しいプロセス名:")[1]
elif (len(item_process) >= 1):
processname = item_process[0].split("プロセス名:")[1]
item_obj = ""
item_obj = [s for s in item if 'オブジェクト名' in s]
if (len(item_obj) >= 2):
objectname = item_obj[0].split(":")[1]
item_id = ""
item_id = [s for s in item if 'セキュリティ ID' in s]
if (len(item_id) >= 1):
securityid = item_id[0].split(":")[1]
if (eventid == SignatureDetector.EVENT_SHARE):
item_sharedname = [s for s in item if '共有名' in s]
sharedname = item_sharedname[0].split(":")[1]
else:
return SignatureDetector.RESULT_NORMAL
datetime = datetime.strip("'")
eventid = eventid.strip("'")
if org_accountname != None:
accountname = org_accountname.strip("'")
accountname = accountname.strip()
accountname = accountname.strip('\t')
accountname = accountname.lower()
accountname = accountname.split('@')[0]
if (accountname.find(DOMAIN_NAME) > -1 or len(accountname) == 0):
return SignatureDetector.RESULT_NORMAL
if clientaddr != None:
clientaddr = clientaddr.strip("'")
if servicename != None:
servicename = servicename.strip("'")
servicename = servicename.lower()
if processname != None:
processname = processname.strip("'")
processname = processname.lower()
if objectname != None:
objectname = objectname.strip("'")
objectname = objectname.lower()
if sharedname != None:
sharedname = sharedname.strip("'")
sharedname = sharedname.lower()
if securityid != None:
securityid = securityid.strip("'")
securityid = securityid.strip()
securityid = securityid.strip('\t')
securityid = securityid.lower()
# To specify parameter as Object
inputLog = InputLog.InputLog(datetime, eventid, accountname,
clientaddr, servicename, processname,
objectname, sharedname, securityid)
# update start by gam
result = SignatureDetector.signature_detect(inputLog)
# update end
clientaddr = inputLog.get_clientaddr()
processname = inputLog.get_processname()
if (result == SignatureDetector.RESULT_CMD
or result == SignatureDetector.RESULT_MAL_CMD):
if (mode == MODE_ML):
#result = ML.preds(eventid, accountname, processname, objectname, base_dummies_4674, clf_4674, base_dummies_4688, clf_4688)
print()
else:
processname = processname.strip().strip("'")
result = SignatureDetector.check_cmd_whitelist(processname)
if (result != SignatureDetector.RESULT_NORMAL
#and result != ML.RESULT_WARN
):
print(result)
print(msg)
#send_alert.Send_alert(result, datetime, eventid, accountname, clientaddr, servicename, processname, objectname, sharedname)
except Exception as e:
file = open(logfile, 'a')
file.write(msg)
file.write(e)
with open(RESULT_FILE, 'a') as f:
writer = csv.writer(f)
writer.writerow([
datetime, eventid, accountname, clientaddr, servicename,
processname, objectname, sharedname, result, file
])
return result