Data

Tools

Indexes

Applications

Experiments

Open Source Science

aip

The Attacker IP Prioritizer(AIP) dynamically generates resource-friendly IPv4 blocklists from Zeek network flows.

https://github.com/stratosphereips/aip

Science Score: 44.0%

This score indicates how likely this project is to be science-related based on various indicators:

  • ✓
    CITATION.cff file
    Found CITATION.cff file
  • ✓
    codemeta.json file
    Found codemeta.json file
  • ✓
    .zenodo.json file
    Found .zenodo.json file
  • ○
    DOI references
  • ○
    Academic publication links
  • ○
    Academic email domains
  • ○
    Institutional organization owner
  • ○
    JOSS paper metadata
  • ○
    Scientific vocabulary similarity
    Low similarity (8.5%) to scientific vocabulary

Keywords

blocklist blocklists honeypots netflows network-attacks network-flows network-traffic-analysis threat-intelligence
Last synced: 6 months ago · JSON representation ·

Repository

The Attacker IP Prioritizer(AIP) dynamically generates resource-friendly IPv4 blocklists from Zeek network flows.

Basic Info
Statistics
  • Stars: 30
  • Watchers: 4
  • Forks: 9
  • Open Issues: 17
  • Releases: 2
Topics
blocklist blocklists honeypots netflows network-attacks network-flows network-traffic-analysis threat-intelligence
Created about 6 years ago · Last pushed over 1 year ago
Metadata Files
Readme Changelog Contributing License Code of conduct Citation Security

README.md

Attacker IP Prioritization (AIP) Tool

Python CI Tests CodeQL Docker Hub CI Docker GHCR CI

Docker Pulls GitHub issues GitHub issues-closed GitHub open-pull-requests GitHub pull-requests closed

The Attacker IP Prioritization (AIP) is a tool to generate efficient and economic IP blocklists based on network traffic captured from honeypot networks.

With the advent of 5G, IoT devices are directly connected often without firewall protection. Therefore we need blocklists that are small, efficient and economic. The AIP structure is shown below.

Description of the AIP pipeline

AIP Models

Each AIP model generates its own blocklist based on a specific criteria. The main models are:

  1. Prioritize New (PN)
    • Focuses on IPs that are new or have not been seen frequently in previous data.
    • Useful to identify emerging attackers that are starting to target a network.
  2. Prioritize Consistent (PC)
    • Focuses on IPs that have consistently attacked over time in previous data.
    • Useful to identify persistent attackers that continuously target a network.
  3. Alpha
    • Provides a baseline identifying all attackers seen in the last 24 hours.
    • Useful to compare the effectiveness of other models.
  4. Alpha7
    • Provides a baseline identifying all attackers seen in the last 7 days.
    • Useful to further compare the effectiveness of other models.
  5. Random Forest
    • Focuses on IPs that are more likely to attack in the future.
    • A more experimental approach to increase blocklist efficiency.

AIP Docker

The best way to run AIP right now is using Docker.

Usage

AIP will automatically attempt to run all the models using the available data. Assuming the Zeek data is located in its usual location:

bash :~$ cd AIP :~$ docker run --rm -v /opt/zeek/logs/:/home/aip/AIP/data/raw:ro -v ${PWD}/data/:/home/aip/AIP/data/:rw --name aip stratosphereips/aip:latest bin/aip

To run AIP for a specific day: bash :~$ cd AIP :~$ docker run --rm -v /opt/zeek/logs/:/home/aip/AIP/data/raw:ro -v ${PWD}/data/:/home/aip/AIP/data/:rw --name aip stratosphereips/aip:latest bin/aip YYYY-MM-DD

License

The Stratosphere AIP tool is licensed under GNU General Public License v3.0.

About

This tool was developed at the Stratosphere Laboratory at the Czech Technical University in Prague. This is part of the Stratosphere blocklist generation project.

This tool was originally born from the bachelor thesis of Thomas O'Hara, The Attacker IP Prioritizer: An IoT Optimized Blacklisting Algorithm (2021).

Owner

  • Name: Stratosphere IPS
  • Login: stratosphereips
  • Kind: organization
  • Location: Prague

Cybersecurity Research Laboratory at the Czech Technical University in Prague. Creators of Slips, a free software machine learning-based behavioral IDS/IPS.

Citation (CITATION.cff) 

cff-version: 1.2.0
title: "Stratosphere AIP: Attacker IP Prioritizer"
message: 'If you use this software, please cite it as specified below.'
url: "https://github.com/stratosphereips/AIP"
type: software
authors:
  - given-names: Thomas
    family-names: O'Hara
  - given-names: Joaquin
    family-names: Bogado
    orcid: 'https://orcid.org/0000-0001-9491-5698'
  - given-names: Veronica
    family-names: Valeros
    email: valerver@fel.cvut.cz
    affiliation: >-
      Stratosphere Laboratory, AIC, FEL, Czech
      Technical University in Prague
    orcid: 'https://orcid.org/0000-0003-2554-3231'
  - given-names: Sebastian
    family-names: Garcia
    email: garciseb@fel.cvut.cz
    affiliation: >-
      Stratosphere Laboratory, AIC, FEL, Czech
      Technical University in Prague
    orcid: 'https://orcid.org/0000-0001-6238-9910'

GitHub Events

Total
  • Create event: 21
  • Release event: 2
  • Issues event: 41
  • Watch event: 4
  • Delete event: 29
  • Issue comment event: 27
  • Push event: 46
  • Pull request event: 39
Last Year
  • Create event: 21
  • Release event: 2
  • Issues event: 41
  • Watch event: 4
  • Delete event: 29
  • Issue comment event: 27
  • Push event: 46
  • Pull request event: 39

Dependencies

environment.yml conda
  • click
  • git
  • joblib
  • matplotlib
  • pandas
  • pathlib
  • pip
  • pytest
  • python
  • python-dotenv
Pipfile pypi
  • maxminddb ==2.2.0
  • netaddr ==0.8.0
Pipfile.lock pypi
  • maxminddb ==2.2.0
  • netaddr ==0.8.0
requirements.txt pypi
  • ipython *
  • maxminddb ==2.2.0
  • netaddr ==0.8.0
  • sklearn *
setup.py pypi
  • maxminddb *
  • netaddr *
etc/docker/Dockerfile docker
  • ubuntu focal build