Data

Tools

Indexes

Applications

Experiments

Open Source Science

https://github.com/cdpxe/nefias

Network Forensic & Anomaly Detection System; tailored for covert channel/network steganography detection

https://github.com/cdpxe/nefias

Science Score: 23.0%

This score indicates how likely this project is to be science-related based on various indicators:

  • ○
    CITATION.cff file
  • ✓
    codemeta.json file
    Found codemeta.json file
  • ○
    .zenodo.json file
  • ○
    DOI references
  • ○
    Academic publication links
  • ✓
    Committers with academic emails
    2 of 6 committers (33.3%) from academic institutions
  • ○
    Institutional organization owner
  • ○
    JOSS paper metadata
  • ○
    Scientific vocabulary similarity
    Low similarity (14.7%) to scientific vocabulary

Keywords

anomaly-detection bash covert-channels distributed-computing information-hiding information-security infosec linux network network-covert-channels network-forensics network-monitoring network-steganography networks scientific-computations scientific-research security shell shell-scripts steganography

Keywords from Contributors

freebsd netbsd openbsd usenet-server usenet unix sqlite3 solaris rbac nntp-server
Last synced: 5 months ago · JSON representation

Repository

Network Forensic & Anomaly Detection System; tailored for covert channel/network steganography detection

Basic Info
Statistics
  • Stars: 27
  • Watchers: 3
  • Forks: 9
  • Open Issues: 0
  • Releases: 1
Topics
anomaly-detection bash covert-channels distributed-computing information-hiding information-security infosec linux network network-covert-channels network-forensics network-monitoring network-steganography networks scientific-computations scientific-research security shell shell-scripts steganography
Created almost 6 years ago · Last pushed almost 2 years ago
Metadata Files
Readme Changelog License

README.md

NeFiAS – Network Forensics and Anomaly Detection System

PLEASE NOTE: NeFiAS is discontinued due to the limitations of bash environments in terms of stack space and in favor of the WoDiCoF+ project that will be made public in the coming years. See here for information about the WoDiCoF project and here for some information about WoDiCoF+ (in German).

NeFiAS is a simple and portable tool for network anomaly detection/network forensics, mostly tailored for the domain of network covert channels (network steganography). It was (initially) written by Steffen Wendzel. With NeFiAS we aim to provide the scientific community with the most accessible, easy-to-use testbed feasible. NeFiAS is a tool that you can use to test your own covert channel detection algorithms. Also, feel invited to publish your own detection algorithms in this repository to allow experimental replications of your own research work (just contact Steffen for this purpose).

Design Goals

  • Portability
  • Code-base as tiny as possible
  • Low barrier to work with the tool; enable students to easily extend the tool when they write a thesis
  • Support good performance, but prioritize usability if the system can be made more accessible for students and other researchers
  • Modularity for detection modules; make it possible to write detection modules with as few lines of code as feasible

Features

  • Very tiny framework: core system contains less than 1,000 lines of code
  • Portable (core system entirely written in bash and awk (see the story in the documentation)
  • Provides improved performance (if used by multiple accounts on the same host or if set up as a Beowulf cluster, i.e. can be easily spread among many nodes), but is not tailored for any big-data scenarios!
  • Requires only standard Linux, no special libraries or tools required (see requirements below)

Read the Documentation

Check the available NeFiAS Detection Scripts

Requirements

NeFiAS requires only standard Linux tools:

  • bc (console calculator)
  • dialog (optional)
  • bash
  • ssh/scp
  • gawk, sed, tr, split etc.
  • gzip
  • tshark (optional, but pretty useful)

Owner

  • Name: Steffen Wendzel
  • Login: cdpxe
  • Kind: user
  • Location: Worms, Germany

Professor at HS Worms, author of several books on InfoSec and Linux. OSS developer. #Networking #BSD #InformationHiding #Steganography #ReplicationStudies

GitHub Events

Total
Last Year

Committers

Last synced: about 2 years ago

All Time
  • Total Commits: 308
  • Total Committers: 6
  • Avg Commits per committer: 51.333
  • Development Distribution Score (DDS): 0.416
Past Year
  • Commits: 0
  • Committers: 0
  • Avg Commits per committer: 0.0
  • Development Distribution Score (DDS): 0.0
Top Committers
Name Email Commits
kev-alb 4****b 180
Steffen Wendzel w****l@h****e 72
Steffen Wendzel c****e 41
swendzel s****l@c****e 11
Sebastian Zillien s****n@h****e 3
Steffen Wendzel w****l@c****e 1
Committer Domains (Top 20 + Academic)
cs.uni-bonn.de: 2 hs-worms.de: 2

Issues and Pull Requests

Last synced: over 1 year ago

All Time
  • Total issues: 0
  • Total pull requests: 0
  • Average time to close issues: N/A
  • Average time to close pull requests: N/A
  • Total issue authors: 0
  • Total pull request authors: 0
  • Average comments per issue: 0
  • Average comments per pull request: 0
  • Merged pull requests: 0
  • Bot issues: 0
  • Bot pull requests: 0
Past Year
  • Issues: 0
  • Pull requests: 0
  • Average time to close issues: N/A
  • Average time to close pull requests: N/A
  • Issue authors: 0
  • Pull request authors: 0
  • Average comments per issue: 0
  • Average comments per pull request: 0
  • Merged pull requests: 0
  • Bot issues: 0
  • Bot pull requests: 0
View more stats
Top Authors
Issue Authors
Pull Request Authors
Top Labels
Issue Labels
Pull Request Labels