giros-dit / semantic-data-aggregator

A semantic monitoring framework for aggregating data from heterogeneous sources.
Apache License 2.0
4 stars 0 forks source link

Update CDS to be aligned with the DCP output schema #131

Closed daniel-gonzalez-sanchez closed 1 year ago

daniel-gonzalez-sanchez commented 1 year ago

For the integration between the SDA and the DCP, the proposed architecture is as follows:

sda-dcp

ts,te,td,sa,da,sp,dp,pr,flg,fwd,stos,ipkt,ibyt,opkt,obyt,in,out,sas,das,smk,dmk,dtos,dir,nh,nhb,svln,dvln,ismc,odmc,idmc,osmc,mpls1,mpls2,mpls3,mpls4,mpls5,mpls6,mpls7,mpls8,mpls9,mpls10,cl,sl,al,ra,eng,exid,tr,zeek_extra_field,pktips,pktops,bytips,bytops,bytippkt,bytoppkt,bytipo,pktipo,tpkt,tbyt,cp,prtcp,prudp,pricmp,prigmp,prother,flga,flgs,flgf,flgr,flgp,flgu

The zeek_extra_field is an extra field to be added because is needed to be consider and filled by the Zeek monitoring component in PALANTIR.

According to the final decision (#126), the Cryptomining Detection System (CDS) consumes directly the schema of the data provided by the DCP component. The CDS needs to be updated to consider the order of fields described in the previous schema Anonymized & Preprocessed Netflow Data + Aggregated features.

cds