stratosphereips / StratosphereLinuxIPS

Slips, a free software behavioral Python intrusion prevention system (IDS/IPS) that uses machine learning to detect malicious behaviors in the network traffic. Stratosphere Laboratory, AIC, FEL, CVUT in Prague.
Other
712 stars 176 forks source link

try async non-blocking timers instead of the timer thread used in flowalerts #1007

Closed AlyaGomaa closed 1 month ago

AlyaGomaa commented 1 month ago

See if this works

import asyncio

async def check_connection_without_dns_resolution(self, profileid, twid, flow):

        # Start a non-blocking timer
        await asyncio.sleep(15)

        # After 15 seconds, recheck the DNS resolution
        if self.check_if_resolution_was_made_by_different_version(profileid, flow.daddr):
            return False

        if self.is_well_known_org(flow.daddr):
            return False

        self.set_evidence.conn_without_dns(twid, flow)

        # This UID will never appear again, so we can remove it and free memory
        with contextlib.suppress(ValueError):
            self.connections_checked_in_conn_dns_timer_thread.remove(flow.uid)

the goal is to avoid starting threads as much as possible to avoid hanging threads/processes in memory

AlyaGomaa commented 1 month ago

same goes with all the usage of timerthread in ssh.py and dns.py

AlyaGomaa commented 1 month ago

Here's a plan of how this async hell is going to be implemented

warnings.filterwarnings("ignore", category=RuntimeWarning)

class X: def init(self): self.tasks = []

async def check_dns(self):
    """any function that waits for anything will look lik ethis"""
    print("Fetching data...")
    await asyncio.sleep(2)  
    print("Data fetched!")

async def analyze(self):
    """Analyze of any flowanalyzer in flowalerts, like dns.py ssh.py etc"""
    print("analyze just started")
    time.sleep(3)
    t = asyncio.create_task(self.check_dns())
    self.tasks.append(t) 
    print("Analyze just ended")

async def shutdown_gracefully(self):
    await asyncio.gather(*self.tasks)
    print("shutdown gracefully is done")

def main(self):
    """main of flowalerts supposedly"""
    loop = asyncio.get_event_loop()
    loop.create_task(self.analyze())  
    print("flowalerts main is done execution")

def controller(self):
    """will be IModule's run """
    loop = asyncio.get_event_loop()
    self.main()  # Schedule tasks
    loop.run_until_complete(self.shutdown_gracefully())  

X().controller()

AlyaGomaa commented 1 month ago

done here #1012