stratosphereips / StratosphereLinuxIPS

Slips, a free software behavioral Python intrusion prevention system (IDS/IPS) that uses machine learning to detect malicious behaviors in the network traffic. Stratosphere Laboratory, AIC, FEL, CVUT in Prague.
Other
688 stars 167 forks source link

instead of severeal slips ports, use the port as a random string as a prefix to all keys #207

Open AlyaGomaa opened 1 year ago

AlyaGomaa commented 1 year ago

Created by Alya Gomaa via monday.com integration. 🎉

A-atmos commented 1 year ago

Would you please elaborate the issue, I wanted to work on it.

AlyaGomaa commented 1 year ago

hey @A-atmos i think this is a difficult task that would require some time and effort and a lot of testing! but there you go

for each instance of slips, we use a different redis port, and when using ./slips.py -k we let the user choose which port to close but not all users remember to use -k, so they end up with many redis servers open the goal of this issue is to use only 1 port for example the default redis port, and for each instance of slips we add an 'ID' or a 'random string' to identify this instance to every key used by this instance, instead of opening another redis server. so the result would be 1 server for all slips instances, and each instance would have an ID in its' channel names, keys, etc.

A-atmos commented 1 year ago

hey @AlyaGomaa , could we just not use multiple dbs for different instance of slips in the same redis server, instead of adding random string as prefixes to identify the instance. This would end up using a single redis server for all instance of slips in a single redis port!

AlyaGomaa commented 1 year ago

hey @A-atmos yes this is the goal, we want to have 1 single redis server for all instances

A-atmos commented 1 year ago

hey @AlyaGomaa , I was working on this and have a prototype which is passing the database tests, but is not giving out the alert logs. I could make a PR and may be you could give me a lead on it. For now I have:

  1. Added a prefix to each keys, so as to maintain the keys for different instance of slips
  2. Changed core slips files to maintain and work by using prefix instead of port.
  3. Modified database tests to use the prefix.
  4. Introduced an argument which can let use a custom prefix instead of a generated uuid4.

Also I've confusions on if we continue using different port for kalipso and web interface, or change them to use different prefixes accordingly.