search

stratosphereips / StratosphereLinuxIPS

Slips, a free software behavioral Python intrusion prevention system (IDS/IPS) that uses machine learning to detect malicious behaviors in the network traffic. Stratosphere Laboratory, AIC, FEL, CVUT in Prague.
Other
687 stars 166 forks source link

New idea: the adaptive performance protector. #693

Open AlyaGomaa opened 2 months ago

AlyaGomaa commented 2 months ago

Created by Alya Gomaa via monday.com integration. 🎉

AlyaGomaa commented 2 months ago

So the problem is that slips dies if many many flows are sent by the host. Specially malware scanning or ddos.

The solution is to ignore the traffic from that host in this TW if two condition match

If both match then we 'somehow' tell slips or zeek to ignore those flows until next TW.

The important thing is that those flows MUST not enter slips. Must not be read, processed, in any way.

AlyaGomaa commented 2 months ago

we need to find a way to not give this to slips in the first place, maybe tell zeek not to give us anything from this IP