Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- # -*- coding: utf-8 -*-
- """
- Created on Thu Feb 20 20:29:30 2020
- @author: anjonsunny
- """
- import time
- #Required import
- from Trigger.trigger import Trigger
- #Required class name that inherits Trigger
- class MyTrigger(Trigger):
- print("hi")
- #Required function
- def process_data(self):
- #forever loop to process data
- #numAlerts = 0
- #get the cc_node numbers
- nodes = self.get_cc_node_numbers()
- self.set_active_conn(nodes[1])
- #check again
- scannerFeature = {}
- scannerFeature['nmap'] = {'fixed' : 0, 'random' : 1, 'asc' : 0, 'dsc' : 0, 'seq': 0, 'totport' : 1000}
- scannerFeature['nessus'] = {'fixed' : 1, 'random' : 1, 'asc' : 0, 'dsc' : 0, 'seq': 0, 'totport' : 4790}
- scannerFeature['nikto'] = {'fixed' : 1, 'random' : 0, 'asc' : 0, 'dsc' : 0, 'seq': 0, 'totport' : 1}
- scannerFeature['netcat'] = {'fixed' : 1, 'random' : 0, 'asc' : 0, 'dsc' : 1, 'seq': 0, 'totport' : 10000}
- scannerFeature['metasploit'] = {'fixed' : 1, 'random' : 0, 'asc' : 1, 'dsc' : 0, 'seq': 0, 'totport' : 10000}
- scannerFeature['unicornscan'] = {'fixed' : 0, 'random' : 1, 'asc' : 0, 'dsc' : 0, 'seq': 0, 'totport' : 338}
- scannerFeature['angryip'] = {'fixed' : 1, 'random' : 0, 'asc' : 1, 'dsc' : 0, 'seq': 0, 'totport' : 10000}
- scannerFeature['zenmap'] = {'fixed' : 0, 'random' : 1, 'asc' : 0, 'dsc' : 0, 'seq': 0, 'totport' : 1000}
- #build fixed order library for the scanners
- # fixedorders
- fixedOrders = {}
- for scanner in scannerFeature:
- #print(scanner)
- if scannerFeature[scanner]['fixed'] == 1:
- #print(scanner + " is fixed")
- # make a list of the port scanned by maintaining the orders
- fixedOrders[scanner] = self.getPortsScanned(scanner)
- #print(fixedOrders[scanner])
- #port history
- porthistory = {}
- numPortsScanned = 0
- # a dictionary for keeping the current features
- # 1:yes, 0: no, 2: unknown
- curStat = {}
- curStat['fixed'] = 2
- curStat['random'] = 2
- curStat['asc'] = 2
- curStat['dsc'] = 2
- curStat['seq'] = 2
- curStat['totport'] = 0
- while True:
- ####Modify to process Monitor's data and Trigger a switch####
- # read a line of input (from Monitor's stdout)
- data = self.read_input_line()
- print("READ: " + str(data))
- print("$$$$$$$$$$$$$$$And there was data $$$$$$$$$$")
- #if data yet exists, restart loop
- if data == None:
- continue
- line = str(data)
- if line.find("{TCP}") != -1:
- scannedport = self.getPortScanned(line)
- print("$$$$$$$$$$$$$$$$$$$$$$$$$$port " + scannedport + " was scanned")
- timestampindex = line.find("[**]") -1
- timeestamp = line[0:timestampindex].strip()
- def matchFeature(self, scannerFeature, curStat):
- matchres = {}
- for scanner in scannerFeature:
- matchcount = 0
- totalcount = 0
- for ftr in scannerFeature[scanner]:
- if ftr != 'totport' and scannerFeature[scanner][ftr] == curStat[ftr] and curStat[ftr] == 1:
- matchcount = matchcount + 1
- if scannerFeature[scanner][ftr] == 1:
- totalcount = totalcount + 1
- if ftr == 'totport' and scannerFeature[scanner][ftr] == curStat[ftr]:
- totalcount = totalcount + 1
- matchcount = matchcount + 1
- matchres[scanner] = 100*(matchcount/(1.0*totalcount))
- #print(scanner, totalcount, matchcount)
- return matchres
- def isAscending(self, porthistory):
- portlist = self.sortedHistFrmDict(porthistory)
- portlist = map(int, portlist)
- if portlist == sorted(portlist):
- #print(portlist[1:10])
- #print(sorted(portlist)[1:10])
- return 1
- return 0
- def isSeq(self, porthistory):
- portlist = self.sortedHistFrmDict(porthistory)
- portlist = map(int, portlist)
- i = 1
- while i < len(portlist):
- if((portlist[i]) - (portlist[i - 1]) != 1):
- return 0
- i += 1
- return 1
- def portCount(self, porthistory):
- portlist = self.sortedHistFrmDict(porthistory)
- return len(portlist)
- def isDscending(self, porthistory):
- portlist = self.sortedHistFrmDict(porthistory)
- portlist = map(int, portlist)
- if portlist == sorted(portlist, reverse=True):
- return 1
- return 0
- def sortedHistFrmDict(self, porthistory):
- curportslistsrtd = []
- for t in sorted (porthistory) :
- #print ((t, porthistory[t]))
- curportslistsrtd.append(porthistory[t])
- #print(curportslistsrtd[1:10])
- #remove dup
- portlist = []
- [portlist.append(x) for x in curportslistsrtd if x not in portlist]
- return portlist
- def compareScanHist(self, fixedOrders, porthistory):
- matchres = {}
- for scanner in fixedOrders:
- if len(fixedOrders[scanner]) == 0:
- return False, "None"
- liblist = self.sortedHistFrmDict(fixedOrders[scanner])
- curportlist = self.sortedHistFrmDict(porthistory)
- liblist = map(int, liblist)
- curportlist = map(int, curportlist)
- count = 0
- for i in range(len(curportlist)):
- if i< len(liblist) and curportlist[i] == liblist[i]:
- count = count + 1
- matchres[scanner] = (count/(1.0*len(curportlist)))*100
- return matchres
- def getPortsScanned(self, scanner):
- fname = scanner+"."+"log"
- f = open(fname,"r")
- lines = f.readlines()
- ports = {}
- for line in lines:
- #print(line)
- port = self.getPortScanned(line)
- timestampindex = line.find("[**]") -1
- timestamp = line[0:timestampindex].strip()
- #ports.append(port)
- if port not in ports:
- ports[timestamp] = port
- #print("time: " + timestamp)
- def getPortScanned(self, line):
- start = line.find("{")
- if start >= 0:
- #print(line[start:])
- srcipstart = line.find("}",start+1) +1
- #print("srcipstart: "+ str(srcipstart))
- srcipend = line.find(":",srcipstart)
- #print("srcipend: "+ str(srcipend))
- srcportend = line.find(" ", srcipend)
- #print("srcportend: "+ str(srcportend))
- srcip = line[srcipstart:srcipend].strip()
- #print("srcip: "+ str(srcip))
- srcport = line[srcipend+1:srcportend].strip()
- #print("srcport: "+ srcport)
- #print("src ip: "+ srcip + ", "+ "src port: "+ srcport)
- destipstart = line.find("->",srcportend+1) +2
- #print("destipstart: "+ str(destipstart))
- destipend = line.find(":",destipstart)
- #print("destipend: "+ str(destipend))
- #destportend = line.find(" ", destipend)
- #print("destportend: "+ str(destportend))
- dstip = line[destipstart:destipend].strip()
- dstport = line[destipend+1:].strip()
- #print("dest ip: "+ dstip + ", "+ "dest port: "+ dstport)
- #print("port "+ dstport +" scanned")
- return dstport
- ####
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement