Skip to content

ernesto341/ais-research

Repository files navigation

Versions numbered.
Current Stable Version: 0.5

With version 0.2 and later, just run make to create all necessary binaries. Ver. 0.3 and later includes a 'make veryclean' and a 'make clean' option, removing all binaries, antibody files, and logs, or just logs and dhs/retrieve binaries, respectively.

Setup:

Run 'make veryclean', then 'make'.

Useage:

Run 'dhs -i <interface>', optionally with ' 2> dhs.log &', to begin monitoring network traffic and testing live traffic (w/ver. >= 0.3).
Live traffic test results are stored in 'traffic.log'.
To update the 'champions.abs' file with a new pool of antibodies, rerun 'lifetime.25' (or whichever version makes you happiest) from the 'ais/' directory. A new 'champions.abs' file will be created. After the new pool has been bred, send a SIGUSR1 signal to the 'retrieve' process. The new pool will be imported, replacing the old pool.

PRIOR TO VER 0.3: Run 'retrieve' from the 'retdir/' directory, optionally with ' 2> ret.log &', to begin testing live traffic.

To exit cleanly, kill the 'dhs' process for version 0.3 and later, or the 'retrieve' process for earlier versions. All other processes will exit, cleaning up after themselves.

With version 0.4 and later, there is a testing module called 'tester' which can read in a file of attack uris and launch them automatically against a given host, specified in the tester.hpp header file. Currently, the tester runs with the default training file in the ais directory. The tester uses 'curl' and logs curl command errors to cmd_errors.log.
The 'listen.sh' file uses netcat to setup a basic listener on the localhost on port 80.
   IMPORTANT: 'listen.sh' and, subsequently, the active netcat listener, must manually be killed upon completion. Unless you don't care.
When using 'listen.sh' and 'tester', start dhs on the local loopback interface.

With version 0.6 and later, a report is generated showing the champions antibodies in HTML and XML formats.

TO DO:
Return which type of attack has been identified and how many antibodies identified an attack
Need mutex/semaphore on shm? Is my stupid vsigatomic only working by chance? This is only a guess.
Setup COMPLETE signal mask for all processes.
Encrypt data in shared memory segments.
Modularize packet capture and specially issue permissions for net_raw and net_bind, whatever else needed. Ensure reduced permission set for all other modules.
maybe automatically continue breeding generations until fitness reaches min level?
Some globals are repeated between retrieve and dhs - combine them.
continue work to ensure rebreed operation is successful.
actually use the xml format for import operations, or make a converter to .abs format for import.

Issues:
INTERMITTENT MEMORY ERROR ON CLEANUP/^C ON DHS


There appears to be an issue with antibody development - im getting matching values for overf when calculated in pull.cpp after brand new breeds with lifetime.25 (10, 766) in buffer classified antibodies

About

No description, website, or topics provided.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published