prelude-correlator/master: Improve WormPlugin accuracy

commit 89d5e77f6ce7e9e81469d530018fc215d4bcfe55
Author: Yoann Vandoorselaere <[email protected]>
Date:   Thu Oct 29 14:18:16 2009 +0100

    Improve WormPlugin accuracy
    
    The plugin used to alert when seeing an alert to a given target, and
    this same alert going back to the source. This can happen in a number
    of case (example: Netbios alert triggered by Snort).
    
    As of now, the plugin will wait for the events to be repeated against
    at least 5 differents hosts.


========================================

 PreludeCorrelator/plugins/worm.py |   19 +++++++++++++++----
 1 files changed, 15 insertions(+), 4 deletions(-)

========================================

diff --git a/PreludeCorrelator/plugins/worm.py b/PreludeCorrelator/plugins/worm.py
index 849e031..0d45dd7 100644
--- a/PreludeCorrelator/plugins/worm.py
+++ b/PreludeCorrelator/plugins/worm.py
@@ -26,16 +26,27 @@ from PreludeCorrelator import context
 from PreludeCorrelator.pluginmanager import Plugin
 
 class WormPlugin(Plugin):
+    REPEAT = 5
+
+    def __init__(self, env):
+        Plugin.__init__(self, env)
+        self.__repeat_target = self.getConfigValue("repeat-target", self.REPEAT, type=int)
+
     def run(self, idmef):
         ctxt = idmef.Get("alert.classification.text")
         if not ctxt:
             return
 
         # Create context for classification combined with all the target.
+        tlist = {}
         for target in idmef.Get("alert.target(*).node.address(*).address"):
-            ctx = context.Context("WORM_HOST_" + ctxt + target, { "expire": 300, "threshold": 5 }, update = True)
+            ctx = context.Context("WORM_HOST_" + ctxt + target, { "expire": 300 }, update = True)
             ctx.addAlertReference(idmef)
 
+            tlist[target] = True
+            if not hasattr(ctx, "_target_list"):
+                ctx._target_list = {}
+
         for source in idmef.Get("alert.source(*).node.address(*).address"):
             # We are trying to see whether a previous target is now attacking other hosts
             # thus, we check whether a context exist with this classification combined to
@@ -44,12 +55,12 @@ class WormPlugin(Plugin):
             if not ctx:
                 continue
 
+            ctx._target_list.update(tlist)
             ctx.addAlertReference(idmef)
 
-            # Increase and check the context threshold.
-            if ctx.CheckAndDecThreshold():
+            if len(ctx._target_list) > self.__repeat_target:
                 ctx.Set("alert.classification.text", "Possible Worm Activity")
-                ctx.Set("alert.correlation_alert.name", "Source host repeating actions taken against it recently")
+                ctx.Set("alert.correlation_alert.name", "Source host is repeating actions taken against it recently")
                 ctx.Set("alert.assessment.impact.severity", "high")
                 ctx.Set("alert.assessment.impact.description", source + " has repeated actions taken against it recently at least 5 times. It may have been infected with a worm.")
                 ctx.alert()
_______________________________________________
Prelude-cvslog site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-cvslog