Project translated automatically.
Log in
or
register,
to view the original
The tasks:
1 .For protocols, we divide into L3 (IPv4, IPv6) and L4 (TCP, UDP, ICMP, ...).Showing the distribution in bytes and packages within the attack on each level separately
For example:
L3
IPv4 = 300KBps / 1000PPs
L4
UDP = 99 KBps / 99 pps
TCP = 1 KBps / 1 pps
2ndDetermination of which ASN is the attack (autonomic systems)
A. Take a database in .mmdb (maxmind) format
View a general list of IP addresses (if up to 100,000 addresses in mongodb)
We compare all IP addresses with masks and in which ASNs these addresses live
D. Showing the distribution from which ASN is traffic in bytes and packages
ThreeChange of src_addr
Changing interest rates for bytes and packages
We count bytes and packages from each of the addresses, we record
4 .Change of geo_ip
Changing interest rates for bytes and packages
We change the name to geoip_src
and 5.Add to geoip_traffic
a. We count instead of src addresses - bps and pps, we also show each country
6 .We change % by byts and packages, and record with for each:
by srcports
The DSTPorts
by dstports
D. The reason
e. lengthdistribution
F. Continental Distribution
The country distribution
H. GeoDistribution
Share srcPorts and dstPorts for each of the protocols
Get srcPorts_udp and dstPorts_udp and separately srcPorts_tcp and dstPorts_tcp
In short the main task
At the moment, the program considers the packages, turns them instantly into a percentage, and then sends them to the base.
The task is to turn it into bytes and packages, that is, that we don’t have in the interest frame at first, but that we have at first packages and bytes that in the web interface, on the frontend themselves converted into percentage.That is, in essence we will just have to remove the interest conversion function, in the reports module.Remove interests and start sending bytes and packages and update them.That is, update not the percentage, but the bytes and packages.Work should not be in a second, but summarized.That is, if it comes from one IP address, we have earlier for example started an anomaly report and we see that 95% of the graph from one IP address.So now we’ll see that one IP address has been sent to now – 10 GB.That is, seconds don’t need to produce, it’s not the speed, it’s the total number of data that you send us the IP address or the port has come, that is, the total number.This is exactly what it means to “reverse the interest rate.”
Files in which you need to make changes - Applications
The list does not show proposals concealed by the client or freelancer with a Plus profile, as well as proposals violating rules
Proposals are currently absent
Freelancers are reviewing the task — proposals will appear here soon.
Pavel Shtemenko
9 July 2023
Здравствуйте. Без наличия всего проекта весьма тяжело вносить изменения. Ведь проверить даже компиляцией не получится. И я насколько понял это все должно работать на MacOs?
