-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' of https://github.com/Montimage/mmt-security into…
… main
- Loading branch information
Showing
9 changed files
with
8,176 additions
and
7,353 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,9 @@ | ||
| # Version 1.2.17 (17 May 2023) | ||
| - Add 2 security rules, 96, 97 to detect attacks concerning HTTP2 | ||
|
|
||
| # Version 1.2.16 (23 Mar 2023) | ||
| - Add prefix`MMT_SEC_` to the env variable in rule 95 | ||
| - Add security rule to detect Slowloris DoS attack | ||
|
|
||
| # Version 1.2.15 (06 Jan 2023) | ||
| - Add two rules, 94 and 95, to detect DoS in 5G control plane traffic |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| <beginning> | ||
|
|
||
| <!--This rule counts how many packets arrive in interval of time include in [0,100] milliseconds. If the amount of packets that come in that time goes over a threshold decided by the user, then an alert is raised. Note that in order to set the threshold an environment variable called MMT_SEC_5G_DOS_HTTP2_MS_LIMIT must be declared and set. | ||
| If that variable is not declared a default value will be given. | ||
| --> | ||
| <embedded_functions><![CDATA[ | ||
| #include <stdlib.h> | ||
| #include <mmt_core.h> | ||
| #include<math.h> | ||
| static unsigned long int limit_5g_dos_http2_per_ms = 0; | ||
| void on_load(){ | ||
| const char *str = getenv("MMT_SEC_5G_DOS_HTTP2_MS_LIMIT"); | ||
| if( str == NULL ){ | ||
| mmt_info("Rule 96: no value of MMT_SEC_5G_DOS_HTTP2_MS_LIMIT" ); | ||
| limit_5g_dos_http2_per_ms=80; | ||
| } | ||
| else | ||
| limit_5g_dos_http2_per_ms = strtoul( str, NULL, 0 ); | ||
| mmt_info("Rule 96: set MMT_SEC_5G_DOS_HTTP2_MS_LIMIT=%ld", | ||
| limit_5g_dos_http2_per_ms ); | ||
| } | ||
| /* | ||
| To detect DoS, we group messages by windows of millissecond, | ||
| that is, all messages having the same millisecond number will be in the same window. | ||
| We then check the number of message in a window to ensure that it is less than the given limit. | ||
| */ | ||
| static inline bool em_5g_check_msg_throughput( const void *data ){ | ||
| static int last_ms = 0; //current ms window | ||
| static unsigned long int counter = 0; //number of msg in the current ms window | ||
| struct timeval *time = (struct timeval *) data; | ||
| // no limit | ||
| if( limit_5g_dos_http2_per_ms == 0 ) | ||
| return true; | ||
| int millisecond = round( time->tv_usec / 1000.0 ); //microsecond to millisecond | ||
| //new window => reset the counter | ||
| if( last_ms != millisecond ){ | ||
| counter = 0; | ||
| last_ms = millisecond; | ||
| } | ||
| counter ++; | ||
| //if(counter >= limit_5g_dos_http2_per_ms) | ||
| //printf("Rule 96 Dos recognized\n"); | ||
| return (counter >= limit_5g_dos_http2_per_ms); | ||
| } | ||
| ]]></embedded_functions> | ||
| <property value="THEN" delay_units="ms" delay_min="0" delay_max="100" property_id="96" type_property="ATTACK" | ||
| description="5G Http2 DoS attack Recognition"> | ||
| <event value="COMPUTE" event_id="1" | ||
| description="HTTP2 check on the methods/ types that can realize a flooding" | ||
| boolean_expression="(((( http2.header_method == 131) || (http2.header_method==130)) || (http2.type==8)) && (ip.src != ip.dst) )"/> | ||
|
|
||
| <event value="COMPUTE" event_id="2" | ||
| description="Calculate total" | ||
| boolean_expression="( #em_5g_check_msg_throughput( meta.utime ) )"/> | ||
| </property> | ||
| </beginning> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| <beginning> | ||
| <!-- | ||
| Compression attack involve the use of the compression in order to put a great amount of data in a single packet, in order to use a huge amount of | ||
| computational resources by the server after the decompression. In this case the rule checks the length of the packet. | ||
| Since http2 tends to merge multiple packets, an upper limit is also set so as not to confuse the attack with the coalescing operated by the protocol | ||
| --> | ||
| <embedded_functions><![CDATA[ | ||
| #include <string.h> | ||
| #include <stdio.h> | ||
| #include <stdlib.h> | ||
| #include "mmt_lib.h" | ||
| #include "tcpip/mmt_tcpip_protocols.h" | ||
| #include "pre_embedded_functions.h" | ||
| static int em_check( double header_length,double packet_id){ | ||
| //printf( " Rule 97:Recognized suspect packet. Length %f , packet id %d\n",header_length,(int)packet_id); | ||
| return 0; | ||
| } | ||
| ]]></embedded_functions> | ||
|
|
||
| <property value="THEN" property_id="97" type_property="ATTACK" | ||
| description="5G Http2 DoS attack Recognition" if_satisfied=""> | ||
| <event value="COMPUTE" event_id="1" | ||
| description="HTTP2 Compression attack" | ||
| boolean_expression="(( ((((http2.header_length>350) && (16384>http2.header_length )) && ( http2.header_method == 131)) && #em_check(http2.header_length,meta.packet_index)) && (2800>meta.packet_len)) && (ip.src != ip.dst))"/> | ||
|
|
||
| <event value="COMPUTE" event_id="2" | ||
| description="Nothing" | ||
| boolean_expression="( http2.header_method != 0)"/> | ||
| </property> | ||
| </beginning> |
Oops, something went wrong.