read_alerts

#!/usr/bin/perl
# Merge and print alerts 
# Specify alerts.txt file on the command line
# Alerts will be printed with delay DELAY_START
# Attack end is detected with delay DELAY_END
# Alerts must have packet rate above RATE Gbps to be printed

$|=1;

$DELAY_START = 10;
$DELAY_END = 300;
$RATE = 1;
$UPDATE = 0;

$usage="$0 alerts-file\n";

%alerts = ();

$mid = 0;
our $lasttime = 0;

sub gettime
{
    $time = shift;
    $type = shift;
    if ($type eq "loc")
    {    
	($sec, $min, $hour, $day,$month,$year) = (localtime($time))[0,1,2,3,4,5];
    }
    else	
    {    
	($sec, $min, $hour, $day,$month,$year) = (gmtime($time))[0,1,2,3,4,5];
    }
    $month++;
    if ($month < 10)
    {
	$month = "0" . $month;
    }
    if ($day < 10)
    {
	$day = "0" . $day;
    }
    if ($hour < 10)
    {
	$hour = "0" . $hour;
    }
    if ($min < 10)
    {
	$min = "0" . $min;
    }
    if ($sec < 10)
    {
	$sec = "0" . $sec;
    }
    $year = $year + 1900;
    return "$month/$day/$year $hour:$min:$sec";   
}


sub printalert
{
    $target = shift;
    $event = shift;
    $r = $alerts{$target}{'bytes'}*8/1000000000;
    $start =  $alerts{$target}{'start'};
    $end =  $alerts{$target}{'end'};
    $apkts =  $alerts{$target}{'pkts'}/1000000;
    $bytes =  $alerts{$target}{'bytes'};
    $sutc = gettime($start, "utc");
    $sloc = gettime($start, "loc");
    $eutc = gettime($end, "utc");
    $eloc = gettime($end, "loc");
    print "  Target: $target\n";
    print "   Event: $event\n";
    if ($event eq 'START')
    {
	print "   Time:  $start ($sutc UTC, $sloc local time)\n";
    }
    else
    {
	print "   Time:  $end ($eutc UTC, $eloc local time)\n";
    }
    print "Est rate: $r Gbps $apkts Mpps\n";

    for my $t (sort keys %{$alerts{$target}{'text'}})
    {
	if ($t ne "")
	{
	    print " Signatr: $t\n";
	}
    }
    print "\n";
}

sub cleanalerts
{
    $curtime = shift;
    @salerts = keys %alerts;
    for my $t (@salerts)
    {
	$diff = $alerts{$t}{'end'} - $alerts{$t}{'start'};
	$r = $alerts{$t}{'bytes'}*8/1000000000;
	if ($curtime - $alerts{$t}{'start'} > $DELAY_START && $alerts{$t}{'print'} == 1 && $r >= $RATE)
	{
	    if ($diff > 0)
	    {
		printalert($t, 'START');
		$alerts{$t}{'print'} = 0;
	    }
	}
	if ($curtime - $alerts{$t}{'end'} > $DELAY_END)
	{
	    if ($alerts{$t}{'print'} == 0)
	    {
		printalert($t, 'END');
	    }
	    delete($alerts{$t});
	}
    }
}

if ($#ARGV < 0)
{
    print $usage;
    exit(1);
}
$lasttime = time();
open($FH,'<',$ARGV[0]) || die("no such file ", $ARGV[0]);
$curpos = tell($FH);
for (;;) {
    # For interactive printing
    if (time() - $lasttime > $DELAY_START)
    {
	cleanalerts(time());
    }
    $curtime = 0;
    for (; $_ = readline($FH); $curpos = tell($FH))
    {
	@items = split /\s+/, $_;
	$id = $items[0];
	$time = $items[2];
	$lasttime = $time;
	$bytes = $items[5];
	$pkts = $items[6];
	$text = "";
	if ($curtime == 0 || $time > $curtime)
	{
	    $curtime = $time;
	    cleanalerts($time);
	}
	for ($i=7; $i <= $#items; $i++)
	{
	    if ($text eq "")
	    {
		$text = $items[$i];
	    }
	    else
	    {
		$text .= " " . $items[$i];
	    }
	}
	if ($_ =~ m/(.*)(dst ip )(\d+\.\d+\.\d+\.\d+)(.*)/)
	{
	    $target = $3;
	}
	else
	{
	    next;
	}
	if ($_ =~ m/(.*)(src ip )(\d+\.\d+\.\d+\.\d+)(.*)(dst ip )(\d+\.\d+\.\d+\.\d+)(.*)/)
	{
	    next;
	}
	if ($_ =~ m/(.*)(proto tcp and flags 0)/)
	{
	    next;
	}
	else
	{
	    $type = 0;
	    if ($_ =~ /proto udp/)
	    {
		if ($_ =~ /src port 53\s/)
		{
		    $type = 1;
		}
		elsif ($_ =~ /src port 0/ || $_ =~ /dst port 0/) 
		{
		    $type = 8;	
		}
		elsif ($_ =~ /src port 389\s/)
		{
		    $type = 16;	
		}
		elsif ($_ =~ /src port 123\s/)
		{
		    $type = 256;	
		}
		elsif ($_ =~ /src port 5353\s/)
		{
		    $type = 2048;
		}
		elsif ($_ =~ /src port 19\s/)
		{
		    $type = 16384;
		}
		elsif ($_ =~ /src port 1701\s/)
		{
		    $type = 32768;
		}
		elsif ($_ =~ /src port 11211\s/)
		{
		    $type = 65536;
		}
		elsif ($_ =~ /dst port 53\s/)
		{
		    $type = 131072;
		}
		elsif ($_ =~ /dst port 111\s/)
		{
		    $type = 262144;
		}
	    }
	    elsif ($_ =~ /proto icmp/)
	    {
		$type = 2;
	    }
	    elsif (($_ =~ /proto tcp/ && $_ =~ /flags 2/) || ($_ =~ /proto tcp/ && $_ =~ /flags 0/))
	    {
		$type = 8192;
	    }
	    elsif ($_ =~ /proto tcp/ && $_ =~ /flags 16/)
	    {
		$type = 512;
	    }
	    elsif ($_ =~ /proto tcp/ && $_ =~ /flags 18/)
	    {
		$type = 32;
	    }
	    elsif ($_ =~ /proto tcp/ && $_ =~ /flags 4/)
	    {
		$type = 64;
	    }
	    if ($type == 0)
	    {
		next;
	    }
	}
	if (!exists($alerts{$target}))
	{
	    if ($type != 0)
	    {
		$alerts{$target}{'text'}{$text} = 1;
		$alerts{$target}{'start'} = $time;
		$alerts{$target}{'end'} = $time;
		$alerts{$target}{'type'} = $type;
		$alerts{$target}{'bytes'} = $bytes;
		$alerts{$target}{'pkts'} = $pkts;
		$alerts{$target}{'print'} = 1;
	    }
	}
	else
	{
	    if (!exists($alerts{$target}{'text'}{$text}))
	    {
		$alerts{$target}{'text'}{$text} = 1;
		$alerts{$target}{'type'} |= $type;
		if ($alerts{$target}{'print'} == 0)
		{
		    if ($UPDATE)
		    {
			printalert($target, 'UPDATE SIG');
		    }
		}
	    }
	    if ($pkts > $alerts{$target}{'pkts'})
	    {
		$alerts{$target}{'pkts'} = $pkts;
	    }
	    if ($bytes > $alerts{$target}{'bytes'})
	    {
		$alerts{$target}{'bytes'} = $bytes;
		if ($alerts{$target}{'print'} == 0)
		{
		    if ($UPDATE)
		    {
			printalert($target, 'UPDATE RATE');
		    }
		}
	    }
	    if ($time > $alerts{$target}{'end'})
	    {
		$alerts{$target}{'end'} = $time;		
	    }
	}
    }
    # eof reached on FH, but wait a second and maybe there will be more output
    sleep 10;
    seek $FH, $curpos, 0;      # this clears the eof flag on FH
}