sum_alerts

#!/usr/bin/perl
# Merge and print alerts from a text file in condensed format
# Specify alerts.txt file on the command line
# Alerts will be printed with delay DELAY_START
# Attack end is detected with delay DELAY_END
# Alerts must have rate above RATE Gbps to be printed

$|=1;

$DELAY_START = 10;
$DELAY_END = 300;
$RATE = 0;
$UPDATE = 0;
$VOTES = 10;

$usage="$0 alerts-file\n";

%alerts = ();
%allow = ();

$mid = 0;
our $lasttime = 0;

sub gettime
{
    $time = shift;
    $type = shift;
    if ($type eq "loc")
    {    
	($sec, $min, $hour, $day,$month,$year) = (localtime($time))[0,1,2,3,4,5];
    }
    else	
    {    
	($sec, $min, $hour, $day,$month,$year) = (gmtime($time))[0,1,2,3,4,5];
    }
    $month++;
    if ($month < 10)
    {
	$month = "0" . $month;
    }
    if ($day < 10)
    {
	$day = "0" . $day;
    }
    if ($hour < 10)
    {
	$hour = "0" . $hour;
    }
    if ($min < 10)
    {
	$min = "0" . $min;
    }
    if ($sec < 10)
    {
	$sec = "0" . $sec;
    }
    $year = $year + 1900;
    return "$month/$day/$year $hour:$min:$sec";   
}


sub printalert
{
    $target = shift;
    $event = shift;
    $r = $alerts{$target}{'bytes'}*8/1000000000;
    $start =  $alerts{$target}{'start'};
    $end =  $alerts{$target}{'end'};
    $apkts =  $alerts{$target}{'pkts'}/1000000;
    $bytes =  $alerts{$target}{'bytes'};
    $sutc = gettime($start, "utc");
    $sloc = gettime($start, "loc");
    $eutc = gettime($end, "utc");
    $eloc = gettime($end, "loc");
    if ($r > $RATE && $alerts{$target}{'votes'} > $VOTES)
    {
	print "$target $start $end $apkts $r $bytes ";
	
	for my $t (sort keys %{$alerts{$target}{'text'}})
	{
	    if ($t ne "")
	    {
		print "$t; ";
	    }
	}
	print "votes " . $alerts{$target}{'votes'};
	print "\n";
    }

}

sub cleanalerts
{
    ($curtime, $force) = @_;
    @salerts = keys %alerts;
    for my $t (@salerts)
    {
	$diff = $alerts{$t}{'end'} - $alerts{$t}{'start'};
	if ($curtime - $alerts{$t}{'start'} > $DELAY_START && $alerts{$t}{'print'} == 1 && $alerts{$t}{'pkts'} >= $PKTS)
	{
	    if ($diff > 0)
	    {		
		#printalert($t, 'START');
		$alerts{$t}{'print'} = 0;
	    }
	}
	if ($force || $curtime - $alerts{$t}{'end'} > $DELAY_END)
	{
	    if ($alerts{$t}{'print'} == 0 && $alerts{$t}{'pkts'} > $PKTS)
	    {
		printalert($t, 'END');
	    }
	    delete($alerts{$t});
	}
    }
}

if ($#ARGV < 0)
{
    print $usage;
    exit(1);
}
$lasttime = time();
$fh = new IO::File("allowlist");
while(<$fh>)
{
    $_ =~ s/\n//;
    $allow{$_} = 1;
}
close($fh);
open($FH,'<',$ARGV[0]) || die("no such file ", $ARGV[0]);
$curpos = tell($FH);
$cursize = -s $ARGV[0];
print "#target start end pkts Gbps Bps signatures votes\n";
for (;;) {
    my $size = -s $ARGV[0];
    if ($size < $cursize)
    {
	seek $FH, 0, 0;
	$cursize = $size;
    }
    elsif ($size > $cursize)
    {
	$cursize = $size;
    }
    # For interactive printing
    if (time() - $lasttime > $DELAY_START)
    {
	cleanalerts(time(), 0);
    }
    $curtime = 0;
    for (; $_ = readline($FH); $curpos = tell($FH))
    {
	@items = split /\s+/, $_;
	$id = $items[0];
	$time = $items[2];
	$lasttime = $time;
	$bytes = $items[5];
	$pkts = $items[6];
	$text = "";
	if ($curtime == 0 || $time > $curtime)
	{
	    $curtime = $time;
	    cleanalerts($time, 0);
	}
	for ($i=7; $i <= $#items; $i++)
	{
	    if ($text eq "")
	    {
		$text = $items[$i];
	    }
	    else
	    {
		$text .= " " . $items[$i];
	    }
	}
	if ($_ =~ m/(.*)(dst ip )(\d+\.\d+\.\d+\.\d+)(.*)/)
	{
	    $target = $3;
	    if (exists($allow{$target}))
	    {
		next;
	    }
	}
	else
	{
	    next;
	}
	if ($_ =~ m/(.*)(src ip )(\d+\.\d+\.\d+\.\d+)(.*)(dst ip )(\d+\.\d+\.\d+\.\d+)(.*)/)
	{
	    next;
	}
	if ($_ =~ m/(.*)(proto tcp and flags 0)/)
	{
	    next;
	}
	if ($_ =~ m/(.*)(src port 443)/)
	{
	    next;
	}
	$type = 0;
	if ($_ =~ /proto udp/)
	{
	    if ($_ =~ /src port 53\s/)
	    {
		$type = 1;
	    }
	    elsif ($_ =~ /src port 0/ || $_ =~ /dst port 0/) 
	    {
		$type = 8;	
	    }
	    elsif ($_ =~ /src port 389\s/)
	    {
		$type = 16;	
	    }
	    elsif ($_ =~ /src port 123\s/)
	    {
		$type = 256;	
	    }
	    elsif ($_ =~ /src port 5353\s/)
	    {
		$type = 2048;
	    }
	    elsif ($_ =~ /src port 19\s/)
	    {
		$type = 16384;
	    }
	    elsif ($_ =~ /src port 1701\s/)
	    {
		$type = 32768;
	    }
	    elsif ($_ =~ /src port 11211\s/)
	    {
		$type = 65536;
	    }
	    elsif ($_ =~ /dst port 53\s/)
	    {
		$type = 131072;
	    }
	    elsif ($_ =~ /dst port 111\s/)
	    {
		$type = 262144;
	    }
	}
	elsif ($_ =~ /proto icmp/)
	{
	    $type = 2;
	}
	elsif (($_ =~ /proto tcp/ && $_ =~ /flags 2/) || ($_ =~ /proto tcp/ && $_ =~ /flags 0/))
	{
	    $type = 8192;
	}
	elsif ($_ =~ /proto tcp/ && $_ =~ /flags 16/)
	{
	    $type = 512;
	}
	elsif ($_ =~ /proto tcp/ && $_ =~ /flags 18/)
	{
	    $type = 32;
	}
	elsif ($_ =~ /proto tcp/ && $_ =~ /flags 4/)
	{
	    $type = 64;
	}
	if (!exists($alerts{$target}))
	{
	    if (1) #$type != 0)
	    {
		$alerts{$target}{'text'}{$text} = 1;
		$alerts{$target}{'start'} = $time;
		$alerts{$target}{'end'} = $time;
		$alerts{$target}{'type'} = $type;
		$alerts{$target}{'bytes'} = $bytes;
		$alerts{$target}{'pkts'} = $pkts;
		$alerts{$target}{'print'} = 1;
		$alerts{$target}{'votes'} = 1;
	    }
	}
	else
	{
	    $alerts{$target}{'votes'}++;
	    if (!exists($alerts{$target}{'text'}{$text})) # && $type != 0)
	    {
		$alerts{$target}{'text'}{$text} = 1;
		$alerts{$target}{'type'} |= $type;
		if ($alerts{$target}{'print'} == 0)
		{
		    if ($UPDATE)
		    {
			printalert($target, 'UPDATE SIG');
		    }
		}
	    }
	    if ($pkts > $alerts{$target}{'pkts'})
	    {
		$alerts{$target}{'pkts'} = $pkts;
	    }
	    if ($bytes > $alerts{$target}{'bytes'})
	    {
		$alerts{$target}{'bytes'} = $bytes;
		if ($alerts{$target}{'print'} == 0)
		{
		    if ($UPDATE)
		    {
			printalert($target, 'UPDATE RATE');
		    }
		}
	    }
	    if ($time > $alerts{$target}{'end'})
	    {
		$alerts{$target}{'end'} = $time;		
	    }
	}
    }
    cleanalerts($curtime, 1);
    # eof reached on FH, but wait a second and maybe there will be more output
    sleep 10;
    seek $FH, $curpos, 0;      # this clears the eof flag on FH
}