You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
the tanomaly filter does not count unique destination IPs for a specific source IP: the counter does not look for already counted destinations, introducing (many) duplicates in results.
Plateform (please complete the following information):
all
To Reproduce
Steps to reproduce the behavior:
Start a tanomaly filter
Send 200+ uniform data (random ip src/dst, random port, tcp proto)
Send 100+ data with same IP src, but same IP dst and random port (tcp proto)
Wait for filter to trigger and generate alert
Look alert
alert should have a tcp_nb_host equal to the tcp_nb_port, even though there is only a single destination IP
Expected behavior
The nb_dst_host should be at 1, this results in mistakes during distances calculations, false positives and negatives can occur easily
Additional context
This results in the preprocessing algorithm not caching/searching destination IPs during aggregation (as done properly with the ports).
As such, the anomaly filter is not impacted by this bug.
The text was updated successfully, but these errors were encountered:
Describe the bug
the tanomaly filter does not count unique destination IPs for a specific source IP: the counter does not look for already counted destinations, introducing (many) duplicates in results.
Plateform (please complete the following information):
To Reproduce
Steps to reproduce the behavior:
Expected behavior
The nb_dst_host should be at 1, this results in mistakes during distances calculations, false positives and negatives can occur easily
Additional context
This results in the preprocessing algorithm not caching/searching destination IPs during aggregation (as done properly with the ports).
As such, the anomaly filter is not impacted by this bug.
The text was updated successfully, but these errors were encountered: