Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] TAnomaly does not count unique destination IPs correctly #204

Closed
frikilax opened this issue Sep 21, 2020 · 0 comments · Fixed by #199
Closed

[BUG] TAnomaly does not count unique destination IPs correctly #204

frikilax opened this issue Sep 21, 2020 · 0 comments · Fixed by #199
Labels
bug Something isn't working
Milestone

Comments

@frikilax
Copy link
Member

Describe the bug
the tanomaly filter does not count unique destination IPs for a specific source IP: the counter does not look for already counted destinations, introducing (many) duplicates in results.

Plateform (please complete the following information):

  • all

To Reproduce
Steps to reproduce the behavior:

  1. Start a tanomaly filter
  2. Send 200+ uniform data (random ip src/dst, random port, tcp proto)
  3. Send 100+ data with same IP src, but same IP dst and random port (tcp proto)
  4. Wait for filter to trigger and generate alert
  5. Look alert
  6. alert should have a tcp_nb_host equal to the tcp_nb_port, even though there is only a single destination IP

Expected behavior
The nb_dst_host should be at 1, this results in mistakes during distances calculations, false positives and negatives can occur easily

Additional context
This results in the preprocessing algorithm not caching/searching destination IPs during aggregation (as done properly with the ports).
As such, the anomaly filter is not impacted by this bug.

@frikilax frikilax added the bug Something isn't working label Sep 21, 2020
@frikilax frikilax linked a pull request Sep 21, 2020 that will close this issue
7 tasks
@frikilax frikilax added this to the 1.4.0 milestone Sep 21, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant