Documentation
¶
Index ¶
- Constants
- func CheckMxTxtNullRecordInQuestions(dns_packet *layers.DNS, features []DNSFeatures) bool
- func DomainVarsCount(dns_label string) (int, int, int)
- func Entropy(dns_label []string) float32
- func EntropyLabel(dns_label string) float64
- func GenerateFloatVectors(features []DNSFeatures, onnx *OnnxModel) [][]float32
- func GetCurrentLoggedExfiltratedProcessids() map[uint32]int
- func HandleKernelDroppedPacket[T progs.Protocol](ctx context.Context, dnsLayer gopacket.Layer, isIpv4, isUdp bool, protocol T, ...)
- func IncrementMaliciousProcCountLocalCache(procId uint32)
- func LabelCountExcludeRootDomain(dns_label *string) int
- func LongestandTotoalLenSubdomains(dns_label []string) (int, int, float32)
- func OnnxModelFsUnixMountWatcher(ctx context.Context, globalNodeAgentFsWtchChan chan bool)
- func StaticRuntimeBenignDomainChecks(features []DNSFeatures) bool
- func StaticRuntimeMaliciousDomainChecks(features []DNSFeatures) bool
- func WatchEvents(ctx context.Context, doneChan, globalNodeAgentFsWatchCloseChan chan bool, ...)
- type CombinedFeatures
- type DNSFeatures
- func ParseDnsAdditional(dns_packet *layers.DNS, features []DNSFeatures, isEgress bool) ([]DNSFeatures, error)
- func ParseDnsAnswers(dns_packet *layers.DNS, features []DNSFeatures, isEgress bool) ([]DNSFeatures, error)
- func ParseDnsAuth(dns_packet *layers.DNS, features []DNSFeatures, isEgress bool) ([]DNSFeatures, error)
- func ParseDnsQuestions(dns_packet *layers.DNS, features []DNSFeatures, isEgress bool, i int) ([]DNSFeatures, error)
- func ProcessDnsFeatures(dns_packet *layers.DNS, isEgress bool) ([]DNSFeatures, error)
- type DnsPacketGen
- func (d *DnsPacketGen) CleanStaleOlderPacketRescheduleConnEntry(customNsFdHandle *int, conntrackEntry *conntrack.ConntrackCleanEntry) error
- func (d *DnsPacketGen) EvalOverallPacketProcessTime(dns layers.DNS, spec *ebpf.Collection, enforceNetworkPolicyTime bool)
- func (d *DnsPacketGen) EvaluateGeneratePacket(ctx context.Context, ...) error
- func (d *DnsPacketGen) GenerateDnsPacket(dns layers.DNS, customNsFdHandle *int) layers.DNS
- type DnsPacketGenConfig
- type OnnxModel
Constants ¶
View Source
const ( DEEP_LEXICAL_INFERENCING = iota STATIC_BENIGN_INFERENCING // node agent found no further deep lexical analysis required its benign and can be procceed to leave the user space )
Variables ¶
This section is empty.
Functions ¶
func CheckMxTxtNullRecordInQuestions ¶
func CheckMxTxtNullRecordInQuestions(dns_packet *layers.DNS, features []DNSFeatures) bool
for now verify and drop if its mail or null records
func EntropyLabel ¶
func GenerateFloatVectors ¶
func GenerateFloatVectors(features []DNSFeatures, onnx *OnnxModel) [][]float32
func IncrementMaliciousProcCountLocalCache ¶
func IncrementMaliciousProcCountLocalCache(procId uint32)
func StaticRuntimeBenignDomainChecks ¶
func StaticRuntimeBenignDomainChecks(features []DNSFeatures) bool
to prevent reinference all the domains, including the TLD, and actual domain must be found in the cache of benign domain for faster inferenceing
func StaticRuntimeMaliciousDomainChecks ¶
func StaticRuntimeMaliciousDomainChecks(features []DNSFeatures) bool
Types ¶
type CombinedFeatures ¶
type CombinedFeatures []DNSFeatures
type DNSFeatures ¶
type DNSFeatures struct {
Fqdn string
Tld string
Subdomain string
TotalChars int
TotalCharsInSubdomain int // holds the chars which are unicode encodable and can be stored
NumberCount int
UCaseCount int
Entropy float32
Periods int
PeriodsInSubDomain int
LongestLabelDomain int
AverageLabelLength float32
IsEgress bool
RecordType string
AuthZoneSoaservers map[string]string // zone master --> mx record type
}
func ParseDnsAdditional ¶
func ParseDnsAdditional(dns_packet *layers.DNS, features []DNSFeatures, isEgress bool) ([]DNSFeatures, error)
func ParseDnsAnswers ¶
func ParseDnsAnswers(dns_packet *layers.DNS, features []DNSFeatures, isEgress bool) ([]DNSFeatures, error)
func ParseDnsAuth ¶
func ParseDnsAuth(dns_packet *layers.DNS, features []DNSFeatures, isEgress bool) ([]DNSFeatures, error)
func ParseDnsQuestions ¶
func ParseDnsQuestions(dns_packet *layers.DNS, features []DNSFeatures, isEgress bool, i int) ([]DNSFeatures, error)
func ProcessDnsFeatures ¶
func ProcessDnsFeatures(dns_packet *layers.DNS, isEgress bool) ([]DNSFeatures, error)
type DnsPacketGen ¶
type DnsPacketGen struct {
IfaceHandler *netinet.NetIface // AF_NETLINK
SocketSendFd *int // AF_PACKET
XdpSocketSendFd *xdp.Socket // AF_XDP
OnnxModel *OnnxModel
StreamClient *stream.StreamProducer
}
func NewDnsPacketResendUtils ¶
func NewDnsPacketResendUtils(config *DnsPacketGenConfig) (*DnsPacketGen, error)
func (*DnsPacketGen) CleanStaleOlderPacketRescheduleConnEntry ¶
func (d *DnsPacketGen) CleanStaleOlderPacketRescheduleConnEntry(customNsFdHandle *int, conntrackEntry *conntrack.ConntrackCleanEntry) error
Re packet send gen ensure removal of stale conntrack entries to reserved cokernel memory and prevent the conntrack table to grow
func (*DnsPacketGen) EvalOverallPacketProcessTime ¶
func (d *DnsPacketGen) EvalOverallPacketProcessTime(dns layers.DNS, spec *ebpf.Collection, enforceNetworkPolicyTime bool)
func (*DnsPacketGen) EvaluateGeneratePacket ¶
func (d *DnsPacketGen) EvaluateGeneratePacket(ctx context.Context, ethLayer, networkLayer, transportLayer, dnsLayer gopacket.Layer, l3_bpfMap_checksum uint16, handler *pcap.Handle, isEgress bool, isIpv4, isUdp bool, spec *ebpf.Collection, processInfo *utils.MaliciousKernelTaskCommExportedProcInfo, isPhysicalNetDevSniff bool, egressLink netlink.Link, allowXDP bool, customDnat bool, customUpstreamDnsresolveIp string) error
Runs inference over DL model and esends if non malicious ove AF_XDP OR AF_PACKET TODO: fix massive amount of functions args to the function, for custom config structs
func (*DnsPacketGen) GenerateDnsPacket ¶
type DnsPacketGenConfig ¶
type DnsPacketGenConfig struct {
Iface *netinet.NetIface
OnnxModel *OnnxModel
StreamClient *stream.StreamProducer
}
type OnnxModel ¶
type OnnxModel struct {
TopDomainsDNSServer *utils.TopDomains
InferenceServerSock *inference.DNSOnnxInferenceService // grpc socket l7 client connected to onnx inference server over UDS
}
func NewOnnxModelRemoteInference ¶
func NewOnnxModelRemoteInference(topDomains *utils.TopDomains, inferenceServerSock *inference.DNSOnnxInferenceService) (*OnnxModel, error)
Click to show internal directories.
Click to hide internal directories.