Skip to content

Commit

Permalink
adding checks to the detector
Browse files Browse the repository at this point in the history
  • Loading branch information
Virgula0 committed Jan 18, 2025
1 parent 634d599 commit 065bdba
Show file tree
Hide file tree
Showing 3 changed files with 37 additions and 6 deletions.
11 changes: 10 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ In the project the following files have the described functions:

> [!WARNING]
> The entire software is designed for running on a Linux environment and although the only changes needed for running on another operating system are interface names, some checks may fail due to different environments.
> For example: `detector.py` (https://github.com/Virgula0/nmap-harvester/blob/main/detector.py#L55) contains a check to run with `root` privileges and this check should be commented if the environment is different from Unix.
> For example: `detector.py` contains a check to run with `root` privileges and this check should be commented if the environment is different from Unix. This can be disabled using `--no-strick-check` argument when running the script.
> This disclaimer has been inserted because I noticed the usage of other operating systems during the course lectures. Running the `detector.py` on a virtual environment should work because everything is set to run on the `localhost` interface, but even here, the creation of the dataset phases may not work because of interfaces used by pyshark on a virtual machine. A solution can be to create another container and let the 2 isolated container to communicate between them, but this is up to the readers to investigate better eventually.
## Requirements
Expand Down Expand Up @@ -282,6 +282,15 @@ Time : 1.000000ms
# Running the Detector

The `detector.py` represents the live-demo for NMAP attacks detection.
The host is required to having `nmap` installed.

Depending on your distro

```bash
sudo apt update -y && sudo apt install nmap -y
sudo pacman && sudo pacman -S nmap
flatpak install nmap
```

To run the detector:

Expand Down
19 changes: 14 additions & 5 deletions detector.py
Original file line number Diff line number Diff line change
Expand Up @@ -3,15 +3,15 @@
from rich.live import Live
from rich.table import Table
from rich.console import Console
from utils import preprocess_dataset, save_logs, RUNTIME_CAPTURE
import pandas as pd
import datetime
import os
from interceptor import capture_packets
import threading
import signal
import sys
from interceptor import capture_packets
from injector import run_injector
from utils import preprocess_dataset, save_logs, RUNTIME_CAPTURE, OS_INSTALLATION_PATHS

SLEEP_SECONDS = 1
MODEL_PATH = 'model/model.pkl'
Expand Down Expand Up @@ -52,9 +52,18 @@ def generate_output(data, anomaly_detected, normal_count, anomaly_count, normal_

def main():

if os.geteuid() != 0:
console.print("[bold red]Pyshark needs root privileges for capturing data on interfaces[/bold red]")
sys.exit(-1)
no_strict_check_flag = "--no-strict-check" in sys.argv if len(sys.argv) > 1 else False

# byass check for nmap installed on the host and root privileges
if not no_strict_check_flag:

if not any(os.path.exists(os.path.join(x, "nmap")) for x in OS_INSTALLATION_PATHS):
console.print("[bold red]Nmap is required to be installed on the host[/bold red]")
sys.exit(-1)

if os.geteuid() != 0:
console.print("[bold red]Pyshark needs root privileges for capturing data on interfaces[/bold red]")
sys.exit(-1)

model = joblib.load(MODEL_PATH)
console.print(f"[bold green][INFO] Model loaded successfully! {type(model)}[/bold green]")
Expand Down
13 changes: 13 additions & 0 deletions utils.py
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,19 @@

LOG_FILE = 'logs'
RUNTIME_CAPTURE = 'datasets/runtime/capture.csv'
OS_INSTALLATION_PATHS = [
"/bin",
"/sbin",
"/usr/bin",
"/usr/sbin",
"/opt",
"/usr/local/bin",
"/usr/local/sbin",
"/snap/bin",
"/var/lib/flatpak/app",
"/libexec",
"/usr/libexec"
]

# Utility function for time measurement
def current_ms() -> int:
Expand Down

0 comments on commit 065bdba

Please sign in to comment.