mole-ids / mole Goto Github PK

Yara powered NIDS with high speed packet capture powered by PF_RING

License: Apache License 2.0

YARA 37.33% Go 54.43% Makefile 0.67% Shell 7.57%

pf-ring ids nids yara golang go libpcap

mole's Introduction

Mole is an experimental Network Intrusion Detection System that uses Yara as matching engine and PF_RING for high speed packet capture.

. Features . Supported OSes . Quickstart . Documentation . Contributing .

Features

Yara engine for packet matching
PF_RING integration
Rule configuration using meta fields from Yara (variables, ranges, ...)

Supported OSes

Planned Windows 10 and MacOS X.

Quickstart

To get your hands on Mole, you can use the 5-Minute Quickstart in our documentation.

Documentation

You can find the complete documentation of Mole at https://docs.mole-ids.org.

Contributing

Please note that this project is released with a Contributor Code of Conduct. By participating in this project, you agree to abide by its terms.

mole's People

Contributors

Stargazers

Watchers

Forkers

millaguie asked637 5l1v3r1 wade-welles tawawhite topperun chaobingya x-tfrk jpalanco

mole's Issues

Payload offset for yara matching

Currently, the payload for matching coincidences takes the whole packet. The expected behavior it is taking the payload of the current layer.

Examples:

For IP layer, the payload will be the data of ip layer.

For TCP, UDP, ... the payload will be the data on that layer.

Enable logging

Implement the same format used by suricata's eve.json

Make libpcap default sniffier driver

Make Mole to run by default with the libpcap driver.

Log using an output similar to the Suricata one

Writing the IDS matches to a file will be really handy as well as logging each match with the same format as the Suricata, or at least as much similar as possible.

Allow Mole to capture traffic without PF_Ring

At the moment Mole is only able to capture traffic using PF_ring so adding the capability to capture traffic using libpcap will make Mole more compatible with other systems.

Modify configuration rules behavior

The rule path is relative to the mole binary, I consider its more natural if the path is relative to the configuration file

Defragmentation support

Implement buffer to support defragmented traffic.

References:

Enable ip stack support

Enable parse and configuration to match rules on IP payload

Add command to read PCAP from file

Negation operator

The rules should support negation operator for ports and addresses

Add flowbits feature from Snort/Suricata

Adding this feature will allow MoleIDS to detect multi-phase attacks.

It could be implemented adding a new entry in the meta section, for example:

rule dummy {
    meta:
        // ...
       flowbits = "set:variable, isset:variable, unset:variable"
    // ...
}

The meta entry flowbits will be a comma separated string with key:value options. The key will be the operation against the flowbits and the value will be the variable where the action takes effect.

It will be also possible to reuse operations, like set:var1, set:var2.

BSD OS Support

Can you please add at least FreeBSD and OpenBSD to your planned list of supported operating systems?

Thanks in advace.