Attacker IP Prioritization (AIP) Tool

The Attacker IP Prioritization (AIP) is a tool to generate efficient and economic IP blocklists based on network traffic captured from honeypot networks.

With the advent of 5G, IoT devices are directly connected often without firewall protection. Therefore we need blocklists that are small, efficient and economic. The AIP structure is shown below.

AIP Models

Each AIP model generates its own blocklist based on a specific criteria. The main models are:

Prioritize New (PN)
- Focuses on IPs that are new or have not been seen frequently in previous data.
- Useful to identify emerging attackers that are starting to target a network.
Prioritize Consistent (PC)
- Focuses on IPs that have consistently attacked over time in previous data.
- Useful to identify persistent attackers that continuously target a network.
Alpha
- Provides a baseline identifying all attackers seen in the last 24 hours.
- Useful to compare the effectiveness of other models.
Alpha7
- Provides a baseline identifying all attackers seen in the last 7 days.
- Useful to further compare the effectiveness of other models.
Random Forest
- Focuses on IPs that are more likely to attack in the future.
- A more experimental approach to increase blocklist efficiency.

AIP Docker

The best way to run AIP right now is using Docker.

Usage

AIP will automatically attempt to run all the models using the available data. Assuming the Zeek data is located in its usual location:

:~$ cd AIP
:~$ docker run --rm -v /opt/zeek/logs/:/home/aip/AIP/data/raw:ro -v ${PWD}/data/:/home/aip/AIP/data/:rw --name aip stratosphereips/aip:latest bin/aip

To run AIP for a specific day:

:~$ cd AIP
:~$ docker run --rm -v /opt/zeek/logs/:/home/aip/AIP/data/raw:ro -v ${PWD}/data/:/home/aip/AIP/data/:rw --name aip stratosphereips/aip:latest bin/aip YYYY-MM-DD

License

The Stratosphere AIP tool is licensed under GNU General Public License v3.0.

About

This tool was developed at the Stratosphere Laboratory at the Czech Technical University in Prague. This is part of the Stratosphere blocklist generation project.

This tool was originally born from the bachelor thesis of Thomas O'Hara, The Attacker IP Prioritizer: An IoT Optimized Blacklisting Algorithm (2021).

Attacker IP Prioritization (AIP) Tool

The Attacker IP Prioritization (AIP) is a tool to generate efficient and economic IP blocklists based on network traffic captured from honeypot networks.

With the advent of 5G, IoT devices are directly connected often without firewall protection. Therefore we need blocklists that are small, efficient and economic. The AIP structure is shown below.

AIP Models

Each AIP model generates its own blocklist based on a specific criteria. The main models are:

Prioritize New (PN)
- Focuses on IPs that are new or have not been seen frequently in previous data.
- Useful to identify emerging attackers that are starting to target a network.
Prioritize Consistent (PC)
- Focuses on IPs that have consistently attacked over time in previous data.
- Useful to identify persistent attackers that continuously target a network.
Alpha
- Provides a baseline identifying all attackers seen in the last 24 hours.
- Useful to compare the effectiveness of other models.
Alpha7
- Provides a baseline identifying all attackers seen in the last 7 days.
- Useful to further compare the effectiveness of other models.
Random Forest
- Focuses on IPs that are more likely to attack in the future.
- A more experimental approach to increase blocklist efficiency.

AIP Docker

The best way to run AIP right now is using Docker.

Usage

AIP will automatically attempt to run all the models using the available data. Assuming the Zeek data is located in its usual location:

:~$ cd AIP
:~$ docker run --rm -v /opt/zeek/logs/:/home/aip/AIP/data/raw:ro -v ${PWD}/data/:/home/aip/AIP/data/:rw --name aip stratosphereips/aip:latest bin/aip

To run AIP for a specific day:

:~$ cd AIP
:~$ docker run --rm -v /opt/zeek/logs/:/home/aip/AIP/data/raw:ro -v ${PWD}/data/:/home/aip/AIP/data/:rw --name aip stratosphereips/aip:latest bin/aip YYYY-MM-DD

License

The Stratosphere AIP tool is licensed under GNU General Public License v3.0.

About

This tool was developed at the Stratosphere Laboratory at the Czech Technical University in Prague. This is part of the Stratosphere blocklist generation project.

This tool was originally born from the bachelor thesis of Thomas O'Hara, The Attacker IP Prioritizer: An IoT Optimized Blacklisting Algorithm (2021).

Attacker IP Prioritization (AIP) Tool

The Attacker IP Prioritization (AIP) is a tool to generate efficient and economic IP blocklists based on network traffic captured from honeypot networks.

With the advent of 5G, IoT devices are directly connected often without firewall protection. Therefore we need blocklists that are small, efficient and economic. The AIP structure is shown below.

AIP Models

Each AIP model generates its own blocklist based on a specific criteria. The main models are:

Prioritize New (PN)
- Focuses on IPs that are new or have not been seen frequently in previous data.
- Useful to identify emerging attackers that are starting to target a network.
Prioritize Consistent (PC)
- Focuses on IPs that have consistently attacked over time in previous data.
- Useful to identify persistent attackers that continuously target a network.
Alpha
- Provides a baseline identifying all attackers seen in the last 24 hours.
- Useful to compare the effectiveness of other models.
Alpha7
- Provides a baseline identifying all attackers seen in the last 7 days.
- Useful to further compare the effectiveness of other models.
Random Forest
- Focuses on IPs that are more likely to attack in the future.
- A more experimental approach to increase blocklist efficiency.

AIP Docker

The best way to run AIP right now is using Docker.

Usage

AIP will automatically attempt to run all the models using the available data. Assuming the Zeek data is located in its usual location:

:~$ cd AIP
:~$ docker run --rm -v /opt/zeek/logs/:/home/aip/AIP/data/raw:ro -v ${PWD}/data/:/home/aip/AIP/data/:rw --name aip stratosphereips/aip:latest bin/aip

To run AIP for a specific day:

:~$ cd AIP
:~$ docker run --rm -v /opt/zeek/logs/:/home/aip/AIP/data/raw:ro -v ${PWD}/data/:/home/aip/AIP/data/:rw --name aip stratosphereips/aip:latest bin/aip YYYY-MM-DD

License

The Stratosphere AIP tool is licensed under GNU General Public License v3.0.

About

This tool was developed at the Stratosphere Laboratory at the Czech Technical University in Prague. This is part of the Stratosphere blocklist generation project.

This tool was originally born from the bachelor thesis of Thomas O'Hara, The Attacker IP Prioritizer: An IoT Optimized Blacklisting Algorithm (2021).

Attacker IP Prioritization (AIP) Tool

The Attacker IP Prioritization (AIP) is a tool to generate efficient and economic IP blocklists based on network traffic captured from honeypot networks.

With the advent of 5G, IoT devices are directly connected often without firewall protection. Therefore we need blocklists that are small, efficient and economic. The AIP structure is shown below.

AIP Models

Each AIP model generates its own blocklist based on a specific criteria. The main models are:

Prioritize New (PN)
- Focuses on IPs that are new or have not been seen frequently in previous data.
- Useful to identify emerging attackers that are starting to target a network.
Prioritize Consistent (PC)
- Focuses on IPs that have consistently attacked over time in previous data.
- Useful to identify persistent attackers that continuously target a network.
Alpha
- Provides a baseline identifying all attackers seen in the last 24 hours.
- Useful to compare the effectiveness of other models.
Alpha7
- Provides a baseline identifying all attackers seen in the last 7 days.
- Useful to further compare the effectiveness of other models.
Random Forest
- Focuses on IPs that are more likely to attack in the future.
- A more experimental approach to increase blocklist efficiency.

AIP Docker

The best way to run AIP right now is using Docker.

Usage

AIP will automatically attempt to run all the models using the available data. Assuming the Zeek data is located in its usual location:

:~$ cd AIP
:~$ docker run --rm -v /opt/zeek/logs/:/home/aip/AIP/data/raw:ro -v ${PWD}/data/:/home/aip/AIP/data/:rw --name aip stratosphereips/aip:latest bin/aip

To run AIP for a specific day:

:~$ cd AIP
:~$ docker run --rm -v /opt/zeek/logs/:/home/aip/AIP/data/raw:ro -v ${PWD}/data/:/home/aip/AIP/data/:rw --name aip stratosphereips/aip:latest bin/aip YYYY-MM-DD

License

The Stratosphere AIP tool is licensed under GNU General Public License v3.0.

About

This tool was developed at the Stratosphere Laboratory at the Czech Technical University in Prague. This is part of the Stratosphere blocklist generation project.

This tool was originally born from the bachelor thesis of Thomas O'Hara, The Attacker IP Prioritizer: An IoT Optimized Blacklisting Algorithm (2021).

Attacker IP Prioritization (AIP) Tool

The Attacker IP Prioritization (AIP) is a tool to generate efficient and economic IP blocklists based on network traffic captured from honeypot networks.

With the advent of 5G, IoT devices are directly connected often without firewall protection. Therefore we need blocklists that are small, efficient and economic. The AIP structure is shown below.

AIP Models

Each AIP model generates its own blocklist based on a specific criteria. The main models are:

Prioritize New (PN)
- Focuses on IPs that are new or have not been seen frequently in previous data.
- Useful to identify emerging attackers that are starting to target a network.
Prioritize Consistent (PC)
- Focuses on IPs that have consistently attacked over time in previous data.
- Useful to identify persistent attackers that continuously target a network.
Alpha
- Provides a baseline identifying all attackers seen in the last 24 hours.
- Useful to compare the effectiveness of other models.
Alpha7
- Provides a baseline identifying all attackers seen in the last 7 days.
- Useful to further compare the effectiveness of other models.
Random Forest
- Focuses on IPs that are more likely to attack in the future.
- A more experimental approach to increase blocklist efficiency.

AIP Docker

The best way to run AIP right now is using Docker.

Usage

AIP will automatically attempt to run all the models using the available data. Assuming the Zeek data is located in its usual location:

:~$ cd AIP
:~$ docker run --rm -v /opt/zeek/logs/:/home/aip/AIP/data/raw:ro -v ${PWD}/data/:/home/aip/AIP/data/:rw --name aip stratosphereips/aip:latest bin/aip

To run AIP for a specific day:

:~$ cd AIP
:~$ docker run --rm -v /opt/zeek/logs/:/home/aip/AIP/data/raw:ro -v ${PWD}/data/:/home/aip/AIP/data/:rw --name aip stratosphereips/aip:latest bin/aip YYYY-MM-DD

License

The Stratosphere AIP tool is licensed under GNU General Public License v3.0.

About

This tool was developed at the Stratosphere Laboratory at the Czech Technical University in Prague. This is part of the Stratosphere blocklist generation project.

This tool was originally born from the bachelor thesis of Thomas O'Hara, The Attacker IP Prioritizer: An IoT Optimized Blacklisting Algorithm (2021).

Attacker IP Prioritization (AIP) Tool

The Attacker IP Prioritization (AIP) is a tool to generate efficient and economic IP blocklists based on network traffic captured from honeypot networks.

With the advent of 5G, IoT devices are directly connected often without firewall protection. Therefore we need blocklists that are small, efficient and economic. The AIP structure is shown below.

AIP Models

Each AIP model generates its own blocklist based on a specific criteria. The main models are:

Prioritize New (PN)
- Focuses on IPs that are new or have not been seen frequently in previous data.
- Useful to identify emerging attackers that are starting to target a network.
Prioritize Consistent (PC)
- Focuses on IPs that have consistently attacked over time in previous data.
- Useful to identify persistent attackers that continuously target a network.
Alpha
- Provides a baseline identifying all attackers seen in the last 24 hours.
- Useful to compare the effectiveness of other models.
Alpha7
- Provides a baseline identifying all attackers seen in the last 7 days.
- Useful to further compare the effectiveness of other models.
Random Forest
- Focuses on IPs that are more likely to attack in the future.
- A more experimental approach to increase blocklist efficiency.

AIP Docker

The best way to run AIP right now is using Docker.

Usage

AIP will automatically attempt to run all the models using the available data. Assuming the Zeek data is located in its usual location:

:~$ cd AIP
:~$ docker run --rm -v /opt/zeek/logs/:/home/aip/AIP/data/raw:ro -v ${PWD}/data/:/home/aip/AIP/data/:rw --name aip stratosphereips/aip:latest bin/aip

To run AIP for a specific day:

:~$ cd AIP
:~$ docker run --rm -v /opt/zeek/logs/:/home/aip/AIP/data/raw:ro -v ${PWD}/data/:/home/aip/AIP/data/:rw --name aip stratosphereips/aip:latest bin/aip YYYY-MM-DD

License

The Stratosphere AIP tool is licensed under GNU General Public License v3.0.

About

This tool was developed at the Stratosphere Laboratory at the Czech Technical University in Prague. This is part of the Stratosphere blocklist generation project.

This tool was originally born from the bachelor thesis of Thomas O'Hara, The Attacker IP Prioritizer: An IoT Optimized Blacklisting Algorithm (2021).

Attacker IP Prioritization (AIP) Tool

The Attacker IP Prioritization (AIP) is a tool to generate efficient and economic IP blocklists based on network traffic captured from honeypot networks.

With the advent of 5G, IoT devices are directly connected often without firewall protection. Therefore we need blocklists that are small, efficient and economic. The AIP structure is shown below.

AIP Models

Each AIP model generates its own blocklist based on a specific criteria. The main models are:

Prioritize New (PN)
- Focuses on IPs that are new or have not been seen frequently in previous data.
- Useful to identify emerging attackers that are starting to target a network.
Prioritize Consistent (PC)
- Focuses on IPs that have consistently attacked over time in previous data.
- Useful to identify persistent attackers that continuously target a network.
Alpha
- Provides a baseline identifying all attackers seen in the last 24 hours.
- Useful to compare the effectiveness of other models.
Alpha7
- Provides a baseline identifying all attackers seen in the last 7 days.
- Useful to further compare the effectiveness of other models.
Random Forest
- Focuses on IPs that are more likely to attack in the future.
- A more experimental approach to increase blocklist efficiency.

AIP Docker

The best way to run AIP right now is using Docker.

Usage

AIP will automatically attempt to run all the models using the available data. Assuming the Zeek data is located in its usual location:

:~$ cd AIP
:~$ docker run --rm -v /opt/zeek/logs/:/home/aip/AIP/data/raw:ro -v ${PWD}/data/:/home/aip/AIP/data/:rw --name aip stratosphereips/aip:latest bin/aip

To run AIP for a specific day:

:~$ cd AIP
:~$ docker run --rm -v /opt/zeek/logs/:/home/aip/AIP/data/raw:ro -v ${PWD}/data/:/home/aip/AIP/data/:rw --name aip stratosphereips/aip:latest bin/aip YYYY-MM-DD

License

The Stratosphere AIP tool is licensed under GNU General Public License v3.0.

About

This tool was developed at the Stratosphere Laboratory at the Czech Technical University in Prague. This is part of the Stratosphere blocklist generation project.

This tool was originally born from the bachelor thesis of Thomas O'Hara, The Attacker IP Prioritizer: An IoT Optimized Blacklisting Algorithm (2021).

Attacker IP Prioritization (AIP) Tool

The Attacker IP Prioritization (AIP) is a tool to generate efficient and economic IP blocklists based on network traffic captured from honeypot networks.

With the advent of 5G, IoT devices are directly connected often without firewall protection. Therefore we need blocklists that are small, efficient and economic. The AIP structure is shown below.

AIP Models

Each AIP model generates its own blocklist based on a specific criteria. The main models are:

Prioritize New (PN)
- Focuses on IPs that are new or have not been seen frequently in previous data.
- Useful to identify emerging attackers that are starting to target a network.
Prioritize Consistent (PC)
- Focuses on IPs that have consistently attacked over time in previous data.
- Useful to identify persistent attackers that continuously target a network.
Alpha
- Provides a baseline identifying all attackers seen in the last 24 hours.
- Useful to compare the effectiveness of other models.
Alpha7
- Provides a baseline identifying all attackers seen in the last 7 days.
- Useful to further compare the effectiveness of other models.
Random Forest
- Focuses on IPs that are more likely to attack in the future.
- A more experimental approach to increase blocklist efficiency.

AIP Docker

The best way to run AIP right now is using Docker.

Usage

AIP will automatically attempt to run all the models using the available data. Assuming the Zeek data is located in its usual location:

:~$ cd AIP
:~$ docker run --rm -v /opt/zeek/logs/:/home/aip/AIP/data/raw:ro -v ${PWD}/data/:/home/aip/AIP/data/:rw --name aip stratosphereips/aip:latest bin/aip

To run AIP for a specific day:

:~$ cd AIP
:~$ docker run --rm -v /opt/zeek/logs/:/home/aip/AIP/data/raw:ro -v ${PWD}/data/:/home/aip/AIP/data/:rw --name aip stratosphereips/aip:latest bin/aip YYYY-MM-DD

License

The Stratosphere AIP tool is licensed under GNU General Public License v3.0.

About

This tool was developed at the Stratosphere Laboratory at the Czech Technical University in Prague. This is part of the Stratosphere blocklist generation project.

This tool was originally born from the bachelor thesis of Thomas O'Hara, The Attacker IP Prioritizer: An IoT Optimized Blacklisting Algorithm (2021).

Name		Name	Last commit message	Last commit date
.github		.github
bin		bin
data		data
etc		etc
images		images
lib/aip		lib/aip
tests		tests
.dockerignore		.dockerignore
.env_example		.env_example
.gitignore		.gitignore
CITATION.cff		CITATION.cff
CODE_OF_CONDUCT.md		CODE_OF_CONDUCT.md
ChangeLog.md		ChangeLog.md
LICENSE		LICENSE
README.md		README.md
SECURITY.md		SECURITY.md
requirements.txt		requirements.txt

Name		Name	Last commit message	Last commit date
.github		.github
bin		bin
data		data
etc		etc
images		images
lib/aip		lib/aip
tests		tests
.dockerignore		.dockerignore
.env_example		.env_example
.gitignore		.gitignore
CITATION.cff		CITATION.cff
CODE_OF_CONDUCT.md		CODE_OF_CONDUCT.md
ChangeLog.md		ChangeLog.md
LICENSE		LICENSE
README.md		README.md
SECURITY.md		SECURITY.md
requirements.txt		requirements.txt

Name		Name	Last commit message	Last commit date
.github		.github
bin		bin
data		data
etc		etc
images		images
lib/aip		lib/aip
tests		tests
.dockerignore		.dockerignore
.env_example		.env_example
.gitignore		.gitignore
CITATION.cff		CITATION.cff
CODE_OF_CONDUCT.md		CODE_OF_CONDUCT.md
ChangeLog.md		ChangeLog.md
LICENSE		LICENSE
README.md		README.md
SECURITY.md		SECURITY.md
requirements.txt		requirements.txt

Name		Name	Last commit message	Last commit date
.github		.github
bin		bin
data		data
etc		etc
images		images
lib/aip		lib/aip
tests		tests
.dockerignore		.dockerignore
.env_example		.env_example
.gitignore		.gitignore
CITATION.cff		CITATION.cff
CODE_OF_CONDUCT.md		CODE_OF_CONDUCT.md
ChangeLog.md		ChangeLog.md
LICENSE		LICENSE
README.md		README.md
SECURITY.md		SECURITY.md
requirements.txt		requirements.txt

Name		Name	Last commit message	Last commit date
.github		.github
bin		bin
data		data
etc		etc
images		images
lib/aip		lib/aip
tests		tests
.dockerignore		.dockerignore
.env_example		.env_example
.gitignore		.gitignore
CITATION.cff		CITATION.cff
CODE_OF_CONDUCT.md		CODE_OF_CONDUCT.md
ChangeLog.md		ChangeLog.md
LICENSE		LICENSE
README.md		README.md
SECURITY.md		SECURITY.md
requirements.txt		requirements.txt

Uh oh!

Latest commit

History

Folders and files

Repository files navigation

Attacker IP Prioritization (AIP) Tool

AIP Models

AIP Docker

Usage

License

About

About

Topics

Resources

Code of conduct

Contributing

Security policy

Stars

Watchers

Forks

Releases

Packages

Used by

Contributors

Languages

Uh oh!

Latest commit

History

Folders and files

Repository files navigation

Attacker IP Prioritization (AIP) Tool

AIP Models

AIP Docker

Usage

License

About

About

Topics

Resources

Code of conduct

Contributing

Security policy

Stars

Watchers

Forks

Releases

Packages

Used by

Contributors

Languages

Uh oh!

Latest commit

History

Folders and files

Repository files navigation

Attacker IP Prioritization (AIP) Tool

AIP Models

AIP Docker

Usage

License

About

About

Topics

Resources

Code of conduct

Contributing

Security policy

Stars

Watchers

Forks

Releases

Packages

Used by

Contributors

Languages

Uh oh!

Latest commit

History

Folders and files

Repository files navigation