MSNM Sensor – Multivariate Statistical Network Monitoring Sensor

MSNM Sensor (Multivariate Statistical Network Monitoring-Sensor) shows the practical suitability of the approaches found in PCA-MSNM and in Hierarchical PCA-MSNM works.

The first one present the MSNM approach and new multivariate statistical methodology for network anomaly detection while the second one proposes the previous one in a hierarchical and structured network systems.

The main idea behind these works, is the use of multivariate statistical techniques to generate useful information in the form of two statistics. Such a light information comes from lower to higher levels in a network hierarchy.

Also Read – Python Uncompyle6 – A Cross-Version Python Bytecode Decompiler

This way, the root sensor (for example, a border router) received all the statistical information being able to compute its own statistics (Q,D). By inspecting this statistics, a security analyst can determine if anomalous event are happening when some of the statistic values are above certain control limits.

MSNM-S is conceived to be extremely scalable and aseptic because just two parameters are sent among levels or devices in the monitored network or system. Additionally, the MSNMSensor is able to manage multiple and heterogeneous type data sources at each monitored devices thanks to the FCParser (Feature as a Counter Parser) feature engineering approach.

Installation

Requirements

MSNSensor runs with python 2.7 and has been successfully tested on Ubuntu from 16.04 version and above. Also, the following dependencies has to be installed.

How to install

Creating a python execution environment is, probably the better way to run the application. So I recommend you to create one before doing the requirements installation. Anaconda environment can help you and, if you decide to use it, run the following commands:

$ conda create -n py27 python=2.7
$ conda activate py27

Running the previous command will install everything needed.

(py27) $ pip install -r requirements.txt

How to run an example

Please see instructions at examples or download the pre-configured VM at MSNM-S-UBUNTU. We recommend you to use the VM. Remember to pull the repository to get the MSNM-S project updated. In the following, you can see the necessary steps to run the pre-configure experiment in the VM:

Running the MSNM-Ss (backend)

Open a terminal window and activate netflow daemon and collector.

$ cd ~/msnm-sensor/scripts/netflow/
$ sudo ./activateNetflow.sh (pass: msnm1234)

Wait for 5 minutes to get netflow records. Run and deploy the MSNM-Ss in example/scenario_4 example:

$ cd ~/msnm-sensor/scripts/ $ conda activate py27
$ ./start_experiment.sh ../examples/scenario_4/
$ ps -ef | grep msnmsensor (just to check if all the four MSNM-Ss are running)
$ tail -500f ~/msnm-sensor/examples/scenario_4/borderRouter/logs/msnm.log (another way to see how the MSNM-S is working. Replace the name of the MSNM-S if you want to see the others.)

Running the dashboard (frontend):

Open a new terminal window.

$ cd ~/msnm-sensor/dashboard/
$ conda activate msnm-dashboard
$ ln -s ../examples examples
$ python manage.py runserver

Browse to http://localhost:8000

R K

Recent Posts

Kali Linux 2024.4 Released, What’s New?

Kali Linux 2024.4, the final release of 2024, brings a wide range of updates and…

2 days ago

Lifetime-Amsi-EtwPatch : Disabling PowerShell’s AMSI And ETW Protections

This Go program applies a lifetime patch to PowerShell to disable ETW (Event Tracing for…

2 days ago

GPOHunter – Active Directory Group Policy Security Analyzer

GPOHunter is a comprehensive tool designed to analyze and identify security misconfigurations in Active Directory…

4 days ago

2024 MITRE ATT&CK Evaluation Results – Cynet Became a Leader With 100% Detection & Protection

Across small-to-medium enterprises (SMEs) and managed service providers (MSPs), the top priority for cybersecurity leaders…

6 days ago

SecHub : Streamlining Security Across Software Development Lifecycles

The free and open-source security platform SecHub, provides a central API to test software with…

1 week ago

Hawker : The Comprehensive OSINT Toolkit For Cybersecurity Professionals

Don't worry if there are any bugs in the tool, we will try to fix…

1 week ago