Sign inSign up

mojiz/passban-ids

By mojiz

•Updated over 8 years ago

An anomaly based IDS for IoT Gateways

Image
0

293

mojiz/passban-ids repository overview

⁠Passban IDS

This IDS is part of Agile IoT⁠ project and it is still in its initial steps, it needs a lot of love. It uses netmate third party tool to capture network flows and builds a training model utilizing IsolationForest algorithm. Then it starts to detect the anomalous traffic. It has a web-interface which can be integrated into IoT projects. Please feel free to contact me if you have suggestions to improve the work or you are interested in contributing to the work.

⁠Requirements

  • Raspberry pi running Linux (tested on raspbian light)
  • Docker container

⁠Installation

  • Pull the repository
docker pull mojiz/passban-ids

sudo nano /etc/dphys-swapfile

Find CONF_SWAPSIZE and change the value like this

CONF_SWAPSIZE=2048

Save and exit (Ctrl+O and Ctrl+X). at the moment raspbian supports 2GB SWAP

sudo /etc/init.d/dphys-swapfile stop
sudo /etc/init.d/dphys-swapfile start
  • Mount a directory on the host machine to this directory in the container /data/ (see the docker configuration down below)
  • The command to start the container is: " bash /usr/src/passban-ids/app/start.sh " (see the docker configuration down below) When the container starts, it will copy the codes and its config file to the mounted directory on the host to make it easier to config and modify the code.
  • Default web interface address: http://raspberry-pi-address:5200⁠

⁠Standalone Running

docker run -v /home/pi/passban/:/data -it -p 5200:5200 --privileged --network host mojiz/passban-ids bash /usr/src/passban-ids/app/start.sh

⁠Docker configuration for AgileGW

First open this file:

sudo nano ~/agile-stack/docker-compose.yml

Then copy the following code at the end. Pay extra attention to the number of spaces for the indents.

  agile-passban-ids:
    command: [ "bash", "/usr/src/passban-ids/app/start.sh" ]
    container_name: agile-passban-ids
    image: mojiz/passban-ids:latest
    volumes:
      - $DATA/passban-ids/:/data/
    restart: always
    privileged: true
    environment:
      - AGILE_HOST=$AGILE_HOST
    ports:
      - 5200:5200/tcp
    network_mode: "host"

Then open this file

sudo nano ~/agile-stack/docker-compose.override.yml.buildall

and copy this at the end of the file:

  agile-passban-ids:
    build:
      context: ../modules/agile-passban-ids

In order to have a link to the Passban IDS in the Agile panel, use the following node-red code:

[{"id":"b036120.6a9e5f","type":"tab","label":"TTP Services"},{"id":"3b3e2a69.7f2796","type":"ui_base","theme":{"name":"theme-light","lightTheme":{"default":"#0094CE","baseColor":"#0094CE","baseFont":"Helvetica Neue","edited":true,"reset":false},"darkTheme":{"default":"#097479","baseColor":"#097479","baseFont":"Helvetica Neue","edited":false},"customTheme":{"name":"Untitled Theme 1","default":"#4B7930","baseColor":"#4B7930","baseFont":"Helvetica Neue"},"themeState":{"base-color":{"default":"#0094CE","value":"#0094CE","edited":false},"page-titlebar-backgroundColor":{"value":"#0094CE","edited":false},"page-backgroundColor":{"value":"#fafafa","edited":false},"page-sidebar-backgroundColor":{"value":"#ffffff","edited":false},"group-textColor":{"value":"#1bbfff","edited":false},"group-borderColor":{"value":"#ffffff","edited":false},"group-backgroundColor":{"value":"#ffffff","edited":false},"widget-textColor":{"value":"#111111","edited":false},"widget-backgroundColor":{"value":"#0094ce","edited":false},"widget-borderColor":{"value":"#ffffff","edited":false}}},"site":{"name":"Node-RED Dashboard","hideToolbar":"false","allowSwipe":"false","dateFormat":"DD/MM/YYYY","sizes":{"sx":48,"sy":48,"gx":6,"gy":6,"cx":6,"cy":6,"px":0,"py":0}}},{"id":"98f5429d.862d5","type":"ui_link","z":"","name":"Passban IDS","link":"http://agilegw.local:5200/","icon":"open_in_browser","target":"iframe","order":1},{"id":"87894c19.85478","type":"ui_link","z":"","name":"IP Camera","link":"http://agilegw.local:5000/","icon":"open_in_browser","target":"iframe","order":2},{"id":"b13ce49a.cbf938","type":"ui_group","z":"","name":"tpServices","tab":"","disp":true,"width":"6"},{"id":"614fd69b.ff4788","type":"ui_button","z":"b036120.6a9e5f","name":"","group":"b13ce49a.cbf938","order":0,"width":0,"height":0,"passthru":false,"label":"Ciao","color":"","bgcolor":"","icon":"","payload":"","payloadType":"str","topic":"","x":191.34927368164062,"y":77.49919128417969,"wires":[[]]}]

Have fun, Moji

Tag summary

Content type

Image

Digest

Size

169.8 MB

Last updated

over 8 years ago

docker pull mojiz/passban-ids