Fixing a 'Too many files open' error in fsom
This commit is contained in:
BlackLight
parent
fec0bbea96
commit
4962097aa9
|
|
@ -68,6 +68,7 @@ fi
|
|||
install -m 0644 "${PWD}/htdocs/manual_uncorrelations.xml" "${SHARE_PREFIX}/htdocs"
|
||||
install -m 0755 "${PWD}/htdocs/pcap.cgi" "${SHARE_PREFIX}/htdocs"
|
||||
install -m 0755 "${PWD}/htdocs/correlate.cgi" "${SHARE_PREFIX}/htdocs"
|
||||
install -m 0755 "${PWD}/htdocs/default.xsl" "${SHARE_PREFIX}/htdocs"
|
||||
install -m 0644 "${PWD}/htdocs/js/Curry-1.0.1.js" "${SHARE_PREFIX}/htdocs/js"
|
||||
install -m 0644 "${PWD}/htdocs/js/dracula_algorithms.js" "${SHARE_PREFIX}/htdocs/js"
|
||||
install -m 0644 "${PWD}/htdocs/js/dracula_graffle.js" "${SHARE_PREFIX}/htdocs/js"
|
||||
|
|
|
|||
|
|
@ -862,6 +862,7 @@ fi
|
|||
install -m 0644 "${PWD}/htdocs/manual_uncorrelations.xml" "${SHARE_PREFIX}/htdocs"
|
||||
install -m 0755 "${PWD}/htdocs/pcap.cgi" "${SHARE_PREFIX}/htdocs"
|
||||
install -m 0755 "${PWD}/htdocs/correlate.cgi" "${SHARE_PREFIX}/htdocs"
|
||||
install -m 0755 "${PWD}/htdocs/default.xsl" "${SHARE_PREFIX}/htdocs"
|
||||
install -m 0644 "${PWD}/htdocs/js/Curry-1.0.1.js" "${SHARE_PREFIX}/htdocs/js"
|
||||
install -m 0644 "${PWD}/htdocs/js/dracula_algorithms.js" "${SHARE_PREFIX}/htdocs/js"
|
||||
install -m 0644 "${PWD}/htdocs/js/dracula_graffle.js" "${SHARE_PREFIX}/htdocs/js"
|
||||
|
|
|
|||
8
README
8
README
|
|
@ -188,6 +188,7 @@ preprocessor ai: \
|
|||
database_parsing_interval 30 \
|
||||
hashtable_cleanup_interval 300 \
|
||||
manual_correlations_parsing_interval 120 \
|
||||
neural_clustering_interval 1200 \
|
||||
neural_network_training_interval 43200 \
|
||||
neural_train_steps 10 \
|
||||
output_database ( type="dbtype", name="snort", user="snortusr", password="snortpass", host="dbhost" ) \
|
||||
|
|
@ -330,6 +331,13 @@ of the thread for parsing the alert correlations manually set and the next one
|
|||
(default value if not specified: 120 seconds)
|
||||
|
||||
|
||||
- neural_clustering_interval: Interval in seconds between an execution of the
|
||||
thread for clustering (using k-means) the alerts on the output layer of the
|
||||
neural network in order to recognize likely attack scenarios, and the next one.
|
||||
Set this to 0 if you want no clusterization (default if not specified: 1200
|
||||
seconds)
|
||||
|
||||
|
||||
- neural_network_training_interval: Interval in seconds between an execution of
|
||||
the thread for training the neural network using the set of recent alerts and
|
||||
the next one (default if not specified: 43200 seconds)
|
||||
|
|
|
|||
|
|
@ -77,6 +77,8 @@ AI_deserialize_alerts ()
|
|||
*event_list = NULL;
|
||||
AI_alert_event_key key;
|
||||
|
||||
return NULL;
|
||||
|
||||
if ( stat ( config->alert_history_file, &st ) < 0 )
|
||||
return NULL;
|
||||
|
||||
|
|
@ -159,6 +161,8 @@ AI_serialize_alerts ( AI_snort_alert **alerts_pool, unsigned int alerts_pool_cou
|
|||
*event_next = NULL,
|
||||
*event_iterator = NULL;
|
||||
|
||||
return;
|
||||
|
||||
if ( !alerts_hash )
|
||||
{
|
||||
AI_deserialize_alerts();
|
||||
|
|
|
|||
|
|
@ -1205,8 +1205,12 @@ AI_alert_correlation_thread ( void *arg )
|
|||
{
|
||||
int i;
|
||||
struct stat st;
|
||||
char corr_dot_file[4096] = { 0 },
|
||||
corr_ps_file [4096] = { 0 };
|
||||
|
||||
char corr_dot_file[4096] = { 0 };
|
||||
|
||||
#ifdef HAVE_LIBGVC
|
||||
char corr_ps_file [4096] = { 0 };
|
||||
#endif
|
||||
|
||||
double avg_correlation = 0.0,
|
||||
std_deviation = 0.0,
|
||||
|
|
|
|||
|
|
@ -909,6 +909,7 @@ som_deserialize ( const char* fname )
|
|||
|
||||
if ( !( net = ( som_network_t* ) malloc ( sizeof ( som_network_t ))))
|
||||
{
|
||||
fclose ( fp );
|
||||
return NULL;
|
||||
}
|
||||
|
||||
|
|
@ -923,6 +924,7 @@ som_deserialize ( const char* fname )
|
|||
if ( !( net->input_layer = som_input_layer_new ( input_neurons )))
|
||||
{
|
||||
free ( net );
|
||||
fclose ( fp );
|
||||
return NULL;
|
||||
}
|
||||
|
||||
|
|
@ -930,6 +932,7 @@ som_deserialize ( const char* fname )
|
|||
{
|
||||
free ( net->input_layer );
|
||||
free ( net );
|
||||
fclose ( fp );
|
||||
return NULL;
|
||||
}
|
||||
|
||||
|
|
@ -945,12 +948,14 @@ som_deserialize ( const char* fname )
|
|||
{
|
||||
som_input_layer_destroy ( net );
|
||||
som_output_layer_destroy ( net );
|
||||
fclose ( fp );
|
||||
return NULL;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fclose ( fp );
|
||||
return net;
|
||||
} /* ----- end of function som_deserialize ----- */
|
||||
|
||||
|
|
|
|||
|
|
@ -31,7 +31,10 @@
|
|||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <sys/stat.h>
|
||||
#include <unistd.h>
|
||||
#include <time.h>
|
||||
|
||||
/**
|
||||
* \brief Print the clusters associated to the SOM output to an XML log file
|
||||
|
|
@ -49,7 +52,8 @@ __AI_neural_clusters_to_xml ( kmeans_t *km, AI_alerts_per_neuron *alerts_per_neu
|
|||
dst_addr = 0;
|
||||
|
||||
char src_ip[INET_ADDRSTRLEN] = { 0 },
|
||||
dst_ip[INET_ADDRSTRLEN] = { 0 };
|
||||
dst_ip[INET_ADDRSTRLEN] = { 0 },
|
||||
*timestamp = NULL;
|
||||
|
||||
AI_alerts_per_neuron_key key;
|
||||
AI_alerts_per_neuron *alert_iterator = NULL;
|
||||
|
|
@ -59,7 +63,8 @@ __AI_neural_clusters_to_xml ( kmeans_t *km, AI_alerts_per_neuron *alerts_per_neu
|
|||
AI_fatal_err ( "Unable to write on the neural clusters XML log file", __FILE__, __LINE__ );
|
||||
}
|
||||
|
||||
fprintf ( fp, "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n"
|
||||
fprintf ( fp, "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n"
|
||||
"<?xml-stylesheet href=\"default.xsl\" type=\"text/xsl\"?>\n\n"
|
||||
"<clusters>\n" );
|
||||
|
||||
for ( i=0; i < km->k; i++ )
|
||||
|
|
@ -104,15 +109,18 @@ __AI_neural_clusters_to_xml ( kmeans_t *km, AI_alerts_per_neuron *alerts_per_neu
|
|||
inet_ntop ( AF_INET, &src_addr, src_ip, INET_ADDRSTRLEN );
|
||||
inet_ntop ( AF_INET, &dst_addr, dst_ip, INET_ADDRSTRLEN );
|
||||
|
||||
timestamp = ctime ( &( alert_iterator->alerts[k].timestamp ));
|
||||
timestamp[ strlen ( timestamp ) - 1 ] = 0;
|
||||
|
||||
fprintf ( fp, "\t\t<alert desc=\"%s\" gid=\"%d\" sid=\"%d\" rev=\"%d\" src_ip=\"%s\" src_port=\"%d\" "
|
||||
"dst_ip=\"%s\" dst_port=\"%d\" timestamp=\"%lu\" xcoord=\"%d\" ycoord=\"%d\"/>\n",
|
||||
"dst_ip=\"%s\" dst_port=\"%d\" timestamp=\"%s\" xcoord=\"%d\" ycoord=\"%d\"/>\n",
|
||||
alert_iterator->alerts[k].desc,
|
||||
alert_iterator->alerts[k].gid,
|
||||
alert_iterator->alerts[k].sid,
|
||||
alert_iterator->alerts[k].rev,
|
||||
src_ip, alert_iterator->alerts[k].src_port,
|
||||
dst_ip, alert_iterator->alerts[k].dst_port,
|
||||
alert_iterator->alerts[k].timestamp,
|
||||
timestamp,
|
||||
alert_iterator->key.x, alert_iterator->key.y );
|
||||
}
|
||||
}
|
||||
|
|
@ -124,6 +132,8 @@ __AI_neural_clusters_to_xml ( kmeans_t *km, AI_alerts_per_neuron *alerts_per_neu
|
|||
|
||||
fprintf ( fp, "</clusters>\n" );
|
||||
fclose ( fp );
|
||||
|
||||
chmod ( config->neural_clusters_log, 0644 );
|
||||
} /* ----- end of function __AI_neural_clusters_to_xml ----- */
|
||||
|
||||
/**
|
||||
|
|
|
|||
Loading…
Reference in New Issue