cschantz
26c69175cd
Add full reputation tracking and auto-blocking for SYN flood attacks
CRITICAL FIX for active SYN flood attacks
PROBLEM:
- SYN_RECV connection monitoring only logged events
- NO reputation scoring for active SYN flood attackers
- NO auto-blocking even with 100+ simultaneous connections
- User report: "server with active attack cant auto block ips"
ROOT CAUSE:
SYN_RECV monitoring (lines 2225-2247) only logged to recent_events
without updating IP_DATA or reputation database. This meant:
- IPs with massive connection counts got no reputation score
- Auto-mitigation engine never saw these IPs
- Manual blocking was the only option
SOLUTION IMPLEMENTED:
1. Full IP Reputation Tracking (lines 2243-2317)
- Reads/updates IP reputation file (ip_X_X_X_X)
- Increments hit counter for each detection
- Adds "SYN_FLOOD" to attack list
2. Progressive Scoring by Connection Count
- 20-50 connections: +15 points
- 50-100 connections: +25 points
- 100+ connections: +40 points per hit
- Can quickly reach score 100 for instant blocking
3. Advanced Intelligence Integration
- Attack velocity tracking (rapid successive hits)
- Attack diversity bonuses (multiple attack vectors)
- Subnet attack detection (coordinated DDoS)
- Timing pattern analysis (botnet identification)
4. Reputation Database Logging (line 2325)
- Logs to IP reputation DB: flag_ip_attack()
- Persistent tracking across sessions
- Historical attack data preserved
5. Auto-Mitigation Integration (line 2317)
- Writes IP data to file for auto_mitigation_engine()
- Stores block reasons for detailed logging
- Enables automatic blocking when score >= 80
- INSTANT blocking when score = 100
ATTACK PROGRESSION EXAMPLE:
- Detection 1 (50 conns): Score 25
- Detection 2 (75 conns): Score 25 + 25 + bonuses = ~60
- Detection 3 (100 conns): Score 60 + 40 + bonuses = 100
- RESULT: INSTANT_BLOCK triggered automatically
This restores full auto-blocking for network-layer attacks.
2025-12-24 19:24:35 -05:00
..
2025-12-17 01:34:24 -05:00
2025-12-03 20:49:46 -05:00
2025-12-17 19:25:58 -05:00
2025-12-17 01:35:48 -05:00
2025-12-24 19:24:35 -05:00
2025-12-04 16:17:59 -05:00