cschantz
2e176aa310
Add 5 advanced SYN flood intelligence metrics for better attacker detection
New SYN-Specific Intelligence Metrics:
1. PURE-SYN DETECTION (+20 points)
- IP has 5+ SYN_RECV but 0 ESTABLISHED connections
- Legitimate users always complete some handshakes
- Pure SYN = 100% attack traffic, no legitimate use
- Tag: PURE-SYN
2. SYN/ESTABLISHED RATIO ANALYSIS (+10-15 points)
- Normal: More ESTABLISHED than SYN_RECV
- Suspicious: 2:1 or 3:1 SYN_RECV:ESTABLISHED ratio
- 3:1 ratio: +15 points
- 2:1 ratio: +10 points
- Tag: BAD-RATIO
3. REPEATED SYN WITHOUT COMPLETION (+15 points)
- IP detected 2+ times with SYN floods
- BUT never has any ESTABLISHED connections
- Indicates bot that never completes handshakes
- Filters out transient network issues
4. SPOOFED SOURCE IP DETECTION (+20 points)
- High SYN count (10+)
- Detected 2+ times
- No other traffic (no HTTP, no scans, nothing)
- Likely IP spoofing attack
- Tag: SPOOFED
5. SINGLE-TARGET PORT FOCUS (+5-10 points)
- All SYN_RECV to same port (e.g., only :80)
- Indicates targeted attack vs port scan
- 1 port + 8+ conns: +10 points
- 2 ports + 15+ conns: +5 points
- Tag: TARGETED
Log Format Enhancement:
Old: Conns:14 | DDoS:T4
New: Conns:14 Est:0 | DDoS:T4 PURE-SYN SPOOFED TARGETED
Example Attack Signatures:
Pure Botnet:
[20:45:12] 1.2.3.4 | Score:105 [CRITICAL] | 💥SYN_FLOOD | Conns:12 Est:0 | DDoS:T4 ACCEL BOTNET PURE-SYN SPOOFED TARGETED
Sophisticated Multi-Vector:
[20:45:13] 5.6.7.8 | Score:120 [CRITICAL] | 💥SYN_FLOOD | Conns:15 Est:2 | DDoS:T4 BOTNET MULTI-VECTOR HTTP-ATTACKER BAD-RATIO HOSTILE-ASN
Scoring Impact (512 SYN Attack Example):
Base: 15
Tier 4: +50
Momentum: +15
Pure SYN: +20
Spoofed: +20
Targeted: +10
──────────────
TOTAL: 130 points → Instant block + score 100 cap
Benefits:
- Distinguishes bots from legitimate users
- Catches IP spoofing attacks
- Detects repeat offenders faster
- Provides clear attack attribution in logs
2025-12-24 20:44:48 -05:00
..
2025-12-17 01:34:24 -05:00
2025-12-03 20:49:46 -05:00
2025-12-17 19:25:58 -05:00
2025-12-17 01:35:48 -05:00
2025-12-24 20:44:48 -05:00
2025-12-04 16:17:59 -05:00