Detecting Network Scanning With Ids Signatures

# === TCP Scan Detection ===

# Detect TCP SYN scan (high volume SYN without completion)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN TCP SYN Scan Detected"; flags:S,12; threshold:type both,track by_src,count 30,seconds 10; classtype:attempted-recon; sid:5000001; rev:2;)

# Detect TCP FIN scan
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN TCP FIN Scan"; flags:F,12; threshold:type both,track by_src,count 20,seconds 60; classtype:attempted-recon; sid:5000002; rev:1;)

# Detect TCP Xmas scan (FIN+PSH+URG)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN TCP Xmas Tree Scan"; flags:FPU,12; classtype:attempted-recon; sid:5000003; rev:1;)

# Detect TCP NULL scan (no flags)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN TCP NULL Scan"; flags:0,12; classtype:attempted-recon; sid:5000004; rev:1;)

# Detect ACK scan (firewall probing)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN TCP ACK Scan"; flags:A,12; flow:stateless; threshold:type both,track by_src,count 50,seconds 30; classtype:attempted-recon; sid:5000005; rev:1;)

# Detect SYN+ACK scan (unusual stateless probe)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN TCP SYN-ACK Scan"; flags:SA,12; flow:stateless; threshold:type both,track by_src,count 30,seconds 30; classtype:attempted-recon; sid:5000006; rev:1;)

# === UDP Scan Detection ===

# Detect UDP port scan
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN UDP Port Scan"; threshold:type both,track by_src,count 30,seconds 10; classtype:attempted-recon; sid:5000010; rev:1;)

# === Nmap Specific Detection ===

# Detect Nmap OS fingerprinting (T1 probe - ECN SYN)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN Nmap OS Fingerprint Probe"; flags:SEC,12; window:1; classtype:attempted-recon; sid:5000020; rev:1;)

# Detect Nmap window scan (specific window size patterns)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN Nmap Window Size Probe"; flags:A,12; flow:stateless; window:1024; threshold:type both,track by_src,count 10,seconds 30; classtype:attempted-recon; sid:5000021; rev:1;)

# Detect Nmap version detection probes
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN Nmap Service Version Probe"; flow:established; content:"HELP"; depth:4; threshold:type both,track by_src,count 5,seconds 60; classtype:attempted-recon; sid:5000022; rev:1;)

# Detect Nmap scripting engine (NSE)
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN Nmap NSE HTTP Script"; http.user_agent; content:"Nmap Scripting Engine"; classtype:attempted-recon; sid:5000023; rev:1;)

# === Masscan Detection ===

# Detect Masscan SYN scan (specific window size)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN Masscan SYN Scan Detected"; flags:S,12; window:1024; threshold:type both,track by_src,count 100,seconds 10; classtype:attempted-recon; sid:5000030; rev:1;)

# === Internal Scan Detection ===

# Detect internal host scanning (lateral movement recon)
alert tcp $HOME_NET any -> $HOME_NET any (msg:"SCAN Internal Network Scan Detected"; flags:S,12; threshold:type both,track by_src,count 50,seconds 30; classtype:attempted-recon; sid:5000040; rev:1;)

# Detect internal ICMP sweep
alert icmp $HOME_NET any -> $HOME_NET any (msg:"SCAN Internal ICMP Sweep"; itype:8; threshold:type both,track by_src,count 30,seconds 10; classtype:attempted-recon; sid:5000041; rev:1;)

# Suppress scan alerts from authorized vulnerability scanners
suppress gen_id 1, sig_id 5000001, track by_src, ip 10.0.5.100
suppress gen_id 1, sig_id 5000001, track by_src, ip 10.0.5.101

# Rate-limit scan alerts to prevent log flooding
rate_filter gen_id 1, sig_id 5000001, track by_src, count 5, seconds 300, new_action alert, timeout 600
rate_filter gen_id 1, sig_id 5000040, track by_src, count 3, seconds 300, new_action alert, timeout 600

# Event filter for critical internal scans
event_filter gen_id 1, sig_id 5000040, type both, track by_src, count 1, seconds 60

#!/usr/bin/env python3
"""Analyze IDS alerts for network scanning activity and generate reports."""

import json
import sys
from collections import defaultdict
from datetime import datetime


class ScanDetector:
    """Correlate IDS alerts to identify scanning campaigns."""

    def __init__(self):
        self.scan_events = defaultdict(lambda: {
            'source_ip': '',
            'target_ips': set(),
            'target_ports': set(),
            'scan_types': set(),
            'alert_count': 0,
            'first_seen': None,
            'last_seen': None,
            'signatures': defaultdict(int),
        })

    def process_eve_json(self, filepath: str):
        """Process Suricata EVE JSON alert log."""
        with open(filepath, 'r') as f:
            for line in f:
                try:
                    event = json.loads(line)
                    if event.get('event_type') != 'alert':
                        continue

                    alert = event.get('alert', {})
                    sig = alert.get('signature', '')

                    if 'SCAN' not in sig:
                        continue

                    src_ip = event.get('src_ip', '')
                    dst_ip = event.get('dest_ip', '')
                    dst_port = event.get('dest_port', 0)
                    ts = datetime.fromisoformat(
                        event['timestamp'].replace('Z', '+00:00')
                    )

                    scanner = self.scan_events[src_ip]
                    scanner['source_ip'] = src_ip
                    scanner['target_ips'].add(dst_ip)
                    scanner['target_ports'].add(dst_port)
                    scanner['alert_count'] += 1
                    scanner['signatures'][sig] += 1

                    if 'SYN' in sig:
                        scanner['scan_types'].add('SYN Scan')
                    elif 'FIN' in sig:
                        scanner['scan_types'].add('FIN Scan')
                    elif 'Xmas' in sig:
                        scanner['scan_types'].add('Xmas Scan')
                    elif 'NULL' in sig:
                        scanner['scan_types'].add('NULL Scan')
                    elif 'UDP' in sig:
                        scanner['scan_types'].add('UDP Scan')
                    elif 'Nmap' in sig:
                        scanner['scan_types'].add('Nmap Detected')
                    elif 'Masscan' in sig:
                        scanner['scan_types'].add('Masscan Detected')
                    elif 'Internal' in sig:
                        scanner['scan_types'].add('Internal Scan')

                    if scanner['first_seen'] is None or ts < scanner['first_seen']:
                        scanner['first_seen'] = ts
                    if scanner['last_seen'] is None or ts > scanner['last_seen']:
                        scanner['last_seen'] = ts

                except (json.JSONDecodeError, KeyError, ValueError):
                    continue

    def generate_report(self):
        """Generate scan detection report."""
        scanners = sorted(
            self.scan_events.values(),
            key=lambda x: x['alert_count'],
            reverse=True
        )

        print(f"\n{'='*70}")
        print("NETWORK SCAN DETECTION REPORT")
        print(f"{'='*70}")
        print(f"Unique Scanning Sources: {len(scanners)}\n")

        for scanner in scanners:
            targets = len(scanner['target_ips'])
            ports = len(scanner['target_ports'])
            duration = (scanner['last_seen'] - scanner['first_seen']).total_seconds() \
                if scanner['first_seen'] and scanner['last_seen'] else 0

            is_internal = scanner['source_ip'].startswith(('10.', '172.', '192.168.'))
            severity = "CRITICAL" if is_internal else \
                       "HIGH" if targets > 50 or ports > 100 else "MEDIUM"

            print(f"[{severity}] Scanner: {scanner['source_ip']}")
            print(f"  Type: {'INTERNAL' if is_internal else 'EXTERNAL'}")
            print(f"  Scan Types: {', '.join(scanner['scan_types'])}")
            print(f"  Target Hosts: {targets}, Target Ports: {ports}")
            print(f"  Total Alerts: {scanner['alert_count']}")
            print(f"  Duration: {duration:.0f}s")
            print(f"  First Seen: {scanner['first_seen']}")
            print(f"  Top Signatures:")
            for sig, count in sorted(
                scanner['signatures'].items(), key=lambda x: x[1], reverse=True
            )[:5]:
                print(f"    - {sig}: {count}")
            print()


if __name__ == '__main__':
    detector = ScanDetector()
    log_file = sys.argv[1] if len(sys.argv) > 1 else '/var/log/suricata/eve.json'
    detector.process_eve_json(log_file)
    detector.generate_report()