suricata_check_design_principles.checkers.principle.ml

PrincipleMLChecker.

Attributes

COUNT_COLUMNS
DROPDOWN_COLUMNS
GRIDSEARCHCV
IP_COLUMNS
IP_KEYWORDS
MSG_COLUMNS
MSG_KEYWORDS
NUMERICAL_COLUMNS
N_JOBS
PARAM_GRID
PIPELINE
PRECISION_WEIGHT
SCORER
SPLITTABLE_FEATURES
SPLITTER
STRING_COLUMNS

Classes

PrincipleMLChecker

The PrincipleChecker contains several checks based on the Ruling the Unruly paper and target specificity and coverage.

Module Contents

class suricata_check_design_principles.checkers.principle.ml.PrincipleMLChecker(include: collections.abc.Iterable[str] | None = None)

Bases: suricata_check.checkers.interface.CheckerInterface

The PrincipleChecker contains several checks based on the Ruling the Unruly paper and target specificity and coverage.

Codes Q000-Q009 report on non-adherence to rule design principles similar to Q000-Q009. Differently, they are the result of machine learning analysis of the rules.

Initializes the checker given a list of issue codes to emit.

__getnewargs__() → tuple

Returns the arguments to be passed to the __new__ method when unpickling.

train(df: pandas.DataFrame, rule_col: str = 'rule.rule', principle_cols: dict[str, str] = {'Q000': 'labelled.no_proxy', 'Q001': 'labelled.success', 'Q002': 'labelled.thresholded', 'Q003': 'labelled.exceptions', 'Q004': 'labelled.generalized_match_content', 'Q005': 'labelled.generalized_match_location'}, reuse_models: bool = False) → None

Train several models for the checker to detect issues in rules.

The checker class with trained models is stored in a pickle file (_PICKLE_PATH).

codes

A Mapping of issue codes emitted by the checker to metadata for those issue types. The metadata is structured in the form of a Mapping from attribute name to attribute value. The one mandatory metadata attribute is severity, which must be one of the levels provided by the logging module

count_columns = ('flowbits.isset.count', 'flowbits.isntoset.count', 'flowint.isset.count',...

dropdown_columns = ('proto', 'threshold.type')

enabled_by_default = False

A boolean indicating if the checker is enabled by default when discovered automatically.

ip_columns

ip_keywords = ('$HOME_NET', '$HTTP_SERVERS', '$EXTERNAL_NET', 'any')

msg_columns

msg_keywords = ('Suspicious', 'CVE', 'Vulnerability', 'Response')

numerical_columns = ('threshold.count',)

splittable_features = ('metadata', 'flow', 'threshold')

string_columns = ()

suricata_check_design_principles.checkers.principle.ml.COUNT_COLUMNS = ('flowbits.isset.count', 'flowbits.isntoset.count', 'flowint.isset.count',...

suricata_check_design_principles.checkers.principle.ml.DROPDOWN_COLUMNS = ('proto', 'threshold.type')

suricata_check_design_principles.checkers.principle.ml.GRIDSEARCHCV

suricata_check_design_principles.checkers.principle.ml.IP_COLUMNS

suricata_check_design_principles.checkers.principle.ml.IP_KEYWORDS = ('$HOME_NET', '$HTTP_SERVERS', '$EXTERNAL_NET', 'any')

suricata_check_design_principles.checkers.principle.ml.MSG_COLUMNS

suricata_check_design_principles.checkers.principle.ml.MSG_KEYWORDS = ('Suspicious', 'CVE', 'Vulnerability', 'Response')

suricata_check_design_principles.checkers.principle.ml.NUMERICAL_COLUMNS = ('threshold.count',)

suricata_check_design_principles.checkers.principle.ml.N_JOBS = 8

suricata_check_design_principles.checkers.principle.ml.PARAM_GRID: list[dict]

suricata_check_design_principles.checkers.principle.ml.PIPELINE

suricata_check_design_principles.checkers.principle.ml.PRECISION_WEIGHT = 10

suricata_check_design_principles.checkers.principle.ml.SCORER

suricata_check_design_principles.checkers.principle.ml.SPLITTABLE_FEATURES = ('metadata', 'flow', 'threshold')

suricata_check_design_principles.checkers.principle.ml.SPLITTER

suricata_check_design_principles.checkers.principle.ml.STRING_COLUMNS = ()