You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Fides module. Global P2P Threat Ingelligence Sharing
2
2
3
-
The Fides module is an essential component of the Global P2P system in Slips.
3
+
Slips implements an internet global P2P system for Threat Intelligence sharing and alerting.
4
4
5
+
The Fides module implements the Global P2P system in Slips.
5
6
6
7
Traditional network defense systems depend on centralized threat intelligence, which has limitations like single points of failure, inflexibility, and reliance on trust in centralized authorities. Peer-to-peer networks offer an alternative for sharing threat intelligence but face challenges in verifying the trustworthiness of participants, including potential malicious actors.
7
8
8
-
The Fides Module, based on [Master Theses](https://github.com/stratosphereips/fides/tree/bfac47728172d3a4bbb27a5bb53ceef424e45e4f) on CTU FEL by Lukáš Forst. The goal of this module is to address the challenge of trustworthiness of peers in peer-to-peer networks by providing several trust evaluation models. It evaluates peer behavior, considers membership in trusted organizations, and assesses incoming threat data to determine reliability. Fides aggregates and weights data to enhance intrusion prevention systems, even in adversarial scenarios. Experiments show that Fides can maintain accurate threat intelligence even when 75% of the network is controlled by malicious actors, assuming the remaining 25% are trusted.
9
+
The Fides Module is based on the [Master Thesis](https://dspace.cvut.cz/handle/10467/101312) of Lukáš Forst and implemented in Slips in the Master Thesis of David Otta. The goal of the Fides module is to address the challenge of trust of peers in P2P networks by providing several trust evaluation models. It evaluates peer behavior, considers membership in trusted organizations, and assesses incoming threat data to determine reliability. Fides aggregates and weights data to enhance intrusion prevention systems, even in adversarial scenarios. Experiments show that Fides can maintain accurate threat intelligence even when 75% of the network is controlled by malicious actors, assuming the remaining 25% are trusted.
9
10
10
11
The whole architecture is thoroughly documented in the thesis itself, which can be downloaded from the link above.
11
12
12
13
## Docker direct use
13
-
You can use Slips with Fides Module by allowing it in the Slips config file or by using the following commands.
14
+
You can use Slips with the Fides Module by allowing it in the Slips config file or by using the following commands.
14
15
15
16
```
16
17
docker pull stratosphereips/slips
17
-
docker run -it --rm --net=host --cap-add=NET_ADMIN stratosphereips/slips
18
+
docker run -it --rm --net=host --use_fides=True --cap-add=NET_ADMIN stratosphereips/slips
18
19
```
19
20
20
-
To be able to use the fides module you should use ```--cap-add=NET_ADMIN```
21
+
To be able to use the fides module, you should use ```--cap-add=NET_ADMIN```
21
22
22
-
## Installation:
23
+
## Conditions
23
24
24
-
```
25
-
docker pull stratosphereips/slips
26
-
docker run -it --rm --net=host --use_fides=True stratosphereips/slips
27
-
```
25
+
If you plan on using the Fides Module, please be aware that it is used only if Slips is running on an interface OR on a growing Zeek directory. The `--use_fides=True` is ignored when Slips is run on a file.
28
26
29
-
***NOTE***
30
-
31
-
If you plan on using the Fides Module, lease be aware that it is used only
32
-
if Slips is running on an interface. The `--use_fides=True` is ignored when Slips is run on a file.
33
-
34
-
### Configuration
35
-
Evaluation model, evaluation thrash-holds and other configuration is located in fides.conf.yml
27
+
## Configuration
28
+
The evaluation model used, the evaluation thresholds, and other configurations are located in ```fides.conf.yml``` file
@@ -48,51 +41,33 @@ Fides is inactive by default in Slips.
48
41
49
42
To enable it, change ```use_fides=False``` to ```use_fides=True``` in ```config/slips.yaml```.
50
43
51
-
And start slips on your interface.
52
-
53
-
## Project sections
54
-
55
-
The project is built into Slips as a module and uses Redis for communication. Integration with Slips
56
-
is seamless, and it should be easy to adjust the module for use with other IPSs.
57
-
58
-
- Slips, the Intrusion Prevention System
59
-
- Fides Module the trust evaluation module for global p2p interaction
60
-
44
+
And start Slips on your interface.
61
45
62
46
## How it works:
63
47
64
48
Slips interacts with other slips peers for the following purposes:
65
49
66
-
### Sharing opinion on peers
50
+
### Sharing an opinion with peers
67
51
68
-
If a peers A is asked for its opinion on peer B by peer C, peer A sends the aggregated opinion on peer B to peer C, if there is any.
52
+
If peer A is asked for its opinion on peer B by peer C, peer A sends its opinion on peer B to peer C, if there is any.
69
53
70
54
### Asking for an opinion
71
55
72
-
Newly connected peer will create a base trust by asking ather peers for opinion.
56
+
Peers can ask other peers what they think about an IP address or domain.
73
57
74
58
### Dispatching alerts
75
59
76
-
If a threat so great it may impact whole network, one or more groups, threat alert is
77
-
dispatched to peers, without regard to trust level accumulated on them.
78
-
79
-
### Answering and receiving requests form global P2P module.
60
+
If a peer generates an alert based on evidence of an attack, it can alert other peers by sending an **Alert message** in the P2P network.
80
61
81
62
## Logs
82
63
83
-
Slips contains a minimal log file for reports received by other peers and peer updates in
84
-
```output``` directory if not manually specified using the appropriate slips parameter upon start.
85
-
Custom logger ```modules/fidesModule/utils/logger.py``` is used by Fide Module for internal logging. Either Slips' logging is used, or the custom logger is defaulted to logging via Python's printing function.
86
-
87
-
## Limitations
88
-
89
-
For now, slips supports the trust intelligence evaluation, global p2p is to be implemented.
64
+
Slips contains a minimal log file for reports received by other peers and peer updates in the ```output``` directory if not manually specified using the appropriate slips parameter upon start.
65
+
The custom logger ```modules/fidesModule/utils/logger.py``` code is used by the Fides Module for internal logging.
90
66
91
67
## Implementation notes and credit
92
-
The mathematical models for trust evaluation were written by Lukáš Forst as part of his theses and can be accessed [here](https://github.com/LukasForst/fides/commits?author=LukasForst).
68
+
The mathematical models for the trust evaluation were written by Lukáš Forst as part of his [Master Thesis](https://dspace.cvut.cz/handle/10467/101312).
93
69
94
70
95
-
## TLDR;
71
+
## Privacy
96
72
97
-
Slips (meaning Fides Module here) only shares trust level and confidence (numbers) generated by slips about IPs to the network,
98
-
no private information is shared.
73
+
Slips only shares the trust level and confidence values generated by Slips about IPs to the network, no more information.
0 commit comments