Good morning everybody.
I am a junior IT security developer working on my master thesis, currently working on a Encrypted Traffic Analysis tool to be deployed on an existing Suricata-based system.
Currently, I am trying to extract the most statistical information I can from Suricata with Lua Output and I’m particulary interested in this function SCFlowStats. From what it does it is clear to me that there is a somewhere where bytes moved in a flow are summed and stored, but even if I tried I can’t find where in the source code does this happen. I want to get in there to add more statistical indexes that, as far as I can tell, should be easy to compute in the same “space” bytes are summed.
Can someone point me to where in the sourcecode is the output for SCFlowStats calculated? Or really point me anywhere I could put my hands on for this kind of job?
Thank you in advance.
These stats are updated here https://github.com/OISF/suricata/blob/master/src/flow.c#L440
What kind of extra logic are you interested in adding?
Thank you!
I want to be able to reconstruct the bytes flow distribution with more resolution than simply “total bytes to server” and “total bytes to client”. Best case would be being able to get a stochastic matrix representing the sequence of packets length during the flow. But for starters I will probably try to just add the length’s standard deviation.