Explore the docs »

View Source · Report Bug · Request Feature

• About the Project
• Prerequisites
• Installation
• Getting Started
• Running Tests
• Run Dockerfile
• License
• Contact

Kassandra analyzes user activity and detects anomalous behaviour in HTTP requests that could be identified as non-malicious by other systems. Kassandra allows designing of anomaly detection policies. Kassandra is part of the project Egida and Kassandra, Egida can be checked here.

apt install -y python3 pip3 virtualenv

virtualenv -p /usr/bin/python3 venv
source venv/bin/activate

Run install.bat

To start running Kassandra run the following on the root folder of the project.

python kassandra.py

This will run an UDP server in localhost:5000, configure your proxy to point to that address.

To test Kassandra with you own files you should change here the path to those files. You will need:

1. Train file. Log file with a huge number (40000 is OK) of HTTP requests of a server.
2. Test file. Log file with some HTTP requests for testing.

You can also customize the anomaly values obtained by editing config.yml

• Danger values are reserved to change the weigh for each characteristc
• Extended Isolation Forests are reserved for adjust the Machine Learning model to the training data

To run Kassandra with your own requests and test the model, run the following command and introduce the HTTP request corresponding log.

python kassandra-app.py

docker image build -t kassandra .

docker run -p kassandra

Distributed under the Apache 2.0 License. See LICENSE for more information.

Authors:

• Alba Cotarelo Tuñón
• Antonio Payá González
• Jose Manuel Redondo Lopez

Project Link: https://github.com/Egida-Kassandra/kassandra