[Snort-devel] Machine Learning preprocessor for Snort
Carter Waxman (cwaxman)
cwaxman at cisco.com
Tue Aug 14 10:34:57 EDT 2018
Might I suggest trying to build this as an inspector in Snort 3? Plugin development is far simpler:
Define a Module subclass – This defines your configuration.
Define an Inspector subclass – This runs your packet processing code
Define the InspectApi – This provides the loading hooks and define what you want delivered to the Inspector and how
Build against your Snort 3 installation
Drop the .so in your dynamic plugin folder and run
Take a look at the README and some of the examples in the snort_extra tarball. src/inspectors/dpx would be a good start.
From: Snort-devel <snort-devel-bounces at lists.snort.org> on behalf of Hossein Torbat via Snort-devel <snort-devel at lists.snort.org>
Reply-To: Hossein Torbat <devtorbat at gmail.com>
Date: Tuesday, August 14, 2018 at 8:07 AM
To: "snort-devel at lists.snort.org" <snort-devel at lists.snort.org>
Subject: [Snort-devel] Machine Learning preprocessor for Snort
We are trying to integrate our Machine Learning traffic detection algorithm (written in python) to snort as a preprocessor component, but as we are new to snort, I want to know if there were any previous effort for adding a similar algorithm to snort, or are there any guide which can help us to develop this faster.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-devel