hoststats.conf

# HostStats configuration

# Input template
input-template = <COLLECTOR_FLOW>

# Detection rules (set to 1 to enable)
rules-generic = 1
rules-ssh = 1
rules-dns = 1

# Directory for detection log files
detection-log     = /data/hoststatsnemea/log/

# Verbosity level, see syslog.h(0p) for the list of priorities
log-upto-level    = LOG_INFO
#log-upto-level    = LOG_DEBUG

# Size of hash table (== maximum number of individual hosts)
# Value must be a power of two. If the value is not valid, module uses 
#   the smallest power of two that is greater or equal to a given value.
# The table size should be twice bigger than the expected maximum number of 
#   unique hosts on your network per timeout-active (5 minutes by default). 
# Warning: significantly affects the amount of required memory and performance 
#   of module.
table-size = 2097152

# The source of flow direction
# Flow direction determines whether the flow is part of the request or response 
# flow. WARNING: This setting changes input TEMPLATE of the module (see 
# "./hoststatsnemea -h" part "TRAP Interfaces").
# 0 - Get flow direction generated by another module (required flow direction 
#     module e.g. flowdirection)
# 1 - Create a custom flow direction based on the ports of flow (no extra module
#     is required, but the direction is not so precise)
port-flowdir      = 1

# A record is released, when it is in the table longer than this time. [seconds]
timeout-active    = 300

# A record is released, if it wasn't updated during this time. [seconds]
timeout-inactive  = 30

# A detector controlling above timeouts starts periodically after this time. [seconds]
det-start-time    = 10


#
# Detectors configuration
#

# general detector configuration
syn-scan-threshold = 200
syn-scan-syn-to-ack-ratio = 20
syn-scan-request-to-response-ratio = 5
syn-scan-ips = 200

# DOS detection type - can be 0 (default) or 1
# 0 - Detection based on flows (default) - Less false positive detections,
# but could not be able to detect DOS when attack is aggregated into
# single flow.
# 1 - Detection based on packets - Could detect more false positive detections
# than detection based on flows, but can detect DOS attack when it is aggregated
# into single flow.
dos-detection-type = 0

dos-victim-connections-synflood = 270000
dos-victim-connections-others = 1000000
dos-victim-packet-ratio = 2

# (Bytes / Packets) must be lower than this treshold to detect
dos-victim-bytes-packets-ratio = 100

# Victim must be able to respond at least this percent of requests (0.8 = 80%)
dos-victim-responsibility = 0.8

dos-attacker-connections-synflood = 270000
dos-attacker-connections-others = 1000000
dos-attacker-packet-ratio = 2

# (Bytes / Packets) must be lower than this treshold to detect
dos-attacker-bytes-packets-ratio = 100

dos-req-rsp-est-ratio = 0.8

# dos_rsp_req_est_ratio should be calculateed using the following formula:
# dos_rsp_req_est_ratio = 1.0 - dos_req_rsp_est_ratio
dos-rsp-req-est-ratio = 0.2

dos-min-rsp-ratio =  0.02


# ssh detector configuration
scan-threshold = 100
scan-flag-ratio = 5
scan-packet-ratio = 5
scan-ip-ratio = 0.5

bruteforce-out-threshold = 10
bruteforce-ips = 5
bruteforce-ips-ratio = 20
bruteforce-req-threshold = 60
bruteforce-req-min-packet-ratio = 5
bruteforce-req-max-packet-ratio = 20

# bruteforce-data-threshold should be calculated using the following formula:
# bruteforce-data-threshold = x * bruteforce-req-threshold
# where x is real number (0.5 by default).
bruteforce-data-threshold = 30
bruteforce-data-min-packet-ratio = 10
bruteforce-data-max-packet-ratio = 25
bruteforce-server-ratio = 3


# dns detector configuration
dns-amplif-threshold = 10000