NathanGibbs3 / BASE / 624

pending completion

Build # 624

Build Type

push

travis-ci-com

Committed by

NathanGibbs3

Commit Message

Merge branch 'devel'

Run Details

562 of 562 new or added lines in 28 files covered. (100.0%)

3145 of 17504 relevant lines covered (17.97%)

23.22 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/base_stat_common.php

<?php
/*******************************************************************************
** Basic Analysis and Security Engine (BASE)
** Copyright (C) 2004 BASE Project Team
** Copyright (C) 2000 Carnegie Mellon University
**
** (see the file 'base_main.php' for license details)
**
** Project Leads: Kevin Johnson <kjohnson@secureideas.net>
**                Sean Muller <samwise_diver@users.sourceforge.net>
** Built upon work by Roman Danyliw <rdd@cert.org>, <roman@danyliw.com>
**
** Purpose: summary statistics
********************************************************************************
** Authors:
********************************************************************************
** Kevin Johnson <kjohnson@secureideas.net
**
********************************************************************************
*/
// Ensure the conf file has been loaded. Prevent direct access to this file.
defined('_BASE_INC') or die('Accessing this file directly is not allowed.');

include_once("$BASE_path/includes/base_constants.inc.php");

function SensorCnt( $db, $join = '', $where = '' ){
   if ( $join == "" && $where == "" )
      $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.sid) FROM acid_event");
   else
      $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.sid) FROM acid_event $join $where");
   $myrow = $result->baseFetchRow();
   $num = $myrow[0];
   $result->baseFreeRows();

        return $num;
}

function SensorTotal( $db ){
   $result = $db->baseExecute("SELECT COUNT(DISTINCT sensor.sid) FROM sensor");
   $myrow = $result->baseFetchRow();
   $num = $myrow[0];
   $result->baseFreeRows();

        return $num;
}

function EventCnt( $db, $join = '', $where = '' ){
   if ( $join == "" && $where == "" )
      $result = $db->baseExecute("SELECT count(*) FROM acid_event");
   else
      $result = $db->baseExecute("SELECT COUNT(acid_event.sid) FROM acid_event $join $where");  

   $myrow = $result->baseFetchRow();
   $num = $myrow[0];
   $result->baseFreeRows();

        return $num;
}

// Takes: Numeric sensor ID from the Sensor table (SID), and DB connection.
// Returns: The number of unique alert descriptions for the given sensor ID.
function UniqueCntBySensor( $sensorID, $db ){
        // Calculate the Unique Alerts.
  $query = "SELECT COUNT(DISTINCT signature) FROM acid_event WHERE sid = '" . $sensorID . "'";
  $result = $db->baseExecute($query);

  if ( $result ) 
  {
     $row = $result->baseFetchRow();
     $num = $row[0];
     $result->baseFreeRows();
  }
  else
     $num = 0;

        return $num;
}

// Takes: Numeric sensor ID from the Sensor table (SID), and DB connection.
// Returns: The total number of alerts for the given sensor ID.
function EventCntBySensor( $sensorID, $db ){
   $query = "SELECT count(*) FROM acid_event where sid = '" .$sensorID. "'";

   $result = $db->baseExecute($query);
   $myrow = $result->baseFetchRow();
   $num = $myrow[0];
   $result->baseFreeRows();

        return $num;
}

function MinDateBySensor( $sensorID, $db ){
   $query = "SELECT min(timestamp) FROM acid_event WHERE sid= '". $sensorID."'";

   $result = $db->baseExecute($query);
   $myrow = $result->baseFetchRow();
   $num = $myrow[0];
   $result->baseFreeRows();

        return $num;
}

function MaxDateBySensor( $sensorID, $db ){
   $query = "SELECT max(timestamp) FROM acid_event WHERE sid='".$sensorID."'";

   $result = $db->baseExecute($query);
   $myrow = $result->baseFetchRow();
   $num = $myrow[0];
   $result->baseFreeRows();

        return $num;
}

function UniqueDestAddrCntBySensor( $sensorID, $db ){
   $query = "SELECT COUNT(DISTINCT ip_dst) from acid_event WHERE sid='" . $sensorID . "'";

   $result = $db->baseExecute($query);
   $row = $result->baseFetchRow();
   $num = $row[0];
   $result->baseFreeRows();

        return $num;
}

function UniqueSrcAddrCntBySensor( $sensorID, $db ){
   $query = "SELECT COUNT(DISTINCT ip_src) from acid_event WHERE sid='" . $sensorID . "'";

   $result = $db->baseExecute($query);
   $row = $result->baseFetchRow();
   $num = $row[0];
   $result->baseFreeRows();

        return $num;
}

function TCPPktCnt( $db ){
   $result = $db->baseExecute("SELECT count(*) FROM acid_event WHERE ip_proto=6");
   $myrow = $result->baseFetchRow();
   $num = $myrow[0];
   $result->baseFreeRows();

        return $num;
}

function UDPPktCnt( $db ){
   $result = $db->baseExecute("SELECT count(*) FROM acid_event WHERE ip_proto=17");
   $myrow = $result->baseFetchRow();
   $num = $myrow[0];
   $result->baseFreeRows();

        return $num;
}

function ICMPPktCnt( $db ){
   $result = $db->baseExecute("SELECT count(*) FROM acid_event WHERE ip_proto=1");
   $myrow = $result->baseFetchRow();
   $num = $myrow[0];
   $result->baseFreeRows();

        return $num;
}

function PortscanPktCnt( $db ){
   $result = $db->baseExecute("SELECT count(*) FROM acid_event WHERE ip_proto=255");
   $myrow = $result->baseFetchRow();
   $num = $myrow[0];
   $result->baseFreeRows();

        return $num;
}

function UniqueSrcIPCnt( $db, $join = '', $where = '' ){
   if ( $join == "" && $where == "" )
     $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_src) FROM acid_event");
   else
     $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_src) FROM acid_event $join WHERE $where"); //.
                                //"WHERE acid_event.sid > 0 $where");

   $row = $result->baseFetchRow();
   $num = $row[0];
   $result->baseFreeRows();

        return $num;
}

function UniqueDstIPCnt( $db, $join = '', $where = '' ){
   if ( $join == "" && $where == "" )
     $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_dst) FROM acid_event");
   else
     $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_dst) FROM acid_event $join WHERE $where"); //.
                                //"WHERE acid_event.sid > 0 $where");

   $row = $result->baseFetchRow();
   $num = $row[0];
   $result->baseFreeRows();

        return $num;
}

function UniqueIPCnt( $db, $join = '', $where = '' ){
   $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_src), ".
                              "COUNT(DISTINCT acid_event.ip_dst) FROM acid_event $join $where");

   $row = $result->baseFetchRow();
   $num1 = $row[0];
   $num2 = $row[1];
   $result->baseFreeRows();

        return array($num1, $num2);
}

function StartStopTime( &$start_time, &$stop_time, $db ){
   $result = $db->baseExecute("SELECT (SELECT timestamp FROM acid_event ORDER BY timestamp ASC LIMIT 1), ".
                              "(SELECT timestamp FROM acid_event ORDER BY timestamp DESC LIMIT 1)");
   $myrow = $result->baseFetchRow();
   $start_time = $myrow[0];
   $stop_time = $myrow[1];
   $result->baseFreeRows();
}

function UniqueAlertCnt($db, $join = '', $where = '' ){
   $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.signature) FROM acid_event $join ".
                                 "$where");    

   $row = $result->baseFetchRow();
   $num = $row[0];
   $result->baseFreeRows();

        return $num;
}

function UniquePortCnt( $db, $join = '', $where = '' ){
   if ( $join == "" && $where == "")
     $result = $db->baseExecute("SELECT COUNT(DISTINCT layer4_sport),  ".
                                "COUNT(DISTINCT layer4_dport) FROM acid_event");
   else
     $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.layer4_sport),  ".
                                "COUNT(DISTINCT acid_event.layer4_dport) FROM acid_event $join ".
                                "$where");

   $row = $result->baseFetchRow();
   $result->baseFreeRows();

        return array($row[0], $row[1]);
}

function UniqueTCPPortCnt( $db, $join = '', $where = '' ){
   if ( $join == "" && $where == "")
     $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.layer4_sport),  ".
                              "COUNT(DISTINCT acid_event.layer4_dport) FROM acid_event ".
                              "WHERE ip_proto='".TCP."'");
   else
     $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.layer4_sport),  ".
                              "COUNT(DISTINCT acid_event.layer4_dport) FROM acid_event $join".
                              " $where AND ip_proto='".TCP."'");

   $row = $result->baseFetchRow();
   $result->baseFreeRows();

        return array($row[0], $row[1]);
}

function UniqueUDPPortCnt( $db, $join = '', $where = '' ){
   if ( $join == "" && $where == "")
     $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.layer4_sport),  ".
                              "COUNT(DISTINCT acid_event.layer4_dport) FROM acid_event ".
                              "WHERE ip_proto='".UDP."'");
   else
     $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.layer4_sport),  ".
                              "COUNT(DISTINCT acid_event.layer4_dport) FROM acid_event $join".
                              " $where AND ip_proto='".UDP."'");

   $row = $result->baseFetchRow();
   $result->baseFreeRows();

        return array($row[0], $row[1]);
}

function UniqueLinkCnt( $db, $join = '', $where = '' ){
   if (!stristr($where, "WHERE") && $where != "")
        $where = " WHERE $where ";

   if ( $db->DB_type == "mysql" )
   {
     if ( $join == "" && $where == "")
       $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_src, acid_event.ip_dst, acid_event.ip_proto) FROM acid_event");
     else
       $result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_src, acid_event.ip_dst, acid_event.ip_proto) FROM acid_event $join $where");

     $row = $result->baseFetchRow();
     $result->baseFreeRows();
   }
   else
   {
     if ( $join == "" && $where == "")
       $result = $db->baseExecute("SELECT DISTINCT acid_event.ip_src, acid_event.ip_dst, acid_event.ip_proto FROM acid_event");
     else
       $result = $db->baseExecute("SELECT DISTINCT acid_event.ip_src, acid_event.ip_dst, acid_event.ip_proto FROM acid_event $join $where");
   
     $row[0] = $result->baseRecordCount();
     $result->baseFreeRows();     
   }

        return $row[0];
}

function PrintGeneralStats(
        $db, $compact, $show_stats, $join = '', $where = '',
        $show_total_events = false
){
        GLOBAL $et, $debug_mode;
        if ( $show_stats == 1 || $show_total_events ){
                $event_cnt = EventCnt($db, $join, $where);
                if ( $debug_mode > 1 && isset($et) && is_object($et) ){
                        $et->Mark('Stats: Alert Count');
                }
        }
        if ( $show_stats == 1 ){
     $sensor_cnt = SensorCnt($db, $join, $where);
     $sensor_total = SensorTotal($db);
                if ( $debug_mode > 1 && isset($et) && is_object($et) ){
                        $et->Mark('Stats: Sensor Data');
                }
     $unique_alert_cnt = UniqueAlertCnt($db, $join, $where);
                if ( $debug_mode > 1 && isset($et) && is_object($et) ){
                        $et->Mark('Stats: Unique Alert');
                }
     $unique_ip_cnt = UniqueIPCnt($db, $join, $where);
                if ( $debug_mode > 1 && isset($et) && is_object($et) ){
                        $et->Mark('Stats: Unique IP');
                }
     $unique_links_cnt = UniqueLinkCnt($db, $join, $where);
                if ( $debug_mode > 1 && isset($et) && is_object($et) ){
                        $et->Mark('Stats: Unique IP Links');
                }
     $unique_port_cnt = UniquePortCnt($db, $join, $where);
                if ( $debug_mode > 1 && isset($et) && is_object($et) ){
                        $et->Mark('Stats: Unique Ports ALL');
                }
     $unique_tcp_port_cnt = UniqueTCPPortCnt($db, $join, $where);
                if ( $debug_mode > 1 && isset($et) && is_object($et) ){
                        $et->Mark('Stats: Unique Ports TCP');
                }
     $unique_udp_port_cnt = UniqueUDPPortCnt($db, $join, $where);
                if ( $debug_mode > 1 && isset($et) && is_object($et) ){
                        $et->Mark('Stats: Unique Ports UDP');
                }
                if ( $debug_mode == 1 && isset($et) && is_object($et) ){
                        $et->Mark("Stats: Unique Data");
                }
        }
        if ( $db->baseGetDBversion() >= 103 ){
                // Michael Stone 2005-03-09
                // This is an expensive calculation. Do it, only if we need it.
                if ( $show_stats == 1 ){
                        $result = $db->baseExecute(
                                "SELECT count(DISTINCT(sig_class_id)) FROM acid_event"
                        );
                        $myrow = $result->baseFetchRow();
                        $class_cnt = $myrow[0];
                        $result->baseFreeRows();
                        if ( $debug_mode > 1 && isset($et) && is_object($et) ){
                                $et->Mark("Stats: Classification Count");
                        }
                }

      $class_cnt_info[0] = " <strong>"._SCCATEGORIES." </strong>";
      $class_cnt_info[1] = "<a href=\"base_stat_class.php?sort_order=class_a\">";
      $class_cnt_info[2] = "</a>";
        }

   $sensor_cnt_info[0] = "<strong>"._SCSENSORTOTAL."</strong>\n";
   $sensor_cnt_info[1] = "<a href=\"base_stat_sensor.php\">";
   $sensor_cnt_info[2] = "</a> / ";

   $unique_alert_cnt_info[0] = "<strong>"._UNIALERTS.":</strong>\n";
   $unique_alert_cnt_info[1] = "<a href=\"base_stat_alerts.php\">"; 
   $unique_alert_cnt_info[2] = "</a>";

   $event_cnt_info[0] = "<strong>"._SCTOTALNUMALERTS."</strong>\n";
   $event_cnt_info[1] = '<a href="base_qry_main.php?&amp;num_result_rows=-1'.
                        '&amp;submit='._QUERYDBP.'&amp;current_view=-1">';
   $event_cnt_info[2] = "</a>";

   $unique_src_ip_cnt_info[0] = _SCSRCIP;
   $unique_src_ip_cnt_info[1] = " ".BuildUniqueAddressLink(1);
   $unique_src_ip_cnt_info[2] = "</a>";
   $unique_dst_ip_cnt_info[0] = _SCDSTIP;
   $unique_dst_ip_cnt_info[1] = " ".BuildUniqueAddressLink(2);
   $unique_dst_ip_cnt_info[2] = "</a>";

   $unique_links_info[0] = _SCUNILINKS;
   $unique_links_info[1] = " <a href=\"base_stat_iplink.php\">";
   $unique_links_info[2] = "</a>";

   $unique_src_port_cnt_info[0] = _SCSRCPORTS; 
   $unique_src_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=1&amp;proto=-1\">";
   $unique_src_port_cnt_info[2] = "</a>";
   $unique_dst_port_cnt_info[0] = _SCDSTPORTS; 
   $unique_dst_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=2&amp;proto=-1\">";
   $unique_dst_port_cnt_info[2] = "</a>";

   $unique_tcp_src_port_cnt_info[0] = "TCP (";
   $unique_tcp_src_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=1&amp;proto=".TCP."\">";
   $unique_tcp_src_port_cnt_info[2] = "</a>)";
   $unique_tcp_dst_port_cnt_info[0] = "TCP (";
   $unique_tcp_dst_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=2&amp;proto=".TCP."\">";
   $unique_tcp_dst_port_cnt_info[2] = "</a>)";

   $unique_udp_src_port_cnt_info[0] = "UDP (";
   $unique_udp_src_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=1&amp;proto=".UDP."\">";
   $unique_udp_src_port_cnt_info[2] = "</a>)";
   $unique_udp_dst_port_cnt_info[0] = "UDP (";
   $unique_udp_dst_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=2&amp;proto=".UDP."\">";
   $unique_udp_dst_port_cnt_info[2] = "</a>)";

// Begin page output.
        if ( $show_stats == 1 ){
   echo $sensor_cnt_info[0].
        $sensor_cnt_info[1].
        $sensor_cnt.
        $sensor_cnt_info[2].
        $sensor_total;
                NLIO('<br/>');
   echo $unique_alert_cnt_info[0].
        $unique_alert_cnt_info[1].
        $unique_alert_cnt.
        $unique_alert_cnt_info[2];
                NLIO('<br/>');
                if ( $db->baseGetDBversion() >= 103 ){
                        print $class_cnt_info[0] . $class_cnt_info[1] . $class_cnt
                        . $class_cnt_info[2];
                        NLIO('<br/>');
                }

   echo $event_cnt_info[0].
        $event_cnt_info[1].
        $event_cnt.
        $event_cnt_info[2];
                NLIO("<ul class='stats'>",2);
                NLIO('<li>');
                print $unique_src_ip_cnt_info[0] . $unique_src_ip_cnt_info[1]
                        . $unique_ip_cnt[0] . $unique_src_ip_cnt_info[2];
                PrintLINext();
                print $unique_dst_ip_cnt_info[0] . $unique_dst_ip_cnt_info[1]
                        . $unique_ip_cnt[1] . $unique_dst_ip_cnt_info[2];
                PrintLINext();
                print $unique_links_info[0] . $unique_links_info[1]
                        . $unique_links_cnt . $unique_links_info[2];
                if ( $compact == 0 ){
                        NLIO('</li></ul>');
                        NLIO("<ul class='stats'><li>");
                }else{
                        PrintLINext();
                }
                print $unique_src_port_cnt_info[0] . $unique_src_port_cnt_info[1]
                        . $unique_port_cnt[0] . $unique_src_port_cnt_info[2];
                if ( $compact == 0 ){
                        NLIO("<ul class='stats'><li>");
                }else{
                        PrintLINext();
     echo "&nbsp;&nbsp;--&nbsp;&nbsp;";
                }
   echo $unique_tcp_src_port_cnt_info[0].
        $unique_tcp_src_port_cnt_info[1]. 
        $unique_tcp_port_cnt[0].
        $unique_tcp_src_port_cnt_info[2].
        "&nbsp;&nbsp;".
        $unique_udp_src_port_cnt_info[0].
        $unique_udp_src_port_cnt_info[1]. 
        $unique_udp_port_cnt[0].
        $unique_udp_src_port_cnt_info[2];
                if ( $compact == 0 ){
                        NLIO('</li></ul>',4);
                }
                PrintLINext();
                print $unique_dst_port_cnt_info[0] . $unique_dst_port_cnt_info[1]
                        . $unique_port_cnt[1] . $unique_dst_port_cnt_info[2];
                if ( $compact == 0 ){
                        NLIO("<ul class='stats'><li>");
                }else{
                        PrintLINext();
     echo "&nbsp;&nbsp;--&nbsp;&nbsp;";
                }
   echo $unique_tcp_dst_port_cnt_info[0].
        $unique_tcp_dst_port_cnt_info[1]. 
        $unique_tcp_port_cnt[1].
        $unique_tcp_dst_port_cnt_info[2].
        "&nbsp;&nbsp;".
        $unique_udp_dst_port_cnt_info[0].
        $unique_udp_dst_port_cnt_info[1]. 
        $unique_udp_port_cnt[1].
        $unique_udp_dst_port_cnt_info[2];
                if ( $compact == 0 ){
                        NLIO('</li></ul>',4);
                }
                NLIO('</li></ul>');
        }else{
                if ( $show_total_events ){
                        NLIO("<ul class='stats'><li>");
                        print $event_cnt_info[0] . $event_cnt_info[1] . $event_cnt
                                . $event_cnt_info[2];
                        NLIO('</li></ul>');
                }
                NLIO("<ul class='stats'><li>");
      echo $sensor_cnt_info[1]._SCSENSORS.'</a>';
                PrintLINext();
                print $unique_alert_cnt_info[1] . _UNIALERTS
                        . $unique_alert_cnt_info[2];
                PrintLINext();
                if ( $db->baseGetDBversion() >= 103 ){
                        print '&nbsp;&nbsp;&nbsp;( ' . $class_cnt_info[1]
                                . _SCCLASS . $class_cnt_info[2] . ' )';
                }
                PrintLINext();
                print _SCUNIADDRESS
                . $unique_src_ip_cnt_info[1] . _SCSOURCE . ' | '
                . $unique_src_ip_cnt_info[2] . $unique_dst_ip_cnt_info[1] . _SCDEST
                . $unique_dst_ip_cnt_info[2];
                PrintLINext();
                print $unique_links_info[1] . $unique_links_info[0]
                . $unique_links_info[2];
                PrintLINext();
                print $unique_src_port_cnt_info[1] . _SCSOURCE . " "
                . $unique_src_port_cnt_info[2] . _SCPORT . ": "
                . $unique_tcp_src_port_cnt_info[1]." TCP</a> | "
                . $unique_udp_src_port_cnt_info[1]." UDP</a>";
                PrintLINext();
                print $unique_dst_port_cnt_info[1] . _SCDEST . " "
                . $unique_dst_port_cnt_info[2] . _SCPORT . ": "
                . $unique_tcp_dst_port_cnt_info[1] . " TCP</a> | "
                . $unique_udp_dst_port_cnt_info[1] . " UDP</a>";
                NLIO('</li></ul>');
        }
        if ( isset($et) && is_object($et) ){
                $et->Mark("Stats: Output");
        }
}
?>

1	<?php
2	/*******************************************************************************
3	** Basic Analysis and Security Engine (BASE)
4	** Copyright (C) 2004 BASE Project Team
5	** Copyright (C) 2000 Carnegie Mellon University
6	**
7	** (see the file 'base_main.php' for license details)
8	**
9	** Project Leads: Kevin Johnson <kjohnson@secureideas.net>
10	** Sean Muller <samwise_diver@users.sourceforge.net>
11	** Built upon work by Roman Danyliw <rdd@cert.org>, <roman@danyliw.com>
12	**
13	** Purpose: summary statistics
14	********************************************************************************
15	** Authors:
16	********************************************************************************
17	** Kevin Johnson <kjohnson@secureideas.net
18	**
19	********************************************************************************
20	*/
21	// Ensure the conf file has been loaded. Prevent direct access to this file.
22	defined('_BASE_INC') or die('Accessing this file directly is not allowed.');
23
24	include_once("$BASE_path/includes/base_constants.inc.php");
25
26	function SensorCnt( $db, $join = '', $where = '' ){
27	if ( $join == "" && $where == "" )	×
28	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.sid) FROM acid_event");	×
29	else
30	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.sid) FROM acid_event $join $where");	×
31	$myrow = $result->baseFetchRow();	×
32	$num = $myrow[0];	×
33	$result->baseFreeRows();	×
34
35	return $num;	×
36	}
37
38	function SensorTotal( $db ){
39	$result = $db->baseExecute("SELECT COUNT(DISTINCT sensor.sid) FROM sensor");	×
40	$myrow = $result->baseFetchRow();	×
41	$num = $myrow[0];	×
42	$result->baseFreeRows();	×
43
44	return $num;	×
45	}
46
47	function EventCnt( $db, $join = '', $where = '' ){
48	if ( $join == "" && $where == "" )	×
49	$result = $db->baseExecute("SELECT count(*) FROM acid_event");	×
50	else
51	$result = $db->baseExecute("SELECT COUNT(acid_event.sid) FROM acid_event $join $where");	×
52
53	$myrow = $result->baseFetchRow();	×
54	$num = $myrow[0];	×
55	$result->baseFreeRows();	×
56
57	return $num;	×
58	}
59
60	// Takes: Numeric sensor ID from the Sensor table (SID), and DB connection.
61	// Returns: The number of unique alert descriptions for the given sensor ID.
62	function UniqueCntBySensor( $sensorID, $db ){
63	// Calculate the Unique Alerts.
64	$query = "SELECT COUNT(DISTINCT signature) FROM acid_event WHERE sid = '" . $sensorID . "'";	×
65	$result = $db->baseExecute($query);	×
66
67	if ( $result )
68	{
69	$row = $result->baseFetchRow();	×
70	$num = $row[0];	×
71	$result->baseFreeRows();	×
72	}
73	else
74	$num = 0;	×
75
76	return $num;	×
77	}
78
79	// Takes: Numeric sensor ID from the Sensor table (SID), and DB connection.
80	// Returns: The total number of alerts for the given sensor ID.
81	function EventCntBySensor( $sensorID, $db ){
82	$query = "SELECT count(*) FROM acid_event where sid = '" .$sensorID. "'";	×
83
84	$result = $db->baseExecute($query);	×
85	$myrow = $result->baseFetchRow();	×
86	$num = $myrow[0];	×
87	$result->baseFreeRows();	×
88
89	return $num;	×
90	}
91
92	function MinDateBySensor( $sensorID, $db ){
93	$query = "SELECT min(timestamp) FROM acid_event WHERE sid= '". $sensorID."'";	×
94
95	$result = $db->baseExecute($query);	×
96	$myrow = $result->baseFetchRow();	×
97	$num = $myrow[0];	×
98	$result->baseFreeRows();	×
99
100	return $num;	×
101	}
102
103	function MaxDateBySensor( $sensorID, $db ){
104	$query = "SELECT max(timestamp) FROM acid_event WHERE sid='".$sensorID."'";	×
105
106	$result = $db->baseExecute($query);	×
107	$myrow = $result->baseFetchRow();	×
108	$num = $myrow[0];	×
109	$result->baseFreeRows();	×
110
111	return $num;	×
112	}
113
114	function UniqueDestAddrCntBySensor( $sensorID, $db ){
115	$query = "SELECT COUNT(DISTINCT ip_dst) from acid_event WHERE sid='" . $sensorID . "'";	×
116
117	$result = $db->baseExecute($query);	×
118	$row = $result->baseFetchRow();	×
119	$num = $row[0];	×
120	$result->baseFreeRows();	×
121
122	return $num;	×
123	}
124
125	function UniqueSrcAddrCntBySensor( $sensorID, $db ){
126	$query = "SELECT COUNT(DISTINCT ip_src) from acid_event WHERE sid='" . $sensorID . "'";	×
127
128	$result = $db->baseExecute($query);	×
129	$row = $result->baseFetchRow();	×
130	$num = $row[0];	×
131	$result->baseFreeRows();	×
132
133	return $num;	×
134	}
135
136	function TCPPktCnt( $db ){
137	$result = $db->baseExecute("SELECT count(*) FROM acid_event WHERE ip_proto=6");	×
138	$myrow = $result->baseFetchRow();	×
139	$num = $myrow[0];	×
140	$result->baseFreeRows();	×
141
142	return $num;	×
143	}
144
145	function UDPPktCnt( $db ){
146	$result = $db->baseExecute("SELECT count(*) FROM acid_event WHERE ip_proto=17");	×
147	$myrow = $result->baseFetchRow();	×
148	$num = $myrow[0];	×
149	$result->baseFreeRows();	×
150
151	return $num;	×
152	}
153
154	function ICMPPktCnt( $db ){
155	$result = $db->baseExecute("SELECT count(*) FROM acid_event WHERE ip_proto=1");	×
156	$myrow = $result->baseFetchRow();	×
157	$num = $myrow[0];	×
158	$result->baseFreeRows();	×
159
160	return $num;	×
161	}
162
163	function PortscanPktCnt( $db ){
164	$result = $db->baseExecute("SELECT count(*) FROM acid_event WHERE ip_proto=255");	×
165	$myrow = $result->baseFetchRow();	×
166	$num = $myrow[0];	×
167	$result->baseFreeRows();	×
168
169	return $num;	×
170	}
171
172	function UniqueSrcIPCnt( $db, $join = '', $where = '' ){
173	if ( $join == "" && $where == "" )	×
174	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_src) FROM acid_event");	×
175	else
176	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_src) FROM acid_event $join WHERE $where"); //.	×
177	//"WHERE acid_event.sid > 0 $where");
178
179	$row = $result->baseFetchRow();	×
180	$num = $row[0];	×
181	$result->baseFreeRows();	×
182
183	return $num;	×
184	}
185
186	function UniqueDstIPCnt( $db, $join = '', $where = '' ){
187	if ( $join == "" && $where == "" )	×
188	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_dst) FROM acid_event");	×
189	else
190	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_dst) FROM acid_event $join WHERE $where"); //.	×
191	//"WHERE acid_event.sid > 0 $where");
192
193	$row = $result->baseFetchRow();	×
194	$num = $row[0];	×
195	$result->baseFreeRows();	×
196
197	return $num;	×
198	}
199
200	function UniqueIPCnt( $db, $join = '', $where = '' ){
201	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_src), ".	×
202	"COUNT(DISTINCT acid_event.ip_dst) FROM acid_event $join $where");	×
203
204	$row = $result->baseFetchRow();	×
205	$num1 = $row[0];	×
206	$num2 = $row[1];	×
207	$result->baseFreeRows();	×
208
209	return array($num1, $num2);	×
210	}
211
212	function StartStopTime( &$start_time, &$stop_time, $db ){
213	$result = $db->baseExecute("SELECT (SELECT timestamp FROM acid_event ORDER BY timestamp ASC LIMIT 1), ".	×
214	"(SELECT timestamp FROM acid_event ORDER BY timestamp DESC LIMIT 1)");
215	$myrow = $result->baseFetchRow();	×
216	$start_time = $myrow[0];	×
217	$stop_time = $myrow[1];	×
218	$result->baseFreeRows();	×
219	}
220
221	function UniqueAlertCnt($db, $join = '', $where = '' ){
222	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.signature) FROM acid_event $join ".	×
223	"$where");	×
224
225	$row = $result->baseFetchRow();	×
226	$num = $row[0];	×
227	$result->baseFreeRows();	×
228
229	return $num;	×
230	}
231
232	function UniquePortCnt( $db, $join = '', $where = '' ){
233	if ( $join == "" && $where == "")	×
234	$result = $db->baseExecute("SELECT COUNT(DISTINCT layer4_sport), ".	×
235	"COUNT(DISTINCT layer4_dport) FROM acid_event");
236	else
237	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.layer4_sport), ".	×
238	"COUNT(DISTINCT acid_event.layer4_dport) FROM acid_event $join ".	×
239	"$where");	×
240
241	$row = $result->baseFetchRow();	×
242	$result->baseFreeRows();	×
243
244	return array($row[0], $row[1]);	×
245	}
246
247	function UniqueTCPPortCnt( $db, $join = '', $where = '' ){
248	if ( $join == "" && $where == "")	×
249	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.layer4_sport), ".	×
250	"COUNT(DISTINCT acid_event.layer4_dport) FROM acid_event ".
251	"WHERE ip_proto='".TCP."'");
252	else
253	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.layer4_sport), ".	×
254	"COUNT(DISTINCT acid_event.layer4_dport) FROM acid_event $join".	×
255	" $where AND ip_proto='".TCP."'");	×
256
257	$row = $result->baseFetchRow();	×
258	$result->baseFreeRows();	×
259
260	return array($row[0], $row[1]);	×
261	}
262
263	function UniqueUDPPortCnt( $db, $join = '', $where = '' ){
264	if ( $join == "" && $where == "")	×
265	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.layer4_sport), ".	×
266	"COUNT(DISTINCT acid_event.layer4_dport) FROM acid_event ".
267	"WHERE ip_proto='".UDP."'");
268	else
269	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.layer4_sport), ".	×
270	"COUNT(DISTINCT acid_event.layer4_dport) FROM acid_event $join".	×
271	" $where AND ip_proto='".UDP."'");	×
272
273	$row = $result->baseFetchRow();	×
274	$result->baseFreeRows();	×
275
276	return array($row[0], $row[1]);	×
277	}
278
279	function UniqueLinkCnt( $db, $join = '', $where = '' ){
280	if (!stristr($where, "WHERE") && $where != "")	×
281	$where = " WHERE $where ";	×
282
283	if ( $db->DB_type == "mysql" )	×
284	{
285	if ( $join == "" && $where == "")	×
286	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_src, acid_event.ip_dst, acid_event.ip_proto) FROM acid_event");	×
287	else
288	$result = $db->baseExecute("SELECT COUNT(DISTINCT acid_event.ip_src, acid_event.ip_dst, acid_event.ip_proto) FROM acid_event $join $where");	×
289
290	$row = $result->baseFetchRow();	×
291	$result->baseFreeRows();	×
292	}
293	else
294	{
295	if ( $join == "" && $where == "")	×
296	$result = $db->baseExecute("SELECT DISTINCT acid_event.ip_src, acid_event.ip_dst, acid_event.ip_proto FROM acid_event");	×
297	else
298	$result = $db->baseExecute("SELECT DISTINCT acid_event.ip_src, acid_event.ip_dst, acid_event.ip_proto FROM acid_event $join $where");	×
299
300	$row[0] = $result->baseRecordCount();	×
301	$result->baseFreeRows();	×
302	}
303
304	return $row[0];	×
305	}
306
307	function PrintGeneralStats(
308	$db, $compact, $show_stats, $join = '', $where = '',
309	$show_total_events = false
310	){
311	GLOBAL $et, $debug_mode;
312	if ( $show_stats == 1 \|\| $show_total_events ){	×
313	$event_cnt = EventCnt($db, $join, $where);	×
314	if ( $debug_mode > 1 && isset($et) && is_object($et) ){	×
315	$et->Mark('Stats: Alert Count');	×
316	}
317	}
318	if ( $show_stats == 1 ){	×
319	$sensor_cnt = SensorCnt($db, $join, $where);	×
320	$sensor_total = SensorTotal($db);	×
321	if ( $debug_mode > 1 && isset($et) && is_object($et) ){	×
322	$et->Mark('Stats: Sensor Data');	×
323	}
324	$unique_alert_cnt = UniqueAlertCnt($db, $join, $where);	×
325	if ( $debug_mode > 1 && isset($et) && is_object($et) ){	×
326	$et->Mark('Stats: Unique Alert');	×
327	}
328	$unique_ip_cnt = UniqueIPCnt($db, $join, $where);	×
329	if ( $debug_mode > 1 && isset($et) && is_object($et) ){	×
330	$et->Mark('Stats: Unique IP');	×
331	}
332	$unique_links_cnt = UniqueLinkCnt($db, $join, $where);	×
333	if ( $debug_mode > 1 && isset($et) && is_object($et) ){	×
334	$et->Mark('Stats: Unique IP Links');	×
335	}
336	$unique_port_cnt = UniquePortCnt($db, $join, $where);	×
337	if ( $debug_mode > 1 && isset($et) && is_object($et) ){	×
338	$et->Mark('Stats: Unique Ports ALL');	×
339	}
340	$unique_tcp_port_cnt = UniqueTCPPortCnt($db, $join, $where);	×
341	if ( $debug_mode > 1 && isset($et) && is_object($et) ){	×
342	$et->Mark('Stats: Unique Ports TCP');	×
343	}
344	$unique_udp_port_cnt = UniqueUDPPortCnt($db, $join, $where);	×
345	if ( $debug_mode > 1 && isset($et) && is_object($et) ){	×
346	$et->Mark('Stats: Unique Ports UDP');	×
347	}
348	if ( $debug_mode == 1 && isset($et) && is_object($et) ){	×
349	$et->Mark("Stats: Unique Data");	×
350	}
351	}
352	if ( $db->baseGetDBversion() >= 103 ){	×
353	// Michael Stone 2005-03-09
354	// This is an expensive calculation. Do it, only if we need it.
355	if ( $show_stats == 1 ){	×
356	$result = $db->baseExecute(	×
357	"SELECT count(DISTINCT(sig_class_id)) FROM acid_event"
358	);
359	$myrow = $result->baseFetchRow();	×
360	$class_cnt = $myrow[0];	×
361	$result->baseFreeRows();	×
362	if ( $debug_mode > 1 && isset($et) && is_object($et) ){	×
363	$et->Mark("Stats: Classification Count");	×
364	}
365	}
366
367	$class_cnt_info[0] = " <strong>"._SCCATEGORIES." </strong>";	×
368	$class_cnt_info[1] = "<a href=\"base_stat_class.php?sort_order=class_a\">";	×
369	$class_cnt_info[2] = "</a>";	×
370	}
371
372	$sensor_cnt_info[0] = "<strong>"._SCSENSORTOTAL."</strong>\n";	×
373	$sensor_cnt_info[1] = "<a href=\"base_stat_sensor.php\">";	×
374	$sensor_cnt_info[2] = "</a> / ";	×
375
376	$unique_alert_cnt_info[0] = "<strong>"._UNIALERTS.":</strong>\n";	×
377	$unique_alert_cnt_info[1] = "<a href=\"base_stat_alerts.php\">";	×
378	$unique_alert_cnt_info[2] = "</a>";	×
379
380	$event_cnt_info[0] = "<strong>"._SCTOTALNUMALERTS."</strong>\n";	×
381	$event_cnt_info[1] = '<a href="base_qry_main.php?&num_result_rows=-1'.	×
382	'&submit='._QUERYDBP.'&current_view=-1">';
383	$event_cnt_info[2] = "</a>";	×
384
385	$unique_src_ip_cnt_info[0] = _SCSRCIP;	×
386	$unique_src_ip_cnt_info[1] = " ".BuildUniqueAddressLink(1);	×
387	$unique_src_ip_cnt_info[2] = "</a>";	×
388	$unique_dst_ip_cnt_info[0] = _SCDSTIP;	×
389	$unique_dst_ip_cnt_info[1] = " ".BuildUniqueAddressLink(2);	×
390	$unique_dst_ip_cnt_info[2] = "</a>";	×
391
392	$unique_links_info[0] = _SCUNILINKS;	×
393	$unique_links_info[1] = " <a href=\"base_stat_iplink.php\">";	×
394	$unique_links_info[2] = "</a>";	×
395
396	$unique_src_port_cnt_info[0] = _SCSRCPORTS;	×
397	$unique_src_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=1&proto=-1\">";	×
398	$unique_src_port_cnt_info[2] = "</a>";	×
399	$unique_dst_port_cnt_info[0] = _SCDSTPORTS;	×
400	$unique_dst_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=2&proto=-1\">";	×
401	$unique_dst_port_cnt_info[2] = "</a>";	×
402
403	$unique_tcp_src_port_cnt_info[0] = "TCP (";	×
404	$unique_tcp_src_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=1&proto=".TCP."\">";	×
405	$unique_tcp_src_port_cnt_info[2] = "</a>)";	×
406	$unique_tcp_dst_port_cnt_info[0] = "TCP (";	×
407	$unique_tcp_dst_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=2&proto=".TCP."\">";	×
408	$unique_tcp_dst_port_cnt_info[2] = "</a>)";	×
409
410	$unique_udp_src_port_cnt_info[0] = "UDP (";	×
411	$unique_udp_src_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=1&proto=".UDP."\">";	×
412	$unique_udp_src_port_cnt_info[2] = "</a>)";	×
413	$unique_udp_dst_port_cnt_info[0] = "UDP (";	×
414	$unique_udp_dst_port_cnt_info[1] = " <a href=\"base_stat_ports.php?port_type=2&proto=".UDP."\">";	×
415	$unique_udp_dst_port_cnt_info[2] = "</a>)";	×
416
417	// Begin page output.
418	if ( $show_stats == 1 ){	×
419	echo $sensor_cnt_info[0].	×
420	$sensor_cnt_info[1].	×
421	$sensor_cnt.
422	$sensor_cnt_info[2].	×
423	$sensor_total;
424	NLIO('<br/>');	×
425	echo $unique_alert_cnt_info[0].	×
426	$unique_alert_cnt_info[1].	×
427	$unique_alert_cnt.
428	$unique_alert_cnt_info[2];	×
429	NLIO('<br/>');	×
430	if ( $db->baseGetDBversion() >= 103 ){	×
431	print $class_cnt_info[0] . $class_cnt_info[1] . $class_cnt	×
432	. $class_cnt_info[2];	×
433	NLIO('<br/>');	×
434	}
435
436	echo $event_cnt_info[0].	×
437	$event_cnt_info[1].	×
438	$event_cnt.
439	$event_cnt_info[2];	×
440	NLIO("<ul class='stats'>",2);	×
441	NLIO('<li>');	×
442	print $unique_src_ip_cnt_info[0] . $unique_src_ip_cnt_info[1]	×
443	. $unique_ip_cnt[0] . $unique_src_ip_cnt_info[2];	×
444	PrintLINext();	×
445	print $unique_dst_ip_cnt_info[0] . $unique_dst_ip_cnt_info[1]	×
446	. $unique_ip_cnt[1] . $unique_dst_ip_cnt_info[2];	×
447	PrintLINext();	×
448	print $unique_links_info[0] . $unique_links_info[1]	×
449	. $unique_links_cnt . $unique_links_info[2];	×
450	if ( $compact == 0 ){	×
451	NLIO('</li></ul>');	×
452	NLIO("<ul class='stats'><li>");	×
453	}else{
454	PrintLINext();	×
455	}
456	print $unique_src_port_cnt_info[0] . $unique_src_port_cnt_info[1]	×
457	. $unique_port_cnt[0] . $unique_src_port_cnt_info[2];	×
458	if ( $compact == 0 ){	×
459	NLIO("<ul class='stats'><li>");	×
460	}else{
461	PrintLINext();	×
462	echo "  --  ";	×
463	}
464	echo $unique_tcp_src_port_cnt_info[0].	×
465	$unique_tcp_src_port_cnt_info[1].	×
466	$unique_tcp_port_cnt[0].	×
467	$unique_tcp_src_port_cnt_info[2].	×
468	"  ".
469	$unique_udp_src_port_cnt_info[0].	×
470	$unique_udp_src_port_cnt_info[1].	×
471	$unique_udp_port_cnt[0].	×
472	$unique_udp_src_port_cnt_info[2];	×
473	if ( $compact == 0 ){	×
474	NLIO('</li></ul>',4);	×
475	}
476	PrintLINext();	×
477	print $unique_dst_port_cnt_info[0] . $unique_dst_port_cnt_info[1]	×
478	. $unique_port_cnt[1] . $unique_dst_port_cnt_info[2];	×
479	if ( $compact == 0 ){	×
480	NLIO("<ul class='stats'><li>");	×
481	}else{
482	PrintLINext();	×
483	echo "  --  ";	×
484	}
485	echo $unique_tcp_dst_port_cnt_info[0].	×
486	$unique_tcp_dst_port_cnt_info[1].	×
487	$unique_tcp_port_cnt[1].	×
488	$unique_tcp_dst_port_cnt_info[2].	×
489	"  ".
490	$unique_udp_dst_port_cnt_info[0].	×
491	$unique_udp_dst_port_cnt_info[1].	×
492	$unique_udp_port_cnt[1].	×
493	$unique_udp_dst_port_cnt_info[2];	×
494	if ( $compact == 0 ){	×
495	NLIO('</li></ul>',4);	×
496	}
497	NLIO('</li></ul>');	×
498	}else{
499	if ( $show_total_events ){	×
500	NLIO("<ul class='stats'><li>");	×
501	print $event_cnt_info[0] . $event_cnt_info[1] . $event_cnt	×
502	. $event_cnt_info[2];	×
503	NLIO('</li></ul>');	×
504	}
505	NLIO("<ul class='stats'><li>");	×
506	echo $sensor_cnt_info[1]._SCSENSORS.'</a>';	×
507	PrintLINext();	×
508	print $unique_alert_cnt_info[1] . _UNIALERTS	×
509	. $unique_alert_cnt_info[2];	×
510	PrintLINext();	×
511	if ( $db->baseGetDBversion() >= 103 ){	×
512	print '   ( ' . $class_cnt_info[1]	×
513	. _SCCLASS . $class_cnt_info[2] . ' )';	×
514	}
515	PrintLINext();	×
516	print _SCUNIADDRESS
517	. $unique_src_ip_cnt_info[1] . _SCSOURCE . ' \| '	×
518	. $unique_src_ip_cnt_info[2] . $unique_dst_ip_cnt_info[1] . _SCDEST	×
519	. $unique_dst_ip_cnt_info[2];	×
520	PrintLINext();	×
521	print $unique_links_info[1] . $unique_links_info[0]	×
522	. $unique_links_info[2];	×
523	PrintLINext();	×
524	print $unique_src_port_cnt_info[1] . _SCSOURCE . " "	×
525	. $unique_src_port_cnt_info[2] . _SCPORT . ": "	×
526	. $unique_tcp_src_port_cnt_info[1]." TCP</a> \| "	×
527	. $unique_udp_src_port_cnt_info[1]." UDP</a>";	×
528	PrintLINext();	×
529	print $unique_dst_port_cnt_info[1] . _SCDEST . " "	×
530	. $unique_dst_port_cnt_info[2] . _SCPORT . ": "	×
531	. $unique_tcp_dst_port_cnt_info[1] . " TCP</a> \| "	×
532	. $unique_udp_dst_port_cnt_info[1] . " UDP</a>";	×
533	NLIO('</li></ul>');	×
534	}
535	if ( isset($et) && is_object($et) ){	×
536	$et->Mark("Stats: Output");	×
537	}
538	}
539	?>

NathanGibbs3 / BASE / 624

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous