man(8)

NAME
aiengine - AIEngine (in binary form) is a next generation network intrusion detection system engine with capabilities of learning without any human intervention, NIDS(Network Intrusion Detection System) functionality, DNS domain classification, network collector and many others.

SYNOPSIS
aiengine --help

DESCRIPTION
AIEngine helps network/security profesionals to identify traffic and develop signatures for use them on NIDS, Firewalls, Traffic classifiers and so on.

OPTIONS

Mandatory arguments to long options are mandatory for short options too.

-i, --input
    Sets the network interface, pcap file or directory with pcap files. Sets the pcap file or directory with pcap files to analyze.

Link Layer optional arguments.

-q, --tag
    Selects the tag type of the ethernet layer (vlan,mpls).

TCP optional arguments.

-t, --tcp-flows
    Sets the number of TCP flows on the pool. 32768 flows is the default value.

UDP optional arguments.

-t, --udp-flows
    Sets the number of UDP flows on the pool. 16384 flows is the default value.

Regex optional arguments.

-R, --enable-signatures
    Enables the Regex engine. This implies that all the payloads of the flows will be process by this engine.

-r, --regex
    Sets the regex for evaluate agains the flows..

-c, --flow-class
    Uses tcp, udp or all for matches the signature on the flows.

-m, --matched-flows
    Shows through stdout the flows that matchs with the given regex.

-M, --matched-packet
    Shows the packet payload that matchs with the regex.

-C, --continue
    Continue evaluating the regex with the next packets of the flow.

-j, --reject-flows
    Rejects the flows that matchs with a regex. This functionality only works with root permisions and is only available on the StackLan and StackLanIPv6.

-w, --evidence
    Generates a pcap file with the matching regex for forensic analysis.

Frequencies optional arguments.

-F, --enable-frequencies
    Enables the Frequency engine. This implies that all the payloads of the flows will be process by this engine.

-g, --group-by
    Groups frequencies by src-ip,dst-ip,src-port and dst-port. src-ip stands for source IP address. dst-ip stands for destination IP address. src-port stands for source port (UDP or TCP). dst-port stands for destination port (UDP or TCP). Also the parameter could be a combination of src-ip,src-port or dst-ip,dst-port.

-f, --flow-type
    Selects the flows process by the Frequency engine by using the protocol (TCP or UDP).

-L, --enable-learner
    Enable the Learner engine in order to analyze the frequencies generated by the Frequency engine.

-k, --key-learner
    The Learner engine needs a key for analyze the flows that have been process by the Frequency engine.

-b, --buffer-size
    Sets the size of the internal buffer for generate the regex. By incrementing this buffer, we also increment the memory size needed for store the regex, the engine is capable of discover regex in different offsets.

-Q, --byte-quality
    Sets the minimum byte quality for the generated regex expression. This value is by default set to 80. This means that the generated regex expression is correct on 80% of the generated bytes aproximately.

-y, --enable-yara
    Generates a yara signature. Check http://plusvic.github.io/yara/

Optional arguments.

-n, --stack
    Selects the Network stack for the analysis. There is five network stacks availables at the moment.

    lan StackLan contains the configuration of a regular LAN network (ethernet,ip,tcp,udp).

    lan6
        StackLanIPv6 contains the configuration of a LAN network with IPv6 support (ethernet,ipv6,tcp,udp).

    mobile
        StackMobile contains a 3G stack (GN Interface) (ethernet,ip,udp,gprs,ip,udp,tcp).

    virtual
        StackVirtual that have the configuration of Virtual/Cloud enviroments with support for tunnels GRE/VxLan (ethernet,ip,udp,gre,vxlan,ip,udp,tcp).

    oflow
        StackOpenFlow that contains the configuration for openflow networks (ethernet,ip,tcp,openflow,ethernet,ip,udp,tcp).

-d, --dumpflows
    Dumps the flows processes to the stdout, also if a protocol is passed as argument, then the output is filtered.

-s, --statistics
    Shows details of statistics of every object plugged to the stack. There is 5 levels of statistics level.

-T, --timeout
    Sets the flows timeout. 180 secs is the default value for the timeout for every flow.

-P, --protocol
    Show statistics of a specific protocol of the network stack.

-e, --release
    Release the caches.

-l, --release-cache
    Release a specific cache, given a protocol as parameter.

-p, --pstatistics
    Shows process statistics, such as memory comsumption, context switching, and so on.

-K, --keep-flows
    Keep the network flows on memory for static analisys. The TCP and UDP connections will be on memory even if the timeout have been expired or the TCP connection have been close by RST or FIN flags.

-o, --summary
    Shows a summary of protocols, such as bytes, packets, memory comsumption, cache miss.

-h, --help
    display this help and exit

-v, --version
    output version information and exit

EXAMPLES
section for some illustrative examples.
aiengine -i ens7 -s 5 -P 'HTTPProtocol' -dhttp
Capture from the device ens7 all the traffic and shows a detail of the HTTPProtocol aiengine -i eth0 -R -r '^GET capa.exe.*capacitacion.inami.gob.mx.*$' -m
Capture traffic from eth0 and apply the regular expression ^GET capa.exe.*capacitacion.inami.gob.mx.*$ to TCP and UDP traffic and show the results on stdout. aiengine -i eth0 -t 500000 -R -r '^\x16\x03.*somethingonthenet.*$' -c tcp -m
Capture traffic from eth0 and allocate 500000 TCP flows and apply the regular expression ^ just to tcp traffic and shows the results on stdout. aiengine -i /defcon21/european_defcon/ -F -g dst-ip -L -k '10.5.7.2'
Process all the pcap files of the directory /defcon21/european_defcon/ and apply Frequency analisys by grouping the flows by dst-ip by using the IP address 10.5.7.2 and generates a regex on stdout. aiengine -i /pwningyeti/ -F -g dst-ip,dst-port -L -k 10.5.17.2:4321 -y
Process all the pcap files of the directory /pwningyeti/ and apply Frequency analisys by grouping the flows by dst-ip and dst-port by using the IP address and port 10.5.17.2:4321 and generates a regex on stdout and a Yara signature.
For more complex examples check the wiki page of the folder examples more advance functionality.

BUGS
No known bugs.

AUTHOR
Luis Campo Giralte (luis.camp0.2009@gmail.com)