D.A.R.W.I.N
Darwin is an open source Artificial Intelligence Framework for CyberSecurity. It can be compiled and run on both FreeBSD and Linux.
We provide packages and support for FreeBSD.
Darwin is:
- A multi-threaded C++ engine that runs security filters that work together to improve your network security
- A collection of agents that use the DARWIN protocol to query the security filters accordingly
Darwin is still in an alpha stage, so few filters are available at this time.
Using the provided documentation and SDK you can develop your own Darwin Filters. We are seeking help! Testers and volunteers are welcome!
Advens (www.advens.fr) also provides commercial filters for Darwin !
Filters
Compilation
Note: This code part follows the C++14 standard. Compile with g++ version 8.3.0 or later.
To compile all the filters available, please enter the following:
cmake .
make -j4To compile a specific filter:
cmake . -DFILTER=FILTER_NAME
make -j4You can choose a filter from this list
You can also set a filter list:
cmake . -DFILTER="FILTER_NAME1;FILTER_NAME2"
make -j4Don't forget to unset the FILTER variable if you want to compile all the filters available afterwards:
cmake . -UFILTER
make -j4The compiled filter will be named darwin_filter_name (note: the name is displayed at the beginning of the compilation).
You will find compilation and dependencies information for each filters in the Wiki.
Usage
Usage: ./darwin [-h] [-l [DEBUG|INFO|WARNING|ERROR|CRITICAL]] filter_name socket_path config_file monitoring_socket_path pid_file output next_filter_socket_path nb_thread cache_size threshold
Positional arguments:
filter_nameSpecify the name of this filter in the logssocket_pathSpecify the path to the unix socket for the main connectionconfig_fileSpecify the path to the configuration filemonitoring_socket_pathSpecify the path to the monitoring unix socketpid_fileSpecify the path to the file containing the pid of the processoutputSpecify the filter's outputnext_filter_socket_pathSpecify the path to the next filter unix socketnb_threadInteger specifying the number of treatment thread for this processcache_sizeInteger specifying cache's sizethresholdInteger specifying the filter's threshold (if behind 100, take the filter's default threshold)
OPTIONS:
-hShow help and exit-l [DEBUG|INFO|WARNING|ERROR|CRITICAL|DEVELOPER]Set log level to DEBUG, INFO, WARNING (default), ERROR, CRITICAL or DEVELOPER. DEVELOPER mode does not create a daemon and log level is DEBUG.
Filter Manager
Python Version
Compatible with python 3.5.3 and later.
Usage
Usage: manager.py [-h] [-l {DEBUG,INFO,WARNING,ERROR,CRITICAL}] config_file
Positional arguments:
config_file The config file to use.
Optional arguments:
-h, --help show this help message and exit
-l {DEBUG,INFO,WARNING,ERROR,CRITICAL}, --log-level {DEBUG,INFO,WARNING,ERROR,CRITICAL}
Set log level to DEBUG, INFO, WARNING (default), ERROR or CRITICAL.
Config File
The config file is JSON formatted and contains the filters information. They MUST be formatted as follow:
{
"session_1": {
"exec_path": "/home/darwin/filters/darwin_session",
"config_file": "/var/sockets/redis/redis.sock",
"output": "LOG",
"next_filter": "",
"nb_thread": 5,
"threshold": 80,
"log_level": "DEBUG",
"cache_size": 0
},
"dga_1": {
"exec_path": "/home/darwin/filters/darwin_dga",
"config_file": "/home/darwin/conf/fdga/fdga.conf",
"output": "LOG",
"next_filter": "",
"nb_thread": 5,
"log_level": "DEBUG",
"cache_size": 0
}
}You will find more information in the Wiki
The Service
In the service directory is a rc script named darwin that is
the service script. It handles the following commands: start, stop,
status and restart.
Usage
Use this for debug purpose only.
Usage: manager.py [-h] [-l {DEBUG,INFO,WARNING,ERROR,CRITICAL}] config_file
Positional arguments:
config_file The config file to use.
Optional arguments:
-h, --help show this help message and exit
-l {DEBUG,INFO,WARNING,ERROR,CRITICAL}, --log-level {DEBUG,INFO,WARNING,ERROR,CRITICAL}
Set log level to DEBUG, INFO, WARNING (default), ERROR or CRITICAL.