Method get_summary

traffic_analyzer.py:1584–1627

Get traffic analysis summary with security-focused metrics

(self)

                    'nick': session.nick,
                    'user': session.user,
                    'channels': sorted(session.channels),
                    'server_port': session.server_port,
                    'server_banner': session.server_banner[:3],
                    'mitre': ['T1071.001', 'T1102'],
                },
            )

    def get_tls_fingerprints(self, limit: int = 100) -> List[Dict[str, Any]]:
        if self._ja3_collector is None:
            return []
        return self._ja3_collector.get_records(limit=limit)

    def get_irc_sessions(self, limit: int = 50) -> List[Dict[str, Any]]:
        if self._irc_parser is None:
            return []
        return self._irc_parser.get_sessions(limit=limit)

    def _check_dns_tunneling(self, src_ip: str):
        """Detect potential DNS tunneling based on query frequency"""
        current_time = time.time()

        # Track this query timestamp
        self._dns_query_times[src_ip].append(current_time)

        # Count queries in the tracking window
        window_start = current_time - self.DNS_QUERY_TRACKING_WINDOW
        recent_queries = sum(1 for t in self._dns_query_times[src_ip] if t > window_start)

        if recent_queries > self.DNS_TUNNEL_THRESHOLD:
            self._create_alert(
                level=TrafficAlertLevel.HIGH,
                category=AlertCategory.DNS_TUNNELING.value,
                message=f"Potential DNS tunneling: {src_ip} made {recent_queries} queries in {self.DNS_QUERY_TRACKING_WINDOW}s",
                src_ip=src_ip,
                details={
                    'queries_per_minute': recent_queries,
                    'threshold': self.DNS_TUNNEL_THRESHOLD,
                    'window_seconds': self.DNS_QUERY_TRACKING_WINDOW
                }
            )
    
    def _create_alert(self, level: TrafficAlertLevel, category: str,
                      message: str, src_ip: str = None, dst_ip: str = None,
                      details: Dict = None, dedup_key: str = None):
        """Create a traffic alert with rate limiting and deduplication.

        dedup_key: optional override for the dedup hash. Use when the default