diff options
| author | Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> | 2023-07-26 09:09:12 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-07-26 09:09:12 +0200 |
| commit | 3326fa258ec92e553e39fc8a1bfa3921dc81f15c (patch) | |
| tree | fcd0e725b7b5a8d13db1654a9b0864651c642f00 /src/lib/ndpi_utils.c | |
| parent | 2b230e28e0612e8654ad617534deb9aaaabd51b7 (diff) | |
Add an heuristic to detect fully encrypted flows (#2058)
A fully encrypted session is a flow where every bytes of the
payload is encrypted in an attempt to “look like nothing”.
The heuristic needs only the very first packet of the flow.
See: https://www.usenix.org/system/files/sec23fall-prepub-234-wu-mingshi.pdf
A basic, but generic, inplementation of the popcpunt alg has been added
Diffstat (limited to 'src/lib/ndpi_utils.c')
| -rw-r--r-- | src/lib/ndpi_utils.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/lib/ndpi_utils.c b/src/lib/ndpi_utils.c index 5f334081b..35c0410e2 100644 --- a/src/lib/ndpi_utils.c +++ b/src/lib/ndpi_utils.c @@ -2045,6 +2045,9 @@ const char* ndpi_risk2str(ndpi_risk_enum risk) { case NDPI_TCP_ISSUES: return("TCP Connection Issues"); + case NDPI_FULLY_ENCRYPTED: + return("Fully encrypted flow"); + default: ndpi_snprintf(buf, sizeof(buf), "%d", (int)risk); return(buf); |