{"repo":"deflect-ca/baskerville","free":true,"listed":false,"github":"https://github.com/deflect-ca/baskerville","clone":"git clone https://github.com/deflect-ca/baskerville.git","description":"Security Analytics Engine - Anomaly Detection in Web Traffic","language":"Python","stars":31,"topics":["big-data","machine-learning","spark","python3","isolation-forest","apache-spark","apache-kafka","prometheus","grafana","security-analytics"],"license":null,"category":"analytics","readme_excerpt":"Contents - What is Baskerville - Overview - Technology - Requirements - Useful Definitions - Runtime - Model - Anomaly detector - Request set - Subset - Time bucket - Baskerville Engine - Pipelines: - Raw Logs - Elastic Search - Kafka - Training - Predictions and ML - Installation - Configuration - How to run - Testing - Docs - TODO - Contributing - Contributors What is Baskerville Manual identification and mitigation of (DDoS) attacks on websites is a difficult and time-consuming task with many challenges. This is why Baskerville was created, to identify the attacks directed to Deflect protected websites as they happen and give the infrastructure the time to respond properly. Baskerville is an analytics engine that leverages Machine Learning to distinguish between normal and abnormal web traffic behavior. In short, Baskerville is a Layer 7 (application layer) DDoS attack mitigation tool. The challenges: - Be fast enough to make it count - Be able to adapt to traffic (Apache Spark, Apache Kafka) - Provide actionable info (A prediction and a score for an IP) - Provide reliable predictions (Probation period & feedback) - As with any ML project: not enough labelled data (Using normal-ish data - the anomaly/ novelty detector can accept a small percentage of anomalous data in the dataset) Overview Baskerville is the component of the Deflect analysis engine that is used to decide whether IPs connecting to Deflect hosts are authentic normal connections, or malicious bots. In order t","default_branch":null,"files":null,"tree":[],"storefront":"/r/deflect-ca","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/deflect-ca/baskerville/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}