chiron-elk: Chiron Home Based ML Intrusion Detection System
CHIRON is a home analytics based on ELK stack combined with Machine Learning threat detection framework AKTAION. CHIRON parses and displays data from P0f, Nmap, and BRO IDS. CHIRON is designed for home use and will give great visibility to home internet devices (IoT, Computers, Cellphones, Tablets, etc).
Once you export the .ova or extract the zip, make sure you have an interface bridged to your network and CHIRON will do the rest. Browse to KIBANA http://chironip:5601 click on dashboard or visualizations and you should be able to get a great deal of info on whats going on at your home network.
It can be quite surprising to see how many services, ports and outbound connections to rare destinations home devices make. CHIRON is not designed for enterprise and its current form is not scalable, there are other things like JASK Trident (www.jask.ai) that scale to enterprise traffic loads. CHIRON is also configured to do its tasks automatically including maintenance. We have included a basic troubleshooting guide in case ELK fails which is common, unfortunately.
CHIRON is integrated with AKTAION which detects exploit delivery ransomware/phishing. Aktaion will run every 4 hours against bro logs and it has a benign training data set that it compares against environment dataset, once AKTAION finishes it produces files with exploit micro behaviors that can be seen in visualization by going into the visualization menu and selecting them. We expect to add support to the following protocols in the future
Copyright 2017 jzadeh
