ntop/nDPI

Improve Data Exfiltration

lucaderi opened this issue · 1 comments

lucaderi commented

Using https://github.com/m57/dnsteal the following traffic is generated and better flow risks shall be generated

dnsteal.pcap.zip

utoni commented

What flow risks would you prefer?

For now all 5 flows get already two relevant flow risks:

Risk stats [found 5 (100.0 %) flows with risks]:
	Susp DNS Traffic                             5 [33.3 %]
	Non-Printable/Invalid Chars Detected         5 [33.3 %]
	Minor Issues                                 5 [33.3 %]