stamparm/maltrail
Maltrail
Maltrail is a malicious traffic detection system used for network intrusion detection. It consists of a network intrusion sensor for monitoring interfaces, a threat intelligence aggregator for syncing blacklists, and a detection engine that identifies security threats through signature matching and heuristic attack patterns.
The system distinguishes itself through a distributed sensor architecture that collects traffic data from multiple remote probes and forwards events to a central analysis server. It employs heuristic behavioral analysis to identify unknown threats, such as port scanning or excessive DNS failures, and provides an IP reputation firewall integrator to export attacker source addresses for automated blocking in external tools.
The platform includes a web-based management interface for visualizing threat timelines and analyzing security event logs. It supports the aggregation of threat intelligence from external feeds and custom lists, while providing access control mechanisms to restrict log visibility based on user permissions or network masks.
Features
- Network Intrusion Detection - Monitors network traffic in real time to identify and log malicious activity based on known attack signatures.
- Distributed Capture Probes - Collects traffic data from multiple remote capture probes and forwards events to a single central analysis server.
- Behavioral Threat Detection - Detects suspicious activity like port scanning or DNS failures by analyzing traffic patterns instead of static blacklists.
- IP Blacklisting - Identifies attack patterns by matching network traffic against blacklists of known malicious IP addresses.
- Anomaly-Based Threat Identification - Spots unknown threats such as excessive DNS failures and unusually long domain names using heuristic mechanisms.
- Heuristic Behavioral Detection - Identifies suspicious behavior such as port scanning and direct executable downloads that bypass static blacklists.
- Threat Intelligence Aggregation - Aggregates external blacklists and custom threat feeds to identify known malicious IP addresses and domains.
- Threat Intelligence Synchronizers - Syncs external blacklists and custom threat feeds to automatically identify known malicious IP addresses and domains.
- Traffic Filtering Systems - Identifies security threats by matching network traffic against blacklists and heuristic attack patterns.
- Traffic Signature Matching - Identifies malicious traffic by comparing network packets and domain names against a database of regular expression patterns.
- Centralized Logging Systems - Stores security events from distributed sensors in a unified database for centralized analysis.
- Distributed Security Event Aggregation - Collects security event details from multiple distributed sensors and stores them in one central server.
- Network Traffic Analysis - Visualizes security events through web interfaces and charts to examine the frequency and type of network attacks.
- Sensor Network Coordination - Collects security event data from multiple network sensors into one central server for unified analysis.
- Threat Log Exports - Sends detected threat logs to external monitoring systems using standardized formats like CEF or JSON via Syslog or Logstash.
- Packet Capture Filters - Monitors network interfaces using specific capture filters to identify and log suspicious traffic patterns.
- Automated IP Banning - Exports lists of detected attacker addresses to external firewall tools for automated traffic blocking.
- Firewall Management - Exports filtered lists of attacker source IPs for integration with external blocking tools and firewalls.
- Security Analysis Dashboards - Provides a web interface for visualizing security events, analyzing attacker behavior, and monitoring real-time threat logs.
- Custom Threat List Management - Allows uploading personal lists of malicious trails to supplement standard blacklists and improve detection accuracy.
- Threat Timeline Visualizations - Implements a web interface with timelines and charts to analyze the frequency and type of detected threats.
- Event Export Plugins - Sends detected threat logs to external systems using standardized formats like CEF or JSON via Syslog and Logstash.
- Network Traffic Analyzers - Analyzes real-time network traffic patterns against known attack signatures to identify and log security threats.
- Security Event Monitoring - Provides a web-based interface for examining detailed logs of malicious activity and security attacks.
- Threat Monitoring Dashboards - Ships a web-based management interface for visualizing detected threats and monitoring current system status.
- Web-Based Dashboards - Provides a browser-based dashboard for visualizing threat timelines and managing blacklist synchronization.
- Security Lab Environments - Malicious traffic detection system using public blacklists.
- Systems And Services - Listed in the “Systems And Services” section of the The Book Of Secret Knowledge awesome list.
- Detection And Monitoring - Detects malicious network traffic using public threat lists.
- Malware Analysis - A malicious traffic detection system.
- Network Analysis - Detects malicious traffic using blacklists and behavioral analysis.
- Network Security Monitoring - Detects malicious network traffic using blacklists and behavioral analysis.
- Security And Forensics - Malicious traffic detection system with web monitoring.
