/src/ntopng/include/flow_checks/FlowRiskDNSSuspiciousTraffic.h
Line | Count | Source |
1 | | /* |
2 | | * |
3 | | * (C) 2013-24 - ntop.org |
4 | | * |
5 | | * |
6 | | * This program is free software; you can redistribute it and/or modify |
7 | | * it under the terms of the GNU General Public License as published by |
8 | | * the Free Software Foundation; either version 3 of the License, or |
9 | | * (at your option) any later version. |
10 | | * |
11 | | * This program is distributed in the hope that it will be useful, |
12 | | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
13 | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
14 | | * GNU General Public License for more details. |
15 | | * |
16 | | * You should have received a copy of the GNU General Public License |
17 | | * along with this program; if not, write to the Free Software Foundation, |
18 | | * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. |
19 | | * |
20 | | */ |
21 | | |
22 | | #ifndef _FLOW_RISK_NDPI_DNS_SUSPICIOUS_TRAFFIC_H_ |
23 | | #define _FLOW_RISK_NDPI_DNS_SUSPICIOUS_TRAFFIC_H_ |
24 | | |
25 | | #include "ntop_includes.h" |
26 | | |
27 | | class FlowRiskDNSSuspiciousTraffic : public FlowRisk { |
28 | | private: |
29 | 0 | FlowAlertType getAlertType() const { |
30 | 0 | return FlowRiskDNSSuspiciousTrafficAlert::getClassType(); |
31 | 0 | }; |
32 | | |
33 | | public: |
34 | 0 | FlowRiskDNSSuspiciousTraffic() : FlowRisk() {}; |
35 | 0 | ~FlowRiskDNSSuspiciousTraffic() {}; |
36 | | |
37 | 0 | FlowAlert* buildAlert(Flow* f) { |
38 | 0 | FlowRiskDNSSuspiciousTrafficAlert* alert = |
39 | 0 | new FlowRiskDNSSuspiciousTrafficAlert(this, f); |
40 | | |
41 | | /* The client is assuming to be probing the victim DNS server with |
42 | | * suspicious DNS traffic */ |
43 | 0 | alert->setCliAttacker(), alert->setSrvVictim(); |
44 | |
|
45 | 0 | return alert; |
46 | 0 | } |
47 | | |
48 | 0 | std::string getName() const { |
49 | 0 | return (FlowRiskAlerts::getCheckName( |
50 | 0 | FlowRiskDNSSuspiciousTrafficAlert::getClassRisk())); |
51 | 0 | } |
52 | 0 | ndpi_risk_enum handledRisk() { |
53 | 0 | return FlowRiskDNSSuspiciousTrafficAlert::getClassRisk(); |
54 | 0 | }; |
55 | | }; |
56 | | |
57 | | #endif |