Flare is a Python-based analytical framework designed to detect malicious network behavior through traffic and behavioral analytics.
An analytical framework for network traffic and behavioral analytics
Flare is primarily used by data scientists, security researchers, and network professionals to monitor network traffic, detect intrusion attempts, and hunt for threats by identifying patterns such as beaconing and command and control activity. It simplifies the process of behavioral analytics and integrates with tools like Suricata and Elasticsearch for enhanced network security monitoring.
Flare requires Python 2.7 or 3 and integration with Elasticsearch and/or Suricata for full functionality. Users should forward port 9200 for Elasticsearch access if remote. Using configuration files for command line execution is recommended for ease of use and reproducibility.
Ensure Python 2.7 or Python 3 is installed
Run sudo pip install -r requirements.txt to install dependencies
Run python setup.py install to install Flareflare_beacon -c /path/to/flare/config/elasticsearch.ini --focus_outbound --whois flare_beacon -json /tmp/flare.json
Run Flare beaconing detection using a configuration file with outbound focus and WHOIS lookup, outputting results in JSON format.
flare_beacon --whois --focus_outbound -mo=100 --csv_out=beacon_results.csv
Generate beaconing detection results with WHOIS lookup and outbound focus, outputting as a CSV file.
flare_beacon --group --whois --focus_outbound -c configs/elasticsearch.ini -html beacons.html
Run grouped beaconing analysis with WHOIS and outbound focus, outputting results in an HTML report.
from flare.analytics.command_control import elasticBeacon eb = elasticBeacon(es_host='localhost') beacons = eb.find_beacons(group=True, focus_outbound=True)
Python code snippet to connect to Elasticsearch and identify periodic beaconing activity programmatically.
from flare.tools.alexa import Alexa alexa = Alexa(limit=1000000) print alexa.domain_in_alexa('google.com')
Check if a domain is in the Alexa top domains list.
from flare.tools.whoisip import WhoisLookup whois = WhoisLookup() whois.get_name_by_ip('8.8.8.8')
Perform WHOIS lookup to identify the owner of a public IP address.
from flare.data_science.features import dga_classifier dga_c = dga_classifier() print dga_c.predict('facebook')
Use a pre-built classifier to predict if a domain is legitimate or generated by a domain generation algorithm (DGA).