Project BAIU

The most powerful, extensible, customizable, TRUE DDoS, and TRUE Distributed Brute Force Prevention tool since 2012 (compare it, I dare you :D ) and now it handles all ports and protocols, not just HTTP/S!

Get It!

DOWNLOADS

Download Project BAIU and get it running on your F5s today!

BAIU will actively monitor, and/or restrict the ability of network based entities, both human and automated software, accessing certain aspects of a hosted site that is viewable on the internet over periods of hours, to days, to weeks, to months with multiple, user-defined, variable control methods for restriction, event triggers, multiple methods of counting IP and/or UserID access, and multiple variable, user-defined timing controls that set independent timing constraints for monitoring and restricting IP/UserID access. It is capable of monitoring and restricting via a static and dynamically distributed model when monitoring and restricting IPs and/or userID/strings. Monitoring and restricting over customizable periods of time (hours, days, weeks, months) significantly reduces the daily chances of attacks. Rather than the "here and now" approach commonly used, BAIU registers, catalogs, analyzes, trends, and considers behavioral characteristics to determine the appropriate reaction. This is the core of the static monitoring and restriction functionality. At this time BAIU only works for the F5 networking appliances as long as the F5 can process iRules which is every appliance they made regardless of licensing. A10 has developed a load balancer/WAF combo that support iRules through conversion and this code is all TCL based so theoretically it can be ported to virtually any system that supports TCL and a database.

Below are the 3 key flavors of Project BAIU. They are as follows:

The HTTP/S (D)DoS Mitigation version focused on Authentication and General Web Security

XXX_010_TIP_BAIU_v2.1

XXX_020_Blacklist_IP_UserAgent_Referer_BAIU

XXX_030_UIDExtractAllSites_AddHeader_BAIUv2.2

XXX_040_Tru_R8L_BAIUv2.1

XXX_050_CnC_BAIU_v2

The TCP (D)DoS Mitigation version that protects TCP based services such as SMTP/S, IMAP/S POP3/S S/FTP, SSH, etc.

XXX_010_TIP_BAIU_DNS_4Ports

XXX_020_Blacklist_DNS_BAIU_4Ports

XXX_030_Extract_DNS_BAIU_4Ports

XXX_040_Tru_R8L_DNS_BAIU_4Ports

XXX_050_CnC_BAIU_v2

The DNS/UDP (D)DoS Mitigation version that protects DNS/UDP based services. It covers UDP in general and the Enhanced Features are for DNS

XXX_010_TIP_BAIU_TCP_4Ports

XXX_020_Blacklist_TCP_BAIU_4Ports

XXX_030_Extract_TCP_BAIU_4Ports

XXX_040_Tru_R8L_TCP_BAIU_4Ports

XXX_050_CnC_BAIU_v2

Shell Scripts for Syncing Tracking and Blocking Stats across multiple F5s:

Fortunately these scripts haven't required any updates since I originally wrote them. The goal was a universal script that will work on any version of F5 and thus far 11 years later, they still work as designed.

Ban List Sync for 1st WAF

Ban List Sync for 2nd WAF

ReqCnt 10min Sync for 1st WAF

ReqCnt 10min Sync for 2nd WAF

ReqCnt_Hourly Sync for 1st WAF

ReqCnt_Hourly Sync for 2nd WAF

Rolling Ban Sync for 1st WAF

Rolling Ban Sync for 2nd WAF

Week Counts Sync for 1st WAF

Week Counts Sync for 2nd WAF

#########################################################################################