AnTagOnIst (Anomaly Tagging On hIstorical data) is a tool that supports the visual analysis and the tagging of anomalies on telemetry data. This is done by providing a user-friendly interface to "Tag" anomalous data on multiple telemetry metrics and produce some metadata reflecting the semantic of those anomalies.
In the context of this project, an anomaly is considered to be any event that could potentially be of concern in the execution of network services. A network anomaly is a collection of symptoms
Different data sources can be used to demonstrate or run the project. An example data set is provided here (instructions on how to set it up are provided below). This is based on some open source data available on the web related to network monitoring. This data is stored on InfluxDB and can be tagged using Grafana (see instructions below). InfluxDB and Grafana are currently provided as example: the system can integrate with any timeseries data and graphical tool, as it provides an abstract API.
The main API is based on 2 IETF drafts:
- https://datatracker.ietf.org/doc/draft-netana-nmop-network-anomaly-semantics/
- https://datatracker.ietf.org/doc/draft-netana-nmop-network-anomaly-lifecycle/
The easiest way to get this running is by using Docker. The following instructions are assuming you have Docker already installed on your system.
The preparation step requires the building of the docker image, by running the following instructions:
cd antagonist
docker_build -t antagonist:latest .
A docker compose file is provided as part of the project (under the docker directory). That docker compose will spin up 4 containers: grafana, influxDB, antagonist, postgres.
After deploying the containers, you will need to add the data to InfluxDB. This can be done by using the provided script to load up the data (script provided in the scripts directory).
cd scripts/data_load
python -m pip install -r requirements.txt
python influxdb_load_data.py
If you want to use that script to load up the data, data file is avaialable here: https://github.com/cisco-ie/telemetry/blob/master/2/bgpclear.csv.zip
(But it should be relatively easy to work with different data).
The GUI (Graphic User Interface) is based on Grafana (https://github.com/grafana/grafana), an open source software used for data visualization. The system relies on a Grafana native functionality called "Annotations", which allows the user to add annotations to timeseries data. These annotations are then queried using the Grafana REST API and enriched through the information added in the GUI by the user.
Two pre-defined Grafana dashboards have to be load up on the system, which are located in docker/grafana/provisioning/dashboads/
They can be imported in Grafana, following the standard import procedure.
The User of this project is solely responsible for the misuse or unlawful use of this software and Content. Authors disclaim any responsibility for harm, loss, or damage resulting from such misuse. This includes but is not limited to unlawful activities, data loss, or adverse effects of any kind. Hacking and cybersecurity laws vary by jurisdiction. By engaging with this project, you agree to take full responsibility for your actions.