merge branch devel into master

Author: sdemircan

README

@@ -0,0 +1,60 @@
+=====================================================================================
+NfQuery : NfQuery: A Privacy Friendly Framework for Multi-Domain Threat Analysis  
+=====================================================================================
+
+.. contents::
+..
+    1  What is NfQuery Framework
+      1.1  Components 
+    2  Dependencies
+    3  Documentation
+    4  Download
+    5  Copyright and License
+    6  Author
+
+
+What is it?
+===============
+The main function of NfQuery is creating useful queries to be used in the NfSen Plug-ins of each organization or domain registered to the Query Server (QS). Queries are fetched from QS and executed by Plug-ins on the aggregated NetFlow data of organizations. As a result of these executions, NfSen Plug-in find the flow data which includes the related threat or attack information. After the detection, Plug-in alerts the QS automatically regarding the findings of the applied query.
+By collecting and interpreting attack statistics from each Plug-in, NfQuery creates a general overview of the threat trends seen in the multi-domain network. Finally, by utilizing the alerting system of NfSen, NfQuery becomes a threat detection and security alerting system for multi-domain networks.
+
+Components
+---------------
+a. Query Server (QS)
+Query Server (QS) is placed in the center of the system and establishes the connection between all components. QS is composed of three sub-elements; Query Manager (QM), Query Generator (QG) and Query Repository (QR). 
+
+b. NfQuery Plug-in
+The NfQuery Plug-in is installed at each domain side over the NfSen instance at the domain and communicates with QS to perform the administrator’s requests such as fetching new queries, updating query list, getting/sending statistical reports and executing the queries over the flow data. 
+
+c. Sources
+NfQuery sources are the main components that provide threat information. This includes publicly available resources such as Botnet C&C server lists (Amada SpyEye), DNS blacklists (DShield), malicious domains and phishing sites lists or output of security analysis applications such as Honeypots, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS) or Firewalls which may provide data in means of log files for private use in NfQuery framework.
+
+
+Dependencies
+============
+Please see the file called plugin/INSTALL for plugin dependecies.
+Please see the file called queryserver/INSTALL for queryserver dependecies.
+
+The Latest Version
+------------------
+Details of the latest version can be found on the Official NfQuery Web Page.
+http://nfquery.ulakbim.gov.tr
+
+Documentation
+-------------
+Please see http://nfquery.ulakbim.gov.tr/
+
+Installation
+------------
+Please see the file called plugin/INSTALL to install plugin.
+Please see the file called queryserver/INSTALL to install queryserver.
+
+Licensing
+---------
+Please see the file called LICENSE.
+
+Author
+======
+Serdar Yigit <serdar.yigit@tubitak.gov.tr>
+Ahmet Can Kepenek <ahmetcan.kepenek@gmail.com>
+Serhat Rifat Demircan <demircan.serhat@gmail.com>

README.md

@@ -0,0 +1,56 @@
+=======================================
+== Required Perl Modules For Backend ==
+=======================================
+
+    -LWP::UserAgent
+    -JSON::RPC::LWP
+    -Term::ANSIColor
+    -JSON
+    -JSON::Parse 'json_to_perl'
+    -NetAddr::IP
+    -Net::SSL ()
+    -Parallel::ForkManager
+    -NfConf
+    -DBM::Deep
+    
+    You can run the Perl CPAN module via command line perl 
+    and get it installed in a single line:
+
+    perl -MCPAN -e 'install Module::Name'  
+
+====================
+== Install Plugin ==
+====================
+    NfQuery Plug-in is an NfSen plugin. You need a working 
+    NfSen instance. NfQuery plug-in has been tested on 
+    Nfsen 1.3.6p1, Perl v5.14.2 and Php 5.3.10.
+
+    After required perl modules are installed run:
+
+    ./install.sh 
+    
+    This script copy backend and frontend files to their
+    locations(according to your nfsen directory layout).
+    
+    After files installed, you need to enable and set backend 
+    configuration parameters in Nfsen configuration file.
+
+    Configuration parameters are:
+
+    nfquery => {
+        #Make sure nfsen have write permission to this directory.
+        output_dir => '/tmp', 
+
+        # Certificates
+        https_ca_file => 'root certificate file'
+        https_ca_dir => 'root certificate directory'
+        https_pkcs12_file => 'plugins pkcs12 file'
+        https_pkcs12_password => 'password',
+
+        # Ip Address Of This Plugin             
+        plugin_ip => 'a.b.c.d',
+
+        # Query Server Information
+        queryserver_ip => 'a.b.c.d/e',
+        queryserver_port => 'a',
+    }