RITA

RITA is an open source framework for network traffic analysis.

The framework processes Bro logs, and currently supports the following analysis features:

• Beaconing Detection: Search for signs of beaconing behavior in and out of your network
• DNS Tunneling Detection Search for signs of DNS based covert channels
• Blacklist Checking: Query blacklists to search for suspicious domains and hosts
• URL Length Analysis: Search for lengthy URLs indicative of malware
• Scanning Detection: Search for signs of port scans in your network

https://github.com/activecm/rita