TrafficEye is a modular analysis and detection tool designed for network traffic, particularly focusing on identifying security threats targeting web applications like SQL injection, XSS, and WebShells. It addresses the need for granular, customizable traffic analysis, offering a robust platform for blue team operations, penetration testing and defense. The tool employs PCAP, log, and replay analysis combined with rule-based detection and AI capabilities.
TrafficEye distinguishes itself with its modular design, allowing users to select and configure modules based on their specific needs. It offers comprehensive support for various log formats and data types, including PCAP, HTTP data, and binary content. The tool's recent improvements include detailed rule management, enhanced performance, and a user-friendly interface. AI-driven analysis and efficient resource management further enhance its capabilities.
- PCAP Analysis: Supports .pcapng files, Burp Suite data, and detailed data extraction.
- Log Analysis: Parses various log formats like Apache, Nginx, and IIS.
- Traffic Replay: Enables replay of raw, text, and binary traffic, including session-based analysis.
- Rule-Based Detection: Utilizes customizable detection rules to identify malicious patterns.
- AI Analysis: Leverages AI for threat detection and data classification.
- Data Extraction: Supports extraction of data from containers, data formats with any data extraction.
- GUI: Offers an intuitive graphical interface for configuration and analysis.
TrafficEye is actively developed with recent releases focusing on performance optimizations, new features, and enhanced detection capabilities. The source code was removed, yet the tool continues to be updated with bug fixes and feature enhancements, demonstrating sustained development. The remaining available modules offer stability. The community support is primarily limited to the development team.
TrafficEye empowers security professionals to proactively identify and respond to network threats. It benefits penetration testers seeking to validate application security, blue teams conducting threat hunting, and network administrators monitoring for malicious activity. Its modularity and comprehensive features offer a valuable alternative to manual log analysis and limited security monitoring solutions. It supports dynamic updates to detection rules, adapting to new attack vectors.