Skip to content

Instantly share code, notes, and snippets.

@jayjacobs
jayjacobs / marxvideo.R
Last active August 29, 2015 13:59
Creating a Video from Marx data at datadrivensecurity.info
# which weeks should we look at?
whichweek <- c(27, 28, 29, 30)
# how many countries to show?
numcountry <- 25 # 20 at first
# read in marx "geo" data available from
# http://datadrivensecurity.info/blog/pages/dds-dataset-collection.html
marx <- read.csv("marx-geo.csv")
# convert datetime to POSIX date/time object
marx$datetime <- strptime(marx$datetime, format='%Y-%m-%d %H:%M:%S')
# this function is the result of heirarchical clustering.
# once we identified the clustered patterns, we found the most
# prominant collection of variables to identify that pattern.
getpatternlist <- function(vz, mat) {
skimmer <- mat[ ,"attribute.confidentiality.data.variety.Payment"]==1 &
mat[ ,"action.physical.variety.Tampering"]==1
espionage <- (mat[, "actor.external.motive.Espionage"]==1 |
mat[ ,"actor.external.variety.State-affiliated"]==1) &
as.vector(getfilter(vz, list("attribute"="confidentiality")))
pos <- (mat[ , "asset.assets.variety.S - POS controller"]==1 |
# which weeks should we look at?
whichweek <- c(27, 28, 29, 30)
# how many countries to show?
numcountry <- 25 # 20 at first
# read in marx data
marx <- read.csv("marx-geo.csv")
# convert datetime to POSIX date/time object
marx$datetime <- strptime(marx$datetime, format='%Y-%m-%d %H:%M:%S')
# drop any weird date formats
@jayjacobs
jayjacobs / marxvideo-ports.R
Created June 15, 2014 17:02
Creating a Video on the TCP/UDP ports in Marx data
# which weeks should we look at?
whichweek <- c(27, 28, 29, 30)
# how many countries to show?
numcountry <- 25 # 20 at first
# read in marx data
marx <- read.csv("marx-geo.csv") # get from dds.ec
@jayjacobs
jayjacobs / bday.R
Last active August 29, 2015 14:11
# adapted from @hrbrmstr code
library(plotrix)
pie3D(c(34), start=pi/2, height=0.4, main="Happy Birthday!", col="chocolate")
lines(c(0, 0), c(0.4, 0.9), lwd=10, col="pink")
lines(c(-0.4, -0.4), c(0.5, 0.9), lwd=10, col="pink")
lines(c(0.4, 0.4), c(0.5, 0.9), lwd=10, col="pink")
points(c(0, 0.4, -0.4), c(0.9, 0.95, 0.95), pch=8, cex=1.5, col="red", lwd=8)
@jayjacobs
jayjacobs / prep-action-industry.R
Created January 10, 2014 03:53
R code to extract the top 10 industries and top 10 threat actions in those industries. Output is in a CSV format and displayed at http://datadrivensecurity.info/blog/posts/2014/Jan/top10-threat-actions/
# verisr is available at https://github.com/jayjacobs/verisr
library(verisr)
library(Hmisc) # for capitalize
# director with VCDB incidents in JSON format
vcdb <- json2veris("github/vcdb")
mat <- veris2matrix(vcdb, unknown=T)
nmat <- colnames(mat)
data(industry2)
ind <- getenum(vcdb, "victim.industry2")
ind <- merge(ind, industry2, all.x=T, by.x="enum", by.y="code")
library(ggplot2)
x <- seq(2,6,0.05)
toplot <- data.frame(x=x, y=dnorm(x, mean=4, sd=0.5))
gg <- ggplot(toplot, aes(x,y)) +
geom_polygon(fill="lightsteelblue", color="steelblue") +
geom_segment(data=data.frame(x=4, xend=4, y=0, yend=0.82),
aes(x, xend=xend, y=y, yend=yend),
color="steelblue4", size=1) +
geom_text(data=data.frame(x=1.7, y=0.1,txt="2+2="), aes(x,y,label=txt),
@jayjacobs
jayjacobs / publicsuffixtest.R
Last active July 31, 2016 21:55
getting public suffix list tests.
connection <- url("https://raw.githubusercontent.com/publicsuffix/list/master/tests/test_psl.txt", method = "libcurl")
results <- readLines(connection)
close(connection)
justtests <- grep('checkPublicSuffix\\(', results, value = TRUE)
alltests <- do.call(rbind, lapply(strsplit(justtests, "'", fixed = TRUE), function(line) {
data.frame(domain=line[2], result=line[4])
}))
domains <- suffix_extract(alltests$domain)
rez1 <-ifelse(!is.na(domains$domain), paste0(domains$domain, "."), "")
rez <- ifelse(!is.na(domains$suffix), paste0(rez1, domains$suffix), NA)

Keybase proof

I hereby claim:

  • I am jayjacobs on github.
  • I am jayjacobs (https://keybase.io/jayjacobs) on keybase.
  • I have a public key ASDRhf1s3d2diy4DmicmkCgfu3NLLrEYD-85Gshxpx0FKQo

To claim this, I am signing this object: