Linking kippo attackers with graphs

AttackerGraphs.py

#!/usr/bin/env python3
"""
This is a program to link attackers together. I have designed it to create a
graph from a CSV file containing information from kippo honeypots. The
fields in the CSV can be customized but mine are:

"src_ip","client_country","client_city",username,password,url,filehost,filename,shasum,session,"_time"

These are all available from the version of Kippo available at
https://github.com/micheloosterhof/kippo. I am using splunk to create this
CSV but anything will do.

Next the links are defined in the JSON file links.json that should be included.
There the links can also be customized. An example of a link one might add
would look like:

{
    "src": {
        "dataType": "attacker",
        "field": "src_ip"
    },
    "dst": {
        "dataType": "geolocation",
        "field": "client_city"
    }
}

This links the attacker to a city. I am using Max Mind geoip database for this
information.

Example usage:

./AttackerGraphs.py -f downloads.csv -l links.json
"""


import csv
import argparse
import json


class Graph:
    def __init__(self):
        self.nodes = []
        self.groups = []

    def add_link(self, src, dst):
        srcNode = self.Node(src[0], src[1])
        dstNode = self.Node(dst[0], dst[1])
        src = self._addNode(srcNode)
        dst = self._addNode(dstNode)

        src.addEdge(dst)
        dst.addEdge(src)

    def showGraph(self):
        start = self.nodes[0]
        self.DFS(start)

    def DFS(self, graph=None):
        if graph is None:
            graph = self.nodes
        visited = []
        start = graph.pop()
        # Look for the first unvisited vertex
        while start.visited and len(graph) > 0:
            start = graph.pop()
        stack = [start]
        while stack:
            vertex = stack.pop()
            if not vertex.visited:
                vertex.visited = True
                visited.append(vertex)
                for i in vertex.neighbors:
                    if i not in stack:
                        stack.append(i)
        if len(visited) > 0:
            self.groups.append(visited)
        if len(graph) > 0:
            self.DFS(graph)

    def showGroups(self):
        groupNum = 0
        for group in self.groups:
            print("Group:", groupNum)
            for node in group:
                print(node)
            print()
            groupNum += 1

    def output(self, output):
        groupNum = 0
        for group in self.groups:
            print("Group:", groupNum)
            for node in self._organizeGroup(group, output):
                print(node)
            print()
            groupNum += 1

    def _addNode(self, node):
        for i in range(len(self.nodes)):
            if self.nodes[i] == node:
                return self.nodes[i]
        self.nodes.append(node)
        return self.nodes[-1]

    def _organizeGroup(self, group, output):
        types = {}
        newGroup = []
        for each in group:
            try:
                types[each.dataType].append(each)
            except KeyError:
                types[each.dataType] = [each]
        for each in output:
            newGroup += types[each]
        return newGroup

    class Node:
        def __init__(self, dataType, data):
            self.data = data
            self.dataType = dataType
            self.neighbors = []
            self.visited = False

        def addEdge(self, node):
            if node not in self.neighbors:
                self.neighbors.append(node)

        def __eq__(self, other):
            if type(other) == type(self):
                if other.data == self.data and other.dataType == self.dataType:
                    return True
            return False

        def __ne__(self, other):
            if type(other) != type(self):
                if other.data != self.source or \
                   other.dataType != self.dataType:
                    return True
            return False

        def __str__(self):
            return "%s <%s>" % (self.data, self.dataType)

        def __repr__(self):
            return self.__str__()


def main():
    parser = argparse.ArgumentParser(description="Process kippo filedownloads to find groups of attackers")
    parser.add_argument('-f', '--file', type=argparse.FileType('r'),
                        required=True, help="csvfile to parse")
    parser.add_argument('-c', '--config', type=argparse.FileType('r'),
                        default="config.json", help="Configuration file")
    args = parser.parse_args()

    config = json.load(args.config)

    links = []
    for l in config["links"]:
        links.append(((l["src"]["dataType"], l["src"]["field"]),
                     (l["dst"]["dataType"], l["dst"]["field"])))

    positions = {}
    graph = Graph()
    downloads = csv.reader(args.file, delimiter=",", quotechar="\"")
    header = next(downloads)
    for i in range(len(header)):
        positions[header[i]] = i

    for row in downloads:
        for link in links:
            src = (
                link[0][0],
                row[positions[link[0][1]]]
            )
            dst = (
                link[1][0],
                row[positions[link[1][1]]]
            )
            graph.add_link(src, dst)

    graph.DFS()
    graph.output(config["output-elements"])

main()

config.json

{
    "links": [
        {
            "src": {
                "dataType": "attacker",
                "field": "src_ip"
            },
            "dst": {
                "dataType": "filehost",
                "field": "filehost"
            }
        },
        {
            "src": {
                "dataType": "filehost",
                "field": "filehost"
            },
            "dst": {
                "dataType": "filename",
                "field": "filename"
            }
        },
        {
        	"src": {
        		"dataType": "filename",
        		"field": "filename"
        	},
        	"dst": {
        		"dataType": "url",
        		"field": "url"
        	}
        },
        {
            "src": {
                "dataType": "filename",
                "field": "filename"
            },
            "dst": {
                "dataType": "shasum",
                "field": "shasum"
            }
        }
    ],
    "output-elements": [
    	"attacker",
    	"url",
    	"filehost"
    ]
}

downloads.csv