Yuping Li xia0pin9
xia0pin9
/ gist:8a44c9483c2fe0adae66
Created
March 13, 2015 02:09
Malware clustering analysis tool with fuzzy hashing algorithms as plugins
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # -*- coding: utf-8 -*- | |
| """malcluster: malware clustering analysis tool""" | |
| __version__ = "0.1.0" | |
| import os | |
| import sys | |
| import time | |
| import timeit |
xia0pin9
/ Pcapmatric
Last active
December 16, 2015 18:30
A sample program for extracting network flow characters (package length, response interval, ports information, etc) from pcap files, which can later be used for machine learning and statistic analysis.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/env python | |
| """ | |
| This script can take a pcap format network flow data file and extrate all the contained network flow information, such as data length, request frequence, request interval, etc. | |
| """ | |
| import getopt, sys, os | |
| import dpkt | |
| import socket, hashlib, getopt |
xia0pin9
/ NIST project
Created
April 28, 2013 22:08
Convert Dr. Simon OU's original version of attack graph (VERTICS, ARCS) to a attack graph check table (via dictionary structure), which is more readable and easy to use by other program.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/env python | |
| import sys,getopt | |
| import parse | |
| def usage(): | |
| print """ | |
| python %s -a <arcsfile> -v <verticesfile> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| // Macro pattern definition | |
| var pattern1 = /@DRAW\sPIECHART\sWITH\sOPTIONS\s(\w+)\sFROM\sDATA\s(\w+)\sAT\s\#(\w+)/gm; | |
| var pattern2 = /@DRAW\sCOLUMNCHART\sWITH\sOPTIONS\s(\w+)\sFROM\sDATA\s(\w+)\sAT\s\#(\w+)/gm; | |
| var pattern3 = /@CREATE\sTABLE\sWITH\s(\w+)\sAT\s\#(\w+)/gm; | |
| var pattern4 = /@CREATE\sFORM\sWITH\s(\w+)\sAT\s\#(\w+)/gm; | |
| var pattern5 = /@DRAW\sSPLINECHART\sWITH\sOPTIONS\s(\w+)\sFROM\sDATA\s(\w+)\,\s(\w+)\sAT\s\#(\w+)/gm; | |
| var pattern6 = /@DRAW\sLINECHART\sWITH\sOPTIONS\s(\w+)\sFROM\sDATA\s(\w+)\sAT\s\#(\w+)/gm; | |
| // Draw pie_chart | |
| function trans1(args){ |