| 32 | from tools import * |
| 33 | |
| 34 | class ProvGraph(object): |
| 35 | def __init__(self,dataset): |
| 36 | self.lock = threading.Lock() |
| 37 | self.thread_lock = threading.Lock() |
| 38 | self.G = nx.DiGraph() |
| 39 | self.TmpG = nx.DiGraph() |
| 40 | self.w2v = FastText.load('../' + dataset + '/filepath-embedding.model') |
| 41 | self.c2v = FastText.load('../' + dataset + '/cmdline-embedding.model') |
| 42 | self.tfidf = json.load(open('../' + dataset + '/tfidf.json')) |
| 43 | self.taylor_map = dict() |
| 44 | self.mean_tfidf = np.mean(list(self.tfidf.values())) |
| 45 | self.AS = AnomalyScore(dataset) |
| 46 | self.graph_cache = [] |
| 47 | self.node_set = set() |
| 48 | self.filtered = set() |
| 49 | self.hit = set() |
| 50 | if dataset == 'hw17': |
| 51 | self.attack_process = set(['fe46ff4b0dd67dc0a974430208331227', 'e14d9cbf5da65c007c4d8708f53b9c2f', '83fe3bf44cf67fb94e258c9396fbe188', 'cd100288b92b5e826dc7b79082398b29', 'c00408939cf270d5a3a29550fdba87d5', '5444a68c94bd0a75afb76cfdc07b14d2', 'e5e1285bbb6611731ccf18d2207a4aff', '7c87efd4610605689d6ba3c02ad75c8f', '5c09e49f4f790f73687a231103893d13', '5fcf1988f6ec204bed510491a9cff2fe', '9429bacd8424a21ec9df2a1b448252cc',\ |
| 52 | 'f4c37a52e9572e89f86b0811b4fb326f','526f43c80ba193bc3dabc6374baad92a','b9ced8f1e981fe2b19ba4f0c74c8eaaa','eca0112ba004a46862c9d957b9dc2222','b8fa95f2d2d39924b045b41cf5991d3f','e0b19819ffbadb37ba779ebe29085e8b','cfcc3cb29e2e6cfa8ba1f48eeb40a69d','526f43c80ba193bc3dabc6374baad92a','894232a1faedaf12a553156f39aeb524','a897833c84ca38eb9d6c06553db9211f','dc17876a3a9ae7401065fc12c074089b','4dff1d0c21ffed9c41c460d43f855630','f1e2739b8c52073f9266a036aa93bd52','b35b4ffe25682ffd5899e5dffb39cb68','bc97cc66c3f4038cd0e9582f6a66ec69','07165d4a31e8d35df421c9d6c4ae450f','97db754defe078d12cd35d28de61c04a','c5d9be0fe1125565a14587328a25f06b','766c100383651fe8fb408dcaeabca2d0','ad7eb65e45d145446eafde6779d5695f']) |
| 53 | self.nodes = defaultdict(dict) |
| 54 | print(len(self.attack_process)) |
| 55 | # |
| 56 | def graph_add_node_mgr(self, row, key, event_type): |
| 57 | self.lock.acquire() |
| 58 | node_attr = {} |
| 59 | # print(row) |
| 60 | if key == APTLOG_KEY.FILE: |
| 61 | s_node = get_md5(row['proc.cmdline']) |
| 62 | if not (s_node in self.nodes): |
| 63 | self.nodes[s_node] = {'label': row['proc.cmdline'], 'type': APTLOG_NODE_TYPE.PROCESS, 'score': 0} |
| 64 | t_node = get_md5(row['fd.name']) |
| 65 | if not (t_node in self.nodes): |
| 66 | self.nodes[t_node] = {'label': row['fd.name'], 'type': APTLOG_NODE_TYPE.FILE, 'score': 0} |
| 67 | self.TmpG.add_node(s_node) |
| 68 | self.TmpG.add_node(t_node) |
| 69 | self.TmpG.add_edge(s_node,t_node,e_type = event_type) |
| 70 | elif key == APTLOG_KEY.PROCESS: |
| 71 | Parentid = row['proc.pcmdline'] |
| 72 | # print(Parentid) |
| 73 | s_node = get_md5(Parentid) |
| 74 | t_node = get_md5(str(row['proc.cmdline'])) |
| 75 | if not (s_node in self.nodes): |
| 76 | self.nodes[s_node] = {'label': row['proc.pcmdline'],'type': APTLOG_NODE_TYPE.PROCESS, 'score': 0} |
| 77 | if not (t_node in self.nodes): |
| 78 | self.nodes[t_node] = {'label': row['proc.cmdline'], 'type': APTLOG_NODE_TYPE.PROCESS, 'score': 0} |
| 79 | self.TmpG.add_node(s_node) |
| 80 | self.TmpG.add_node(t_node) |
| 81 | self.TmpG.add_edge(s_node,t_node,e_type = event_type) |
| 82 | |
| 83 | elif key == APTLOG_KEY.NET: |
| 84 | # add net type node |
| 85 | s_node = get_md5(row['proc.cmdline']) |
| 86 | if not (s_node in self.nodes): |
| 87 | self.nodes[s_node] = {'label': row['proc.cmdline'], 'type': APTLOG_NODE_TYPE.PROCESS, 'score': 0} |
| 88 | t_node = get_md5(row['fd.name']) |
| 89 | if not (t_node in self.nodes): |
| 90 | self.nodes[t_node] = {'label': row['fd.name'], 'type': APTLOG_NODE_TYPE.NET, 'score': 0} |
| 91 | self.TmpG.add_node(s_node) |