(src_log, md5_to_node:dict)
| 30 | return attack_list |
| 31 | |
| 32 | def build_graph(src_log, md5_to_node:dict): |
| 33 | process_nodes = set() |
| 34 | attack_nodes = set() |
| 35 | g = nx.DiGraph() |
| 36 | attack_set = get_md5_process() |
| 37 | attack_set = set(attack_set) |
| 38 | print(attack_set) |
| 39 | event_num = 0 |
| 40 | with open(src_log, 'r') as rf: |
| 41 | for line in tqdm(rf): |
| 42 | line = line.rstrip('\n') |
| 43 | log = json.loads(line) |
| 44 | event_id = log['datatype'] |
| 45 | if event_id in ANFU_TYPE.FILE_OP: |
| 46 | from_id = str(int(log['pid'])) + ':' + log['pcommand'] |
| 47 | to_id = log['filename'] |
| 48 | s_node = get_md5(from_id) |
| 49 | # print("~~~~~~~~~~~~~~") |
| 50 | # print(from_id) |
| 51 | # print(s_node) |
| 52 | # print("~~~~~~~~~~~~~~") |
| 53 | # break |
| 54 | |
| 55 | t_node = get_md5(to_id) |
| 56 | if s_node not in md5_to_node: |
| 57 | md5_to_node[s_node] = from_id |
| 58 | if t_node not in md5_to_node: |
| 59 | md5_to_node[t_node] = to_id |
| 60 | if s_node not in g.nodes().keys(): |
| 61 | g.add_node(s_node) |
| 62 | if t_node not in g.nodes().keys(): |
| 63 | g.add_node(t_node) |
| 64 | is_warn = False |
| 65 | if s_node in attack_set or t_node in attack_set: |
| 66 | is_warn = True |
| 67 | process_nodes.add(s_node) |
| 68 | if is_warn: |
| 69 | attack_nodes.add(s_node) |
| 70 | g.add_edge(s_node, t_node, e_id=event_num, is_warn=is_warn) |
| 71 | event_num += 1 |
| 72 | pass |
| 73 | if event_id in ANFU_TYPE.PROCESS_OP: |
| 74 | from_id = str(int(log['ppid'])) + ':' + log['ppcommand'] |
| 75 | to_id = str(int(log['pid'])) + ':' + log['pcommand'] |
| 76 | s_node = get_md5(from_id) |
| 77 | t_node = get_md5(to_id) |
| 78 | if s_node not in md5_to_node: |
| 79 | md5_to_node[s_node] = from_id |
| 80 | if t_node not in md5_to_node: |
| 81 | md5_to_node[t_node] = to_id |
| 82 | if s_node not in g.nodes().keys(): |
| 83 | g.add_node(s_node) |
| 84 | if t_node not in g.nodes().keys(): |
| 85 | g.add_node(t_node) |
| 86 | process_nodes.add(s_node) |
| 87 | process_nodes.add(t_node) |
| 88 | is_warn = False |
| 89 | if s_node in attack_set or t_node in attack_set: |
no test coverage detected