| 74 | |
| 75 | |
| 76 | def graph_add_node_mgr(self, row, key, event_type): |
| 77 | self.lock.acquire() |
| 78 | node_attr = {} |
| 79 | if key == EVENT_KEY.FILE: |
| 80 | Process = str(row['PID']) + str(row['PName']) |
| 81 | s_node = get_md5(Process) |
| 82 | if not (s_node in self.nodes): |
| 83 | self.nodes[s_node] = {'label': row['PName'].replace('\\','/'), 'cmd':'', 'type': NODE_TYPE.PROCESS, 'score': 0} |
| 84 | t_node = get_md5(row['FileName']) |
| 85 | if not (t_node in self.nodes): |
| 86 | self.nodes[t_node] = {'label': row['FileName'].replace('\\','/'), 'type': NODE_TYPE.FILE, 'score': 0} |
| 87 | self.TmpG.add_node(s_node) |
| 88 | self.TmpG.add_node(t_node) |
| 89 | self.TmpG.add_edge(s_node,t_node,e_type = event_type) |
| 90 | elif key == EVENT_KEY.PROCESS: |
| 91 | Parentid = row['ParentID'].replace(',','') + str(row['PPName']) |
| 92 | # print(Parentid) |
| 93 | s_node = get_md5(Parentid) |
| 94 | if not (s_node in self.nodes): |
| 95 | self.nodes[s_node] = {'label': '', 'cmd':'', 'type': NODE_TYPE.PROCESS, 'score': 0} |
| 96 | t_node = get_md5(str(row['PID']) + str(row['PName'])) |
| 97 | if not (t_node in self.nodes): |
| 98 | self.nodes[t_node] = {'label': row['PName'], 'type': NODE_TYPE.PROCESS, 'cmd': row['CommandLine'].replace('"',' ').replace('\\','/'), 'score': 0} |
| 99 | self.TmpG.add_node(s_node) |
| 100 | self.TmpG.add_node(t_node) |
| 101 | self.TmpG.add_edge(s_node,t_node,e_type = event_type) |
| 102 | |
| 103 | elif key == EVENT_KEY.NET: |
| 104 | # add net type node |
| 105 | s_node = get_md5(str(row['PID']) + str(row['PName'])) |
| 106 | if not (s_node in self.nodes): |
| 107 | self.nodes[s_node] = {'label': row['PName'], 'type': NODE_TYPE.PROCESS, 'cmd': '', 'score': 0} |
| 108 | src_ip = row['saddr'] |
| 109 | dst_ip = row['daddr'] |
| 110 | sport = row['sport'] |
| 111 | dport = row['dport'] |
| 112 | x = '{},{}/32'.format(src_ip,dst_ip) |
| 113 | t_node = get_md5(x) |
| 114 | if not (t_node in self.nodes): |
| 115 | self.nodes[t_node] = {'label': x, 'type': NODE_TYPE.NET, 'score': 0} |
| 116 | self.TmpG.add_node(s_node) |
| 117 | self.TmpG.add_node(t_node) |
| 118 | self.TmpG.add_edge(s_node,t_node,e_type = event_type) |
| 119 | self.lock.release() |
| 120 | |
| 121 | |
| 122 | def GetNodeName(self,node): |