lksnyder0 · September 16, 2015 20:18
diff --git a/AttackerGraphs.py b/AttackerGraphs.py
 #!/usr/bin/env python3
 """
 This is a program to link attackers together. I have designed it to create a
 graph from a CSV file containing information from kippo honeypots. The
 fields in the CSV can be customized but mine are:

 "src_ip","client_country","client_city",username,password,url,filehost,filename,shasum,session,"_time"

 These are all available from the version of Kippo available at
 https://github.com/micheloosterhof/kippo. I am using splunk to create this
 CSV but anything will do.

 Next the links are defined in the JSON file links.json that should be included.
 There the links can also be customized. An example of a link one might add
 would look like:

 {
    "src": {
        "dataType": "attacker",
        "field": "src_ip"
    },
    "dst": {
        "dataType": "geolocation",
        "field": "client_city"
    }
 }

 This links the attacker to a city. I am using Max Mind geoip database for this
 information.

 Example usage:

 ./AttackerGraphs.py -f downloads.csv -l links.json
 """


 import csv
 import argparse
 import json


 class Graph:
    def __init__(self):
        self.nodes = []
        self.groups = []

    def add_link(self, src, dst):
        srcNode = self.Node(src[0], src[1])
        dstNode = self.Node(dst[0], dst[1])
        src = self._addNode(srcNode)
        dst = self._addNode(dstNode)

        src.addEdge(dst)
        dst.addEdge(src)

    def showGraph(self):
        start = self.nodes[0]
        self.DFS(start)

    def DFS(self, graph=None):
        if graph is None:
            graph = self.nodes
        visited = []
        start = graph.pop()
        # Look for the first unvisited vertex
        while start.visited and len(graph) > 0:
            start = graph.pop()
        stack = [start]
        while stack:
            vertex = stack.pop()
            if not vertex.visited:
                vertex.visited = True
                visited.append(vertex)
                for i in vertex.neighbors:
                    if i not in stack:
                        stack.append(i)
        if len(visited) > 0:
            self.groups.append(visited)
        if len(graph) > 0:
            self.DFS(graph)

    def showGroups(self):
        groupNum = 0
        for group in self.groups:
            print("Group:", groupNum)
            for node in group:
                print(node)
            print()
            groupNum += 1

    def output(self, output):
        groupNum = 0
        for group in self.groups:
            print("Group:", groupNum)
            for node in self._organizeGroup(group, output):
                print(node)
            print()
            groupNum += 1

    def _addNode(self, node):
        for i in range(len(self.nodes)):
            if self.nodes[i] == node:
                return self.nodes[i]
        self.nodes.append(node)
        return self.nodes[-1]

    def _organizeGroup(self, group, output):
        types = {}
        newGroup = []
        for each in group:
            try:
                types[each.dataType].append(each)
            except KeyError:
                types[each.dataType] = [each]
        for each in output:
            newGroup += types[each]
        return newGroup

    class Node:
        def __init__(self, dataType, data):
            self.data = data
            self.dataType = dataType
            self.neighbors = []
            self.visited = False

        def addEdge(self, node):
            if node not in self.neighbors:
                self.neighbors.append(node)

        def __eq__(self, other):
            if type(other) == type(self):
                if other.data == self.data and other.dataType == self.dataType:
                    return True
            return False

        def __ne__(self, other):
            if type(other) != type(self):
                if other.data != self.source or \
                   other.dataType != self.dataType:
                    return True
            return False

        def __str__(self):
            return "%s <%s>" % (self.data, self.dataType)

        def __repr__(self):
            return self.__str__()


 def main():
    parser = argparse.ArgumentParser(description="Process kippo filedownloads to find groups of attackers")
    parser.add_argument('-f', '--file', type=argparse.FileType('r'),
                        required=True, help="csvfile to parse")
    parser.add_argument('-c', '--config', type=argparse.FileType('r'),
                        default="config.json", help="Configuration file")
    args = parser.parse_args()

    config = json.load(args.config)

    links = []
    for l in config["links"]:
        links.append(((l["src"]["dataType"], l["src"]["field"]),
                     (l["dst"]["dataType"], l["dst"]["field"])))

    positions = {}
    graph = Graph()
    downloads = csv.reader(args.file, delimiter=",", quotechar="\"")
    header = next(downloads)
    for i in range(len(header)):
        positions[header[i]] = i

    for row in downloads:
        for link in links:
            src = (
                link[0][0],
                row[positions[link[0][1]]]
            )
            dst = (
                link[1][0],
                row[positions[link[1][1]]]
            )
            graph.add_link(src, dst)

    graph.DFS()
    graph.output(config["output-elements"])

 main()
diff --git a/config.json b/config.json
 {
    "links": [
        {
            "src": {
                "dataType": "attacker",
                "field": "src_ip"
            },
            "dst": {
                "dataType": "filehost",
                "field": "filehost"
            }
        },
        {
            "src": {
                "dataType": "filehost",
                "field": "filehost"
            },
            "dst": {
                "dataType": "filename",
                "field": "filename"
            }
        },
        {
        	"src": {
        		"dataType": "filename",
        		"field": "filename"
        	},
        	"dst": {
        		"dataType": "url",
        		"field": "url"
        	}
        },
        {
            "src": {
                "dataType": "filename",
                "field": "filename"
            },
            "dst": {
                "dataType": "shasum",
                "field": "shasum"
            }
        }
    ],
    "output-elements": [
    	"attacker",
    	"url",
    	"filehost"
    ]
 }
diff --git a/downloads.csv b/downloads.csv
	#!/usr/bin/env python3
	"""
	This is a program to link attackers together. I have designed it to create a
	graph from a CSV file containing information from kippo honeypots. The
	fields in the CSV can be customized but mine are:

	"src_ip","client_country","client_city",username,password,url,filehost,filename,shasum,session,"_time"

	These are all available from the version of Kippo available at
	https://github.com/micheloosterhof/kippo. I am using splunk to create this
	CSV but anything will do.

	Next the links are defined in the JSON file links.json that should be included.
	There the links can also be customized. An example of a link one might add
	would look like:

	{
	"src": {
	"dataType": "attacker",
	"field": "src_ip"
	},
	"dst": {
	"dataType": "geolocation",
	"field": "client_city"
	}
	}

	This links the attacker to a city. I am using Max Mind geoip database for this
	information.

	Example usage:

	./AttackerGraphs.py -f downloads.csv -l links.json
	"""


	import csv
	import argparse
	import json


	class Graph:
	def __init__(self):
	self.nodes = []
	self.groups = []

	def add_link(self, src, dst):
	srcNode = self.Node(src[0], src[1])
	dstNode = self.Node(dst[0], dst[1])
	src = self._addNode(srcNode)
	dst = self._addNode(dstNode)

	src.addEdge(dst)
	dst.addEdge(src)

	def showGraph(self):
	start = self.nodes[0]
	self.DFS(start)

	def DFS(self, graph=None):
	if graph is None:
	graph = self.nodes
	visited = []
	start = graph.pop()
	# Look for the first unvisited vertex
	while start.visited and len(graph) > 0:
	start = graph.pop()
	stack = [start]
	while stack:
	vertex = stack.pop()
	if not vertex.visited:
	vertex.visited = True
	visited.append(vertex)
	for i in vertex.neighbors:
	if i not in stack:
	stack.append(i)
	if len(visited) > 0:
	self.groups.append(visited)
	if len(graph) > 0:
	self.DFS(graph)

	def showGroups(self):
	groupNum = 0
	for group in self.groups:
	print("Group:", groupNum)
	for node in group:
	print(node)
	print()
	groupNum += 1

	def output(self, output):
	groupNum = 0
	for group in self.groups:
	print("Group:", groupNum)
	for node in self._organizeGroup(group, output):
	print(node)
	print()
	groupNum += 1

	def _addNode(self, node):
	for i in range(len(self.nodes)):
	if self.nodes[i] == node:
	return self.nodes[i]
	self.nodes.append(node)
	return self.nodes[-1]

	def _organizeGroup(self, group, output):
	types = {}
	newGroup = []
	for each in group:
	try:
	types[each.dataType].append(each)
	except KeyError:
	types[each.dataType] = [each]
	for each in output:
	newGroup += types[each]
	return newGroup

	class Node:
	def __init__(self, dataType, data):
	self.data = data
	self.dataType = dataType
	self.neighbors = []
	self.visited = False

	def addEdge(self, node):
	if node not in self.neighbors:
	self.neighbors.append(node)

	def __eq__(self, other):
	if type(other) == type(self):
	if other.data == self.data and other.dataType == self.dataType:
	return True
	return False

	def __ne__(self, other):
	if type(other) != type(self):
	if other.data != self.source or \
	other.dataType != self.dataType:
	return True
	return False

	def __str__(self):
	return "%s <%s>" % (self.data, self.dataType)

	def __repr__(self):
	return self.__str__()


	def main():
	parser = argparse.ArgumentParser(description="Process kippo filedownloads to find groups of attackers")
	parser.add_argument('-f', '--file', type=argparse.FileType('r'),
	required=True, help="csvfile to parse")
	parser.add_argument('-c', '--config', type=argparse.FileType('r'),
	default="config.json", help="Configuration file")
	args = parser.parse_args()

	config = json.load(args.config)

	links = []
	for l in config["links"]:
	links.append(((l["src"]["dataType"], l["src"]["field"]),
	(l["dst"]["dataType"], l["dst"]["field"])))

	positions = {}
	graph = Graph()
	downloads = csv.reader(args.file, delimiter=",", quotechar="\"")
	header = next(downloads)
	for i in range(len(header)):
	positions[header[i]] = i

	for row in downloads:
	for link in links:
	src = (
	link[0][0],
	row[positions[link[0][1]]]
	)
	dst = (
	link[1][0],
	row[positions[link[1][1]]]
	)
	graph.add_link(src, dst)

	graph.DFS()
	graph.output(config["output-elements"])

	main()
	{
	"links": [
	{
	"src": {
	"dataType": "attacker",
	"field": "src_ip"
	},
	"dst": {
	"dataType": "filehost",
	"field": "filehost"
	}
	},
	{
	"src": {
	"dataType": "filehost",
	"field": "filehost"
	},
	"dst": {
	"dataType": "filename",
	"field": "filename"
	}
	},
	{
	"src": {
	"dataType": "filename",
	"field": "filename"
	},
	"dst": {
	"dataType": "url",
	"field": "url"
	}
	},
	{
	"src": {
	"dataType": "filename",
	"field": "filename"
	},
	"dst": {
	"dataType": "shasum",
	"field": "shasum"
	}
	}
	],
	"output-elements": [
	"attacker",
	"url",
	"filehost"
	]
	}