Python entropy.shannon_entropy方法代碼示例

# 需要導入模塊: import entropy [as 別名]
# 或者: from entropy import shannon_entropy [as 別名]
def max_entropy(inList):
        """returns the maximum shannon entropy of URIs in the list"""
        try:
            maxEntropy = en.shannon_entropy(inList[0])
        except(IndexError,TypeError,KeyError):
            try:
                maxEntropy = en.shannon_entropy(inList)
            except(TypeError):
                maxEntropy = 0.0

        for uri in inList:
            try:
                if maxEntropy <  en.shannon_entropy(uri):
                    maxEntropy = en.shannon_entropy(uri)
            except(IndexError, TypeError, KeyError):
                print()

        return(maxEntropy) 

# 需要導入模塊: import entropy [as 別名]
# 或者: from entropy import shannon_entropy [as 別名]
def min_entropy(inList):
        """Returns the minimum shannon entropy of URIs in the list"""
        try:
            minEntropy = en.shannon_entropy(inList[0])
        except(IndexError,TypeError,KeyError):
            try:
                minEntropy = en.shannon_entropy(inList)
            except(TypeError):
                minEntropy = 0.0

        for uri in inList:
            try:
                if minEntropy > en.shannon_entropy(uri):
                    minEntropy = en.shannon_entropy(uri)
            except(IndexError, TypeError, KeyError):
                print()

        return(minEntropy) 

# 需要導入模塊: import entropy [as 別名]
# 或者: from entropy import shannon_entropy [as 別名]
def score_domain(config, domain, args):
    """ """
    score = 0

    for t in config["tlds"]:
        if domain.endswith(t):
            score += 20

    try:
        res = get_tld(domain, as_object=True, fail_silently=True, fix_protocol=True)

        if res is not None:
            domain = '.'.join([res.subdomain, res.domain])
    except Exception as err:
        message_failed(args, err, domain)
        pass

    score += int(round(entropy.shannon_entropy(domain)*50))

    domain          = unconfuse(domain)
    words_in_domain = re.split(r"\W+", domain)

    if words_in_domain[0] in ["com", "net", "org"]:
        score += 10

    for word in config["keywords"]:
        if word in domain:
            score += config["keywords"][word]

    for key in [k for (k,s) in config["keywords"].items() if s >= 70]:
        for word in [w for w in words_in_domain if w not in ["email", "mail", "cloud"]]:
            if distance(str(word), str(key)) == 1:
                score += 70

    if "xn--" not in domain and domain.count("-") >= 4:
        score += domain.count("-") * 3

    if domain.count(".") >= 3:
        score += domain.count(".") * 3
    return score 

# 需要導入模塊: import entropy [as 別名]
# 或者: from entropy import shannon_entropy [as 別名]
def process(self):
        # print("SECTIONS")
        # logging.debug("loading pefile")
        pelib = self._getLibrary(PEFileModule().getName())
        if(pelib is None):
            return ""

        # logging.debug("iterating sections")
        ret = []
        number = 0

        for section in pelib.sections:
            # print(section)
            dic_sec = {}
            dic_sec["name"] = repr(section.Name)

            dic_sec["size_raw_data"] = int(hex(section.SizeOfRawData), 16)
            dic_sec["virtual_size"] = int(hex(section.Misc_VirtualSize), 16)
            dic_sec["characteristics"] = hex(section.Characteristics)

            if (section.__dict__.get('IMAGE_SCN_MEM_WRITE', False) and
                    section.__dict__.get('IMAGE_SCN_MEM_EXECUTE', False)):
                dic_sec["write_executable"] = "True"
            else:
                dic_sec["write_executable"] = "False"

            data = section.get_data()
            # logging.debug("calculating hashes")
            dic_sec["sha1"] = SHA1(data)
            dic_sec["sha2"] = SHA256(data)
            dic_sec["md5"] = MD5(data)
            # logging.debug("calculating fuzzy")
            dic_sec["fuzzy_hash"] = getSsdeep(data)
            dic_sec["entropy"] = entropy.shannon_entropy(data) * 8
            # logging.debug("finished calculating")

            ret.append(dic_sec)

        return ret 

# 需要導入模塊: import entropy [as 別名]
# 或者: from entropy import shannon_entropy [as 別名]
def process(self):
        res = entropy.shannon_entropy(self.sample.getBinary()) * 8
        return res 

# 需要導入模塊: import entropy [as 別名]
# 或者: from entropy import shannon_entropy [as 別名]
def entropy(s):
    return shannon_entropy(s) 

# 需要導入模塊: import entropy [as 別名]
# 或者: from entropy import shannon_entropy [as 別名]
def score_domain(provided_ioc):
    """Return the scores of the provided domain."""
    score = 0

    for suspicious_tld in suspicious["tlds"]:
        if provided_ioc.endswith(suspicious_tld):
            score += 20

    try:
        res    = tld.get_tld(provided_ioc, as_object=True, fail_silently=True,
                             fix_protocol=True)
        domain = ".".join([res.subdomain, res.domain])
    except Exception:
        domain = provided_ioc

    score += int(round(entropy.shannon_entropy(domain)*50))
    domain = confusables.unconfuse(domain)
    words_in_domain = re.split("\W+", domain)


    if domain.startswith("*."):
        domain = domain[2:]

        if words_in_domain[0] in ["com", "net", "org"]:
            score += 10

    for word in suspicious["keywords"]:
        if word in domain:
            score += suspicious["keywords"][word]

    for key in [k for k, v in suspicious["keywords"].items() if v >= 70]:
        for word in [w for w in words_in_domain if w not in ["email", "mail", "cloud"]]:
            if pylev.levenshtein(str(word), str(key)) == 1:
                score += 70

    if "xn--" not in domain and domain.count("-") >= 4:
        score += domain.count("-") * 3

    if domain.count(".") >= 3:
        score += domain.count(".") * 3
    return score