From c4036129856013a370336f0d57508a21b285a6b8 Mon Sep 17 00:00:00 2001 From: tpltnt Date: Tue, 10 Apr 2018 21:38:23 +0200 Subject: [PATCH 1/7] more docs on entropy() --- dga_routines.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/dga_routines.py b/dga_routines.py index 889605b..1c59187 100755 --- a/dga_routines.py +++ b/dga_routines.py @@ -5,7 +5,11 @@ def entropy(string): """ - Calculates the Shannon entropy of a string + Calculates the Shannon entropy of a string. + + :param string: input string + :type string: str + :returns: float """ # get probability of chars in string From bd13bf3aaf3881b05166aa237786a9fb7f6f041d Mon Sep 17 00:00:00 2001 From: tpltnt Date: Tue, 10 Apr 2018 21:39:15 +0200 Subject: [PATCH 2/7] more docs on count_consonants() --- dga_routines.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/dga_routines.py b/dga_routines.py index 1c59187..264f21b 100755 --- a/dga_routines.py +++ b/dga_routines.py @@ -23,7 +23,11 @@ def entropy(string): def count_consonants(string): """ - Counting consonants in a string + Counting consonants in a string. + + :param string: input string + :type string: str + :retuns: int (number of consonants) """ consonants = re.compile("[bcdfghjklmnpqrstvwxyz]") count = consonants.findall(string) From 50967c7e111a94fadb03020ba64eafdd05078979 Mon Sep 17 00:00:00 2001 From: tpltnt Date: Tue, 10 Apr 2018 21:43:45 +0200 Subject: [PATCH 3/7] docs for read_file() --- dga_detector.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/dga_detector.py b/dga_detector.py index a8fd7bd..0324129 100644 --- a/dga_detector.py +++ b/dga_detector.py @@ -7,6 +7,13 @@ def read_file(filename): + """ + Read each line from a file (with newline removed). + + :param filename: file name/path to read from + :type filename: str + :returns: generator of str + """ with open(filename) as f: for line in f: yield line.strip("\n") From 46de94d2bd24a0b701d51a0ead412431ecdbd038 Mon Sep 17 00:00:00 2001 From: tpltnt Date: Tue, 10 Apr 2018 21:51:13 +0200 Subject: [PATCH 4/7] docs for domain_check() --- dga_detector.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/dga_detector.py b/dga_detector.py index 0324129..7084be8 100644 --- a/dga_detector.py +++ b/dga_detector.py @@ -20,6 +20,14 @@ def read_file(filename): def domain_check(domain): + """ + Check a given domain. This function operates on the second level domain, e.g. on 'example' of 'example.net'. + + :param domain: domain to check + :type domain: str + :returns: tuple (second level domain - str, entropy - float, number of consonants - int, length - int), may be empty + :note: Domains shorter than six characters, localized domains (i.e. 'xn-') and onion services (i.e. '.onion') are not processed. + """ # skip tor domains if domain.endswith(".onion"): print("Tor domains is ignored...") From 93473f1ce050f98c6e5dde36bd3acfee642f1706 Mon Sep 17 00:00:00 2001 From: tpltnt Date: Tue, 10 Apr 2018 21:52:18 +0200 Subject: [PATCH 5/7] more pythonic call of main routine --- dga_detector.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/dga_detector.py b/dga_detector.py index 7084be8..e2153f7 100644 --- a/dga_detector.py +++ b/dga_detector.py @@ -48,7 +48,7 @@ def domain_check(domain): return domain_without_sub, domain_entropy, domain_consonants, domain_length -def main(): +if __name__ == "__main__": parser = argparse.ArgumentParser(description="DGA domain detection") parser.add_argument("-d", "--domain", help="Domain to check") parser.add_argument("-f", "--file", help="File with domains. One per line") @@ -108,4 +108,3 @@ def main(): /_____/ \____/ /_/ |_| /_____/ \___/\__/ \___/\___/ \__/ \____//_/ ''') parser.print_help() -main() From 62e8de9cdf5fd0ad00b3f35d8b769c0c0ae9412b Mon Sep 17 00:00:00 2001 From: tpltnt Date: Tue, 10 Apr 2018 21:53:20 +0200 Subject: [PATCH 6/7] added interpreter shebang --- dga_detector.py | 1 + 1 file changed, 1 insertion(+) diff --git a/dga_detector.py b/dga_detector.py index e2153f7..2c96979 100644 --- a/dga_detector.py +++ b/dga_detector.py @@ -1,3 +1,4 @@ +#!/usr/bin/env python3 import pickle from gib import gib_detect_train from dga_routines import count_consonants, entropy From 46ba943e2f321e363a7bf1768277afdf74c1edab Mon Sep 17 00:00:00 2001 From: tpltnt Date: Tue, 10 Apr 2018 21:54:12 +0200 Subject: [PATCH 7/7] made dga_detector.py executable --- dga_detector.py | 0 1 file changed, 0 insertions(+), 0 deletions(-) mode change 100644 => 100755 dga_detector.py diff --git a/dga_detector.py b/dga_detector.py old mode 100644 new mode 100755