Git Product home page Git Product logo

mushorg / buttinsky Goto Github PK

View Code? Open in Web Editor NEW
81.0 81.0 27.0 480 KB

Botnet monitoring is a crucial part in threat analysis and often neglected due to the lack of proper open source tools. Our tool will provide an open source framework for automated botnet monitoring. The modular design will allow full customization of the used protocols, the monitoring clients behavior, how we log the collected information, processing of the data to analyze the botnets purpose, size and threat and how the monitoring task are distributed between dedicated nodes.

Home Page: http://buttinsky.org

License: GNU General Public License v3.0

Python 91.69% Shell 8.31%

buttinsky's People

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

buttinsky's Issues

Spawner crash from exception in reporter_handler.py

Traceback (most recent call last):
  File "/usr/lib64/python2.7/site-packages/gevent/greenlet.py", line 328, in run
    result = self._run(*self.args, **self.kwargs)
  File "spawner.py", line 139, in listen
    self.spawnMonitor(identifier, data[2], data[3])
  File "spawner.py", line 154, in spawnMonitor
    layer_log = Layer(reporter_handler.ReporterHandler(log_plugins),
  File "./buttinsky/modules/reporter_handler.py", line 49, in __init__
    self.loggers = self.reporting_handler.get_loggers()
  File "./buttinsky/modules/reporter_handler.py", line 39, in get_loggers
    logger = logger_class(create_tables=create_tables)
NameError: global name 'create_tables' is not defined
<Greenlet at 0x1df90f0: <bound method MonitorSpawner.listen of <__main__.MonitorSpawner object at 0x1deef90>>> failed with NameError

HPFeeds interface

Add a hpfeeds client subscribing to a channel which provides botnet settings.
We are probably using JSON for setting encoding.
Add a hpfeeds client publishing data to a channel. We can start with some basic logging information to get status updates from the monitoring bot.

Filelogging

Debugging will improve a lot if we can enable file logging to a static text file.

In spawner.py

Under import -->
import modules.reporting.file_logger as file_logger

Under load -->
log.info("Task ID:" + identifier + " is loaded successfully into queue from source file <" + filename + ">")

Under main-->
log = file_logger.FileLogger(name="buttinsky").log()
log.info('Starting Buttinsky spawner')

Pls suggest if this viable

Behavior learning layer

Using the generalized data we using machine learning and clustering to generate a bot behavior definition.

Bot mimicking

Use the bot behavior definition to mimic a real bot.

Documentation

Start documentation. Sphinx combined with github pages seems like a good option.

buttinsky initial load error

Running buttinsky.py throws up the error given below:

Traceback (most recent call last):
File "./buttinsky.py", line 26, in
set_nick = "NICK %s\r\n" % net_settings["nick"]
File "/usr/lib/python2.7/dist-packages/configobj.py", line 567, in getitem
val = dict.getitem(self, key)
KeyError: 'nick'

Assess P2P protocol implementation

Have a look into various bots using P2P protocols for communication. What do we need to have in place so one can replicated the communication?

hpfeeds sink

Add a hpfeeds sink to get botnet credentials from various channels.

Documentation

Start writing documentation on how to use the tool, adding new plugins etc.
Preferably using Sphinx-Doc.

cli to add new networks

Provide a cli (probably based on Cmd) to add new networks on the fly. Maybe extend to be used to manage the monitored networks.

TOR support

Add optional TOR support to the network layer

General IRC protocol implementation

The IRC protocol is no rocket science so I'd write it from scratch and get more flexibility this way.
I added a basic starting point to the repository handling NICK, USER, JOIN and PING.
It would be cool if we could configure the communication protocols by providing protocol definitions in the botnet settings.

Communication generalizer

Implement a filter for collected botnet communication to identify the commands purpose. This will build the basis for the bot behavior definer.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.