Skip to content

Commit d7f70ae

Browse files
a232319779a232319779
committed
version: 0.3.1,优化在线扫描结果展示
1 parent 30b3493 commit d7f70ae

6 files changed

Lines changed: 130 additions & 9 deletions

File tree

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ __pycache__/
1010

1111
# tmp
1212
tmp/
13+
tools/
1314

1415
# Distribution / packaging
1516
.Python

‎README.md‎

Lines changed: 62 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ mmdt is a sensitive hash implementation that can be used to calculate file simil
77
## Pre-Install
88

99
* `cmake`: 2.6 and above
10-
* `windows`: The current version (0.2.2) requires `minGW` to be installed on windows
10+
* `windows`: The current version (0.3.1) requires `minGW` to be installed on windows
1111

1212
## Install from Pypi
1313

@@ -39,7 +39,7 @@ $ pip install python_mmdt-xxx.whl
3939
usage: python_mmdt malicious file scan tool [-h] [-s SCANS] [-t THRESHOLD]
4040
[-c CLASSIFY_TYPE]
4141

42-
A malicious scanner tool based on mmdt_hash. Version 0.2.1
42+
A malicious scanner tool based on mmdt_hash. Version 0.3.1
4343

4444
optional arguments:
4545
-h, --help show this help message and exit
@@ -57,6 +57,61 @@ Use like:
5757
mmdt-classify -s $sample_path -t 0.95 -c 1
5858
2. use knn classify
5959
mmdt-classify -s $sample_path -t 0.95 -c 2
60+
61+
# submit mmdt_hash
62+
➜ mmdt-scan-online .\test\2f04b8eb993ca4a3d98607824a10acfb
63+
{
64+
"sha1": "a5ad744088e2739dc8b6a0622432106158d0abd8",
65+
"md5": "2f04b8eb993ca4a3d98607824a10acfb",
66+
"file_name": ".\\test\\2f04b8eb993ca4a3d98607824a10acfb",
67+
"message": "查询任务已添加至查询队列，当前队列中还有0个任务",
68+
"status": 20001,
69+
"data": {}
70+
}
71+
72+
# get check result
73+
➜ mmdt-scan-online .\test\2f04b8eb993ca4a3d98607824a10acfb
74+
{
75+
"sha1": "a5ad744088e2739dc8b6a0622432106158d0abd8",
76+
"md5": "2f04b8eb993ca4a3d98607824a10acfb",
77+
"file_name": ".\\test\\2f04b8eb993ca4a3d98607824a10acfb",
78+
"message": "success",
79+
"status": 20000,
80+
"data": {
81+
"label": "APT28",
82+
"labels": [
83+
{
84+
"label": "APT28",
85+
"ratio": "20.00%"
86+
},
87+
{
88+
"label": "virlock",
89+
"ratio": "50.00%"
90+
},
91+
{
92+
"label": "coinminer",
93+
"ratio": "30.00%"
94+
}
95+
],
96+
"similars": [
97+
{
98+
"hash": "a5ad744088e2739dc8b6a0622432106158d0abd8",
99+
"label": "APT28",
100+
"sim": 1.0
101+
},
102+
{
103+
"hash": "9001f4cfe62367a282efc08b072a13a5e2e403db",
104+
"label": "APT28",
105+
"sim": 0.9896245046624919
106+
},
107+
{
108+
"hash": "0d3d452a7e8d7d328bfe9862cbcee33ad1ce4cf4",
109+
"label": "virlock",
110+
"sim": 0.8511449567066024
111+
},
112+
...
113+
}
114+
}
60115
```
61116
62117
### python code
@@ -93,4 +148,8 @@ class Testmmdt(unittest.TestCase):
93148
![](./pictures/python-mmdt.jpg)
94149
95150
### use classifier to detected malicious file
96-
![](./pictures/scan.png)
151+
![](./pictures/scan.png)
152+
153+
### scan online
154+
![](./pictures/submit.jpg)
155+
![](./pictures/scan_online.jpg)

‎README_CN.md‎

Lines changed: 62 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
## 安装预备
66

77
* `cmake`：2.6以上版本
8-
* `windows`：当前版本(0.2.2)需单独安装 `minGW`
8+
* `windows`：当前版本(0.3.1)需单独安装 `minGW`
99

1010
## PIP安装
1111

@@ -33,7 +33,7 @@ $ mmdt-compare $file_path1 $file_path2
3333
usage: python_mmdt malicious file scan tool [-h] [-s SCANS] [-t THRESHOLD]
3434
[-c CLASSIFY_TYPE]
3535

36-
A malicious scanner tool based on mmdt_hash. Version 0.2.1
36+
A malicious scanner tool based on mmdt_hash. Version 0.3.1
3737

3838
optional arguments:
3939
-h, --help show this help message and exit
@@ -51,6 +51,61 @@ Use like:
5151
mmdt-classify -s $sample_path -t 0.95 -c 1
5252
2. use knn classify
5353
mmdt-classify -s $sample_path -t 0.95 -c 2
54+
55+
# submit mmdt_hash
56+
➜ mmdt-scan-online .\test\2f04b8eb993ca4a3d98607824a10acfb
57+
{
58+
"sha1": "a5ad744088e2739dc8b6a0622432106158d0abd8",
59+
"md5": "2f04b8eb993ca4a3d98607824a10acfb",
60+
"file_name": ".\\test\\2f04b8eb993ca4a3d98607824a10acfb",
61+
"message": "查询任务已添加至查询队列，当前队列中还有0个任务",
62+
"status": 20001,
63+
"data": {}
64+
}
65+
66+
# get check result
67+
➜ mmdt-scan-online .\test\2f04b8eb993ca4a3d98607824a10acfb
68+
{
69+
"sha1": "a5ad744088e2739dc8b6a0622432106158d0abd8",
70+
"md5": "2f04b8eb993ca4a3d98607824a10acfb",
71+
"file_name": ".\\test\\2f04b8eb993ca4a3d98607824a10acfb",
72+
"message": "success",
73+
"status": 20000,
74+
"data": {
75+
"label": "APT28",
76+
"labels": [
77+
{
78+
"label": "APT28",
79+
"ratio": "20.00%"
80+
},
81+
{
82+
"label": "virlock",
83+
"ratio": "50.00%"
84+
},
85+
{
86+
"label": "coinminer",
87+
"ratio": "30.00%"
88+
}
89+
],
90+
"similars": [
91+
{
92+
"hash": "a5ad744088e2739dc8b6a0622432106158d0abd8",
93+
"label": "APT28",
94+
"sim": 1.0
95+
},
96+
{
97+
"hash": "9001f4cfe62367a282efc08b072a13a5e2e403db",
98+
"label": "APT28",
99+
"sim": 0.9896245046624919
100+
},
101+
{
102+
"hash": "0d3d452a7e8d7d328bfe9862cbcee33ad1ce4cf4",
103+
"label": "virlock",
104+
"sim": 0.8511449567066024
105+
},
106+
...
107+
}
108+
}
54109
```
55110
56111
### python代码
@@ -87,4 +142,8 @@ class Testmmdt(unittest.TestCase):
87142
![](./pictures/python-mmdt.jpg)
88143
89144
### 利用分类器实现恶意代码识别
90-
![](./pictures/scan.png)
145+
![](./pictures/scan.png)
146+
147+
### 在线扫描
148+
![](./pictures/submit.jpg)
149+
![](./pictures/scan_online.jpg)

‎pictures/scan_online.jpg‎

225 KB
Loading

‎pictures/submit.jpg‎

96.5 KB
Loading

‎python_mmdt/mmdt/run.py‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
import sys
1212
import shutil
1313
import argparse
14+
import json
1415
import requests
1516
from python_mmdt.mmdt.common import mmdt_load, mmdt_save, gen_md5, gen_sha1, mmdt_std as __mmdt_std__
1617
from python_mmdt.mmdt.mmdt import MMDT
@@ -40,7 +41,7 @@ def mmdt_classfiy():
4041
mmdt-classify -s $sample_path -t 0.95 -c 2
4142
"""
4243
parser = argparse.ArgumentParser(prog='python_mmdt malicious file scan tool',
43-
description='A malicious scanner tool based on mmdt_hash. Version 0.2.2',
44+
description='A malicious scanner tool based on mmdt_hash. Version 0.3.1',
4445
epilog=epilog,
4546
formatter_class=argparse.RawDescriptionHelpFormatter
4647
)
@@ -118,8 +119,9 @@ def mmdt_scan_online():
118119
"mmdt": file_mmdt,
119120
"data": {}
120121
}
121-
r = requests.post(url='http://mmdt.me/mmdt/scan', json=data)
122-
print(r.text)
122+
r = requests.post(url='http://146.56.242.184/mmdt/scan', json=data)
123+
r_data = r.json()
124+
print(json.dumps(r_data, indent=4, ensure_ascii=False))
123125

124126
def mmdt_feature_merge():
125127
"""

0 commit comments

Comments
 (0)