diff --git a/bin/phishing_catcher.py b/bin/phishing_catcher.py index f497ddd..5da17d2 100644 --- a/bin/phishing_catcher.py +++ b/bin/phishing_catcher.py @@ -40,7 +40,7 @@ app_home = "{}/etc/apps/OSweep".format(os.environ['SPLUNK_HOME']) tp_modules = "{}/bin/_tp_modules".format(app_home) sys.path.insert(0, tp_modules) -import entropy +import math import pylev import tld import yaml @@ -60,6 +60,12 @@ def get_modules(): return return suspicious, confusables +def entropy(string): + """Calculates the Shannon entropy of a string""" + prob = [ float(string.count(c)) / len(string) for c in dict.fromkeys(list(string)) ] + entropy = - sum([ p * math.log(p) / math.log(2.0) for p in prob ]) + return entropy + def request_module(session, filename): """Return a list of tags.""" base_url = "https://raw.githubusercontent.com/x0rz/phishing_catcher/master{}" @@ -125,7 +131,7 @@ def score_domain(provided_ioc): except Exception: domain = provided_ioc - score += int(round(entropy.shannon_entropy(domain)*50)) + score += int(round(entropy(domain)*10)) domain = confusables.unconfuse(domain) words_in_domain = re.split("\W+", domain) diff --git a/bin/requirements.txt b/bin/requirements.txt index c2b703a..689313f 100644 --- a/bin/requirements.txt +++ b/bin/requirements.txt @@ -1,5 +1,4 @@ bs4 -entropy HTMLParser pylev PySocks