v1toko Goto Github PK

12012980-malicious-url-detection-using-machine-learning

anomaly-detection-by-netflow-and-dns-analysis-of-alexa-1m-websites

The Domain Name System is a fundamental component of the internet since it maps the easy-to-remember domain names to IP addresses. Therefore, it is usually the primary target for most of the malicious attacks such as DNS Poisoning and Rogue DNS servers. With the help of 0x20 bit encoding, the problem of DNS Poisoning is mitigated to quite a large extent. Although, it has a minor requirement that the authoritative nameserver should be able to preserve the case of the DNS query. It is usually difficult to detect the rogue DNS server above the stub resolver. We propose an anomaly detection system which would be able to raise a red flag in case of DNS Poisoning and malicious DNS authority by passive DNS analysis of domain names and then comparing them with the 0th day cluster of the database. We perform the passive DNS analysis for 27 days by querying the whois server of CYMRU, compare the network profiles of the domain names crawled with the 0th day cluster and categorize the domain names as static, benign anomaly and malicious anomaly depending upon the cluster a domain name shifted. In the process, we also create a WHOIS repository for Alexa domain names which is faster to query than the WHOIS server.

autorecon

AutoRecon is a multi-threaded network reconnaissance tool which performs automated enumeration of services.

blacklotus

BlackLotus UEFI Windows Bootkit

bluekeep

Proof of concept for CVE-2019-0708

build-your-own-x

Master programming by recreating your favorite technologies from scratch.

cloud-security-remediation-guides

Security Remediation Guides

dbeaver

Free universal database tool and SQL client

dga-intel-web

This deep learning model uses a CNN-LSTM architecture to predict whether a given domain name is genuine or was artificially generated by a DGA.

dgad

DGA Detective - Hunt domains generated by Domain Generation Algorithms to identify malware traffic

domainintel

Detecting & monitoring a new domain which can be used for malicious or phishing activities.

elastdocker

🐳 Elastic Stack (ELK) on Docker, with preconfigured Security, Tools, and Monitoring. Enables Logs, Metrics, APM, Alerting, and SIEM features. Up with a Single Command. Now Supports v8.0!

explo

Human and machine readable web vulnerability testing format

flare-floss

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

gospider

Gospider - Fast web spider written in Go

hakoriginfinder

Tool for discovering the origin host behind a reverse proxy. Useful for bypassing cloud WAFs!

ics-hunter

a tcp port scanner that specially designed to track industrial control systems

idiagnosticprofileuac

improving-dga-based-malicious-domain-classifiers-with-natural-language-procesing

intelowl

Intel Owl: analyze files, domains, IPs in multiple ways from a single API at scale

kassiopea

Detection of malicious domains via a large scale network analysis

logstash-pfsense

Logstash configuration for pfSense syslog events.

madmax

MADMAX is public application to detect malicious domain.

malicious-domain-classification

Data Mining - Malicious Domain Classification

malicious-url-detect

Jupyter notebook for detecting malicious URLs

malicious_domain_whois

:beginner: 非法域名挖掘与画像系统

malicious_domains_dga_detection

The repository is created in pursuit of detecting malware-based domain names that were generated using DGA.

ms17-010

MS17-010

mwscup2020_server

mwscup 2020 for server

patternex-feed

PatternEx domain feed: malicious domains detected with AI