<jupyter_start><jupyter_text>There are three main tools for detecting and searching for rootkits:binary file analysis, system and user behavior analysis, and systemlog analysis. Two representatives of malware that use the T1070.002technique - Proton and Rocke are considered. Finally it is provedthat progress in detection tools will lead to the appearance ofmalicious software that will have developed tools for working withlogs and will move from simple destruction to forgery of logs inorder to mask its presence in the system. ![log example](./img/log_example.png)<jupyter_code>!head -n 30 ssh.log
def req_parser(s):
    #month, day, timest, host, proc_id, other = s.split(' ',maxsplit=5)
    #print(month, day, timest, host, proc_id, sep=';') 
    #print(other)
    if len(s.split(' ',maxsplit=5)) >= 5:
        month, day, timest, host, proc_id, other = s.split(' ',maxsplit=5)
    else:
        return None
    if 'Failed password for' in other:
        other,user,em2,ip,em,port,protocol = other.rsplit(' ',maxsplit=6)
        #print(user,ip,port,protocol, sep = ';')
        attack = 'password'

        return month, day, timest, ip, user, port, attack 


    elif 'authentication failure' in other:
        # logname= uid=0 euid=0 tty=ssh ruser= rhost=172.16.58.3  user=root
        other, user = other.rsplit(maxsplit=1)
        user = user.partition('=')[-1]
        other, ip = other.rsplit(maxsplit=1)
        ip = ip.partition('=')[-1]
        port = '00000'
        #print(user)
        #print(ip)
        attack = 'auth'


        return month, day, timest, ip, user, port, attack 

    else:

        return None
file_name = "ssh.log"
sshlog = open(file_name)
import sqlite3
conn = sqlite3.connect('ssh.db')
c = conn.cursor()

# Create table
c.execute('''DROP TABLE req ''')

c.execute('''CREATE TABLE req 
                     (
                     month text, 
                     day text, 
                     timest text, 
                     ip text,
                     user text, 
                     port integer, 
                     prot text
                     );''')

for i in sshlog:
    r = req_parser(i)
    if r and len(r) == 7:
        c.execute('INSERT INTO req VALUES (?,?,?,?,?,?,?)', r)

sshlog.close()

conn.commit()
conn.close()<jupyter_output><empty_output>
{'fraction_non_alphanumeric': 0.11904761904761904, 'fraction_numerical': 0.016017316017316017, 'mean_word_length': 2.4085545722713864, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 6, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 1, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'chain_length': '1', 'dir': 'jupyter-structured-clean-dedup', 'id': '551993', 'license': 'Unlicense', 'n_tokens_mistral': 749, 'n_tokens_neox': 693, 'n_words': 223, 'path': 'pandas_datamining_logs/03_case_of_ssh_attacks/01_data_extraction_and_analysis.ipynb', 'repo_name': 'boykoatwork/jupyter', 'size': '2312'}