INNER CODE UNIT · Python

find_bad_domains

A3sal0n/CyberThreatHunting · tools/dga-hunt.py:180

def find_bad_domains(topd, domains):
    model_data = pickle.load(open('shared/gib_model.pki', 'rb'))
    model_mat = model_data['mat']
    threshold = model_data['thresh']
    suspicious = []
    for domain in domains:
        if domain not in topd:
            #resolved = False
            #try:
            #    data = socket.gethostbyname(domain)
            #    resolved = True
            #except socket.gaierror:
            #    pass
            if (entropy(domain) > 3) and (gib.avg_transition_prob(domain, model_mat) < threshold):
                suspicious.append(domain)
    if len(suspicious) > 0:
        return suspicious
    else:

View source record →