search

mandiant / GeoLogonalyzer

GeoLogonalyzer is a utility to analyze remote access logs for anomalies such as travel feasibility and data center sources.
Apache License 2.0
194 stars 59 forks source link

Support for Unicode ASN Names and option to include accuracy radius in distance calculation #6

Open sck-nogas opened 6 years ago

sck-nogas commented 6 years ago

Here's two quick fixes that I uncovered.

1 - The ASN names if they include Unicode like "TELEFÔNICA BRASIL S.A" would cause the program to crash since in Python2 str can't handle unicode.

2 - When calculating the distance between two location, sometimes the IP location is "approximate", and in some of my logs, the MaxMind DB was putting the location as (37.751, -97.822) which is in the middle of Cheney Reservoir outside, Wichita Kansas. When in reality the actual location was closer to Emeryville, CA. When looking into this issue, I noticed that for some IP address, MaxMind has a 1,000km accuracy radius. Therefore, to prevent over alerting, I included an option to take the accuracy into account.

davidpany commented 6 years ago

Thank you for identifying the Unicode issue, I've updated Version 1.01 to support Unicode ASNs. Please let me know if you have any additional questions.

Also, thanks for sharing the radius of accuracy information. I didn't know that existed but it seems extremely useful. I'll test out your pull request and hopefully get the feature included shortly.