monitoring

[sihunh]

디렉터리가　아닐때　해당　파일　읽어옴　

hashlib 함수를　이용해서　（md5가　나을듯함　검증하는거라）　md5로　암호화후　virustotal api에　넘김

hash　검증후　file result 결과　받고　데이터　추출

만약　다른방법　쓸거면　yara룰　악성코드　탐지룰　추가후　검사

import os import time from data import from watchdog.observers import Observer from watchdog.events import FileSystemEventHandler from D_alert import import requests import hashlib

url = "https://www.virustotal.com/api/v3/search?query=" hash_file = "cdc47d670159eef60916ca03a9d4a007"

class Target: watchDir = download_dir

watchDir에 감시하려는 디렉토리를 명시

def __init__(self):
    self.observer = Observer()   #observer객체를 만듦

def run(self):
    event_handler = Handler()
    self.observer.schedule(event_handler, self.watchDir, recursive=True)
    self.observer.start()

    try:
        while(True):
            time.sleep(1) # 1초마다 감시
    except:
        self.observer.stop()
        print("Error")
        self.observer.join()

class Handler(FileSystemEventHandler):

FileSystemEventHandler 클래스를 상속받음.

오버라이드

"""
def on_created(self, event): #파일, 디렉터리가 생성되면 실행
    해당부분　파일　디렉터리　인지　검증　event 안에　dir관련 부분　가져와서　dir = event.?

    if dir in "no": # 여기　if 문에서　처리　디렉터리가　아니면　해당　파일　open 후　읽고　닫음　
      f = open(＂파일　이름＂, 'rb')
       data = f.read()
      f.close()
    ＃다음　data 안에　저장된　file stream 
       file_hash = hashlib.md5(data).hexdigest()

      response = requests.get(url+file_hash, headers=headers) # 파일　해시값　넣고　호출
      print(response.text) 

      with open(download_dir + "filename", 'w') as outfile: # json으로 만들어서　저장　event.name? 같은　느낌으로　filename 가져오면　됨
          json.dump(json_data, outfile) # 덤프

""" def monitoring(): w = Target() w.run()