NCC Group의 Impossible Travel 로그 분석

소개

IP 주소 지리 정보를 통해 불가능한 이동(impossible travel)을 탐지하는 기본 로그 분석 도구

예상 데이터 형식

다음 헤더를 포함하는 CSV 파일

When,User,Event,IP

다음 형식을 따릅니다

2019-04-09 00:00:00,user2493,AUTHSUCCESS,101.193.251.145

필드 구조는 다음과 같습니다:

• When: YYYY-MM-DD HH:mm:SS 형식
• User: 사용자 이름
• Event: 인증 또는 관심 있는 기타 이벤트(현재 .csv당 한 가지 유형만 지원)
• IP: IPv4 주소

테스트 데이터를 생성하는 스크립트와 예제 .csv는 다음에서 찾을 수 있습니다: https://github.com/olliencc/Speed-of-light-test-data

사용법

impossibletravel.py [csvfile]

예:

impossibletravel.py ..\Speed-of-light-test-data\sampledataexample.csv

그러면 다음 출력이 표시됩니다:

impossibletravel.py ..\Speed-of-light-test-data\sampledataexample.csv
[i] NCC Group Impossible Travel Analysis - 1.0
[i] https://github.com/nccgroup/ImpossibleTravelLogAnalysis
[!]  user621 had traveled on 2019-04-09 01:44:00 at speed 32909.547 m/s (118474.37 km/h) for 0.05 hrs
[!] user9406 had traveled on 2019-04-11 11:03:00 at speed 7376.450 m/s (26555.22 km/h) for 0.23 hrs
[!] user3027 had traveled on 2019-04-12 18:07:00 at speed 94516.879 m/s (340260.76 km/h) for 0.03 hrs
[!] user6995 had traveled on 2019-04-20 16:47:00 at speed 4718.706 m/s (16987.34 km/h) for 1.10 hrs
[!] user1566 had traveled on 2019-04-24 23:00:00 at speed 8512.756 m/s (30645.92 km/h) for 0.30 hrs
[!] user4090 had traveled on 2019-04-28 16:12:00 at speed 3640.331 m/s (13105.19 km/h) for 0.62 hrs
[!] user2577 had traveled on 2019-05-06 11:29:00 at speed 5441.884 m/s (19590.78 km/h) for 0.50 hrs
[!] user7743 had traveled on 2019-05-06 20:30:00 at speed 17065.947 m/s (61437.41 km/h) for 0.15 hrs
[!] user5822 had traveled on 2019-05-24 16:23:00 at speed 75868.560 m/s (273126.82 km/h) for 0.03 hrs
[!] user6431 had traveled on 2019-05-26 05:09:00 at speed 5722.403 m/s (20600.65 km/h) for 0.67 hrs
[!]   user56 had traveled on 2019-05-30 10:43:00 at speed 11834.590 m/s (42604.52 km/h) for 0.43 hrs
[!] user8663 had traveled on 2019-05-30 18:39:00 at speed 7466.536 m/s (26879.53 km/h) for 0.47 hrs
[!] user4256 had traveled on 2019-05-31 08:22:00 at speed 53195.909 m/s (191505.27 km/h) for 0.07 hrs
[!] user1528 had traveled on 2019-06-01 13:59:00 at speed 3645.914 m/s (13125.29 km/h) for 0.92 hrs

Windows 바이너리 릴리스

pyinstaller로 단일 .exe로 컴파일된 버전은 여기의 Releases에서 찾을 수 있습니다: https://github.com/nccgroup/ImpossibleTravelLogAnalysis/releases

사용법은 동일합니다. 예:

..\output\impossibletravel.exe" ..\Speed-of-light-test-data\sampledataexample.csv
[i] NCC Group Impossible Travel Analysis - 1.0
[i] https://github.com/nccgroup/ImpossibleTravelLogAnalysis
[!]  user621 had traveled on 2019-04-09 01:44:00 at speed 32909.547 m/s (118474.37 km/h) for 0.05 hrs
[!] user9406 had traveled on 2019-04-11 11:03:00 at speed 7376.450 m/s (26555.22 km/h) for 0.23 hrs
[!] user3027 had traveled on 2019-04-12 18:07:00 at speed 94516.879 m/s (340260.76 km/h) for 0.03 hrs
[!] user6995 had traveled on 2019-04-20 16:47:00 at speed 4718.706 m/s (16987.34 km/h) for 1.10 hrs
[!] user1566 had traveled on 2019-04-24 23:00:00 at speed 8512.756 m/s (30645.92 km/h) for 0.30 hrs

요구 사항

• requirements.txt 참조
• Maxmin GeoIP 도시 데이터베이스 https://dev.maxmind.com/geoip/geoip2/geolite2/

작성자

Steven van der Baan

라이선스

AGPL에 따라 릴리스됨 - LICENSE 참조