demos/demos_by_use_case/logs/malware-hypergraph/Malware Hypergraph.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Finding Correlations in a CSV of Malware Events via Hypergraph Views\n",
    "\n",
    "To find patterns and outliers in CSVs and event data, Graphistry provides the hypergraph transform. \n",
    "\n",
    "As an example, this notebook examines different malware files reported to a security vendor. It reveals phenomena such as:\n",
    "\n",
    "* The malware files cluster into several families\n",
    "* The nodes central to a cluster reveal attributes specific to a strain of malware\n",
    "* The nodes bordering a cluster reveal attributes that show up in a strain, but are unique to each instance in that strain\n",
    "* Several families have attributes connecting them, suggesting they had the same authors"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Load CSV"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [],
   "source": [
    "import pandas as pd\n",
    "import graphistry as g\n",
    "\n",
    "# To specify Graphistry account & server, use:\n",
    "# graphistry.register(api=3, username='...', password='...', protocol='https', server='hub.graphistry.com')\n",
    "# For more options, see https://github.com/graphistry/pygraphistry#configure\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "('# samples', 999)\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "{'Campaign': 'TRANSFORMICE',\n",
       " 'Date': '2015-11-19 14:04:23',\n",
       " 'Domain': 'spynet1.ddns.net',\n",
       " 'InstallDir': 'TEMP',\n",
       " 'InstallFlag': 'True',\n",
       " 'InstallName': 'svchost.exe',\n",
       " 'NetworkSeparator': \"|'|'|\",\n",
       " 'Origin': 'vt',\n",
       " 'Port': '1177',\n",
       " 'RegistryValue': 'ba4c12bee3027d94da5c81db2d196bfd',\n",
       " 'Version': '0.6.4',\n",
       " 'compile_date': '2015-11-18 21:25:59',\n",
       " 'imphash': 'f34d5f2d4577ed6d9ceec516c1f5a744',\n",
       " 'magic': 'PE32 executable for MS Windows (GUI) Intel 80386 32-bit Mono/.Net assembly',\n",
       " 'md5': '007a8403b3281fd4d48c69f4c96da0b8',\n",
       " 'rat_name': 'njRat',\n",
       " 'section_.RELOC': '7905c1aa858eb5484ad08a2e10b7e50e',\n",
       " 'section_.RSRC': '5b346ed223699f15252c1fdad182859f',\n",
       " 'section_.TEXT': 'f414cace41511d02fb8e278cf36fd2a3',\n",
       " 'sha1': 'd215edec90c5487800d961cc1ac2808e221818fa',\n",
       " 'sha256': '2beb53ca652d9d4f73516ce45365ae824370d2408d6b0d5a809cf3cd177ba694'}"
      ]
     },
     "execution_count": 7,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df = pd.read_csv('./barncat.1k.csv', encoding = \"utf8\")\n",
    "print(\"# samples\", len(df))\n",
    "eval(df[:10]['value'].tolist()[0])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style>\n",
       "    .dataframe thead tr:only-child th {\n",
       "        text-align: right;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: left;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>uuid</th>\n",
       "      <th>event_id</th>\n",
       "      <th>category</th>\n",
       "      <th>type</th>\n",
       "      <th>value</th>\n",
       "      <th>to_ids</th>\n",
       "      <th>date</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>56e1af55-22f4-4b76-881a-50feac1f3af3</td>\n",
       "      <td>417</td>\n",
       "      <td>External analysis</td>\n",
       "      <td>comment</td>\n",
       "      <td>{\"InstallFlag\": \"True\", \"RegistryValue\": \"ba4c...</td>\n",
       "      <td>0</td>\n",
       "      <td>20160310</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                                   uuid  event_id           category     type  \\\n",
       "0  56e1af55-22f4-4b76-881a-50feac1f3af3       417  External analysis  comment   \n",
       "\n",
       "                                               value  to_ids      date  \n",
       "0  {\"InstallFlag\": \"True\", \"RegistryValue\": \"ba4c...       0  20160310  "
      ]
     },
     "execution_count": 8,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "#avoid double counting\n",
    "df3 = df[df['value'].str.contains(\"{\")]\n",
    "df3[:1]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style>\n",
       "    .dataframe thead tr:only-child th {\n",
       "        text-align: right;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: left;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>ActivateKeylogger</th>\n",
       "      <th>ActiveXKey</th>\n",
       "      <th>ActiveXStartup</th>\n",
       "      <th>BackupDNSServer</th>\n",
       "      <th>BypassUAC</th>\n",
       "      <th>Campaign</th>\n",
       "      <th>ChangeCreationDate</th>\n",
       "      <th>ClearAccessControl</th>\n",
       "      <th>ClearZoneIdentifier</th>\n",
       "      <th>ConnectDelay</th>\n",
       "      <th>...</th>\n",
       "      <th>section_.TEXT</th>\n",
       "      <th>section_.TLS</th>\n",
       "      <th>section_BSS</th>\n",
       "      <th>section_CODE</th>\n",
       "      <th>section_DATA</th>\n",
       "      <th>sha1</th>\n",
       "      <th>sha256</th>\n",
       "      <th>to_ids</th>\n",
       "      <th>type</th>\n",
       "      <th>uuid</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0.0</td>\n",
       "      <td>comment</td>\n",
       "      <td>56e1af55-22f4-4b76-881a-50feac1f3af3</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>1 rows × 116 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "  ActivateKeylogger ActiveXKey ActiveXStartup BackupDNSServer BypassUAC  \\\n",
       "0               NaN        NaN            NaN             NaN       NaN   \n",
       "\n",
       "  Campaign ChangeCreationDate ClearAccessControl ClearZoneIdentifier  \\\n",
       "0      NaN                NaN                NaN                 NaN   \n",
       "\n",
       "   ConnectDelay                  ...                  section_.TEXT  \\\n",
       "0           NaN                  ...                            NaN   \n",
       "\n",
       "  section_.TLS section_BSS  section_CODE  section_DATA sha1 sha256 to_ids  \\\n",
       "0          NaN         NaN           NaN           NaN  NaN    NaN    0.0   \n",
       "\n",
       "      type                                  uuid  \n",
       "0  comment  56e1af55-22f4-4b76-881a-50feac1f3af3  \n",
       "\n",
       "[1 rows x 116 columns]"
      ]
     },
     "execution_count": 9,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "#Unpack 'value' json\n",
    "import json\n",
    "df4 = pd.concat([df3.drop('value', axis=1), df3.value.apply(json.loads).apply(pd.Series)])\n",
    "len(df4)\n",
    "df4[:1]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Default Hypergraph Transform\n",
    "\n",
    "The hypergraph transform creates:\n",
    "* A node for every row, \n",
    "* A node for every unique value in a columns (so multiple if found across columns)\n",
    "* An edge connecting a row to its values\n",
    "\n",
    "When multiple rows share similar values, they will cluster together. When a row has unique values, those will form a ring around only that node."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "('# links', 3038)\n",
      "('# events', 204)\n",
      "('# attrib entities', 1408)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "\n",
       "            <iframe id=\"63c1e826-295d-4ca7-a53a-56c57364c741\" src=\"https://hub.graphistry.com/graph/graph.html?dataset=PyGraphistry/Z4BRCK4XKG&type=vgraph&viztoken=dd0d9e3a3bea9a0cc3a9ca4281641e5a465d0de5&usertag=86f11264-pygraphistry-0.9.63&splashAfter=1554614866&info=true\"\n",
       "                    allowfullscreen=\"true\" webkitallowfullscreen=\"true\" mozallowfullscreen=\"true\"\n",
       "                    oallowfullscreen=\"true\" msallowfullscreen=\"true\"\n",
       "                    style=\"width:100%; height:500px; border: 1px solid #DDD\">\n",
       "            </iframe>\n",
       "        \n",
       "            <script>\n",
       "                $(\"#63c1e826-295d-4ca7-a53a-56c57364c741\").bind('mousewheel', function(e) {\n",
       "                e.preventDefault();\n",
       "                });\n",
       "            </script>\n",
       "        "
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 12,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "g.hypergraph(df4)['graph'].plot()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Configured Hypergraph Transform\n",
    "We clean up the visualization in a few ways:\n",
    "\n",
    "1. Categorize hash codes as in the same family. This simplifies coloring by the generated 'category' field. If columns share the same value, such as two columns using md5 values, this would also cause them to only create 1 node per hash, instead of per-column instance.\n",
    "\n",
    "2. Not show a lot of attributes as nodes, such as numbers and dates\n",
    "\n",
    "Running `help(graphistry.hypergraph)` reveals more options."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "('# links', 2350)\n",
      "('# events', 204)\n",
      "('# attrib entities', 1154)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "\n",
       "            <iframe id=\"42d11916-8112-4b1f-a5ab-1e3ff85428d4\" src=\"https://hub.graphistry.com/graph/graph.html?dataset=PyGraphistry/W6NSEAJZT4&type=vgraph&viztoken=a90d9d68d0f1853c85b98c6557f2adfec2181611&usertag=86f11264-pygraphistry-0.9.63&splashAfter=1554614847&info=true\"\n",
       "                    allowfullscreen=\"true\" webkitallowfullscreen=\"true\" mozallowfullscreen=\"true\"\n",
       "                    oallowfullscreen=\"true\" msallowfullscreen=\"true\"\n",
       "                    style=\"width:100%; height:500px; border: 1px solid #DDD\">\n",
       "            </iframe>\n",
       "        \n",
       "            <script>\n",
       "                $(\"#42d11916-8112-4b1f-a5ab-1e3ff85428d4\").bind('mousewheel', function(e) {\n",
       "                e.preventDefault();\n",
       "                });\n",
       "            </script>\n",
       "        "
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 11,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "g.hypergraph(\n",
    "    df4,\n",
    "    opts={\n",
    "        'CATEGORIES': {\n",
    "            'hash': ['sha1', 'sha256', 'md5'],\n",
    "            'section': [x for x in df4.columns if 'section_' in x]\n",
    "        },\n",
    "        'SKIP': ['event_id', 'InstallFlag', 'type', 'val', 'Date', 'date', 'Port', 'FTPPort', 'Origin', 'category', 'comment', 'to_ids']\n",
    "    })['graph'].plot()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Directly connecting metadata\n",
    "Do not show actual malware instance nodes"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "('# links', 26753)\n",
      "('# events', 204)\n",
      "('# attrib entities', 1154)\n",
      "Uploading 6080 kB. This may take a while...\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "\n",
       "            <iframe id=\"1ca9b207-d17c-429f-a341-b8122fb3e128\" src=\"https://hub.graphistry.com/graph/graph.html?dataset=PyGraphistry/3PEE19VIRW&type=vgraph&viztoken=e4db170c3e4186d21904c680fae461cf7584bc86&usertag=86f11264-pygraphistry-0.9.63&splashAfter=1554615042&info=true\"\n",
       "                    allowfullscreen=\"true\" webkitallowfullscreen=\"true\" mozallowfullscreen=\"true\"\n",
       "                    oallowfullscreen=\"true\" msallowfullscreen=\"true\"\n",
       "                    style=\"width:100%; height:500px; border: 1px solid #DDD\">\n",
       "            </iframe>\n",
       "        \n",
       "            <script>\n",
       "                $(\"#1ca9b207-d17c-429f-a341-b8122fb3e128\").bind('mousewheel', function(e) {\n",
       "                e.preventDefault();\n",
       "                });\n",
       "            </script>\n",
       "        "
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "execution_count": 13,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "g.hypergraph(\n",
    "    df4,\n",
    "    direct=True,\n",
    "    opts={\n",
    "        'CATEGORIES': {\n",
    "            'hash': ['sha1', 'sha256', 'md5'],\n",
    "            'section': [x for x in df4.columns if 'section_' in x]\n",
    "        },\n",
    "        'SKIP': ['event_id', 'InstallFlag', 'type', 'val', 'Date', 'date', 'Port', 'FTPPort', 'Origin', 'category', 'comment', 'to_ids']\n",
    "    })['graph'].plot()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.11"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 1
}