Package: cybersectk
cybersectkThis is a fork ofcybersectkby SumendraBSingh, a Python library for Machine Learning CyberSec feature extraction.Installation InstructionsThis library is available through PyPi and can be installed using the following command:pipinstallcybersectkThis will install all the necessary dependencies before installing the package itself.If you are interested in developing for this library yourself, clone the repo, then run the following commands:cdCyberSecTK
python-mvenvenvsourceenv/bin/activate
pipinstall-e.This will move you into the freshly cloned repo, create a virtual environment so any changes you make won't affect the rest of your Python installation, actiavte that virutal environment, then install the CyberSecTK package in "editable" mode.ModulesWLAN IOTThewiotmodule extracts features from wireless DataLink layer header informationfromcybersectk.wiotimportwiotwiot()This module outputs a NumPy array, which can be passed directly to a TensorFlow or PyTorch training script.NOTE: Ensure the file is in the same directory as the script, and don't forget specify the.pcapextension at the end of the file name.TCP IOTTheiotmodule extracts features from TCP/IP packets.fromcybersectk.iotimportiotiot('path_to_your_pcap_file.pcap',**ip_filter)This module outputs a NumPy array, which can be passed directly to a TensorFlow or PyTorch training script.Iterating Through a Directory of PCAPsWe can use Python's built-inoslibrary to iterate through a directory containing PCAP files and pass each file to theiot()function, using theip_filterdictionary provided by CyberSecTK:importosfromcybersectk.iotimportiot# Specify the directory path where the PCAP files are locatedpcap_directory='/path/to/pcap/files'# Iterate through each file in the directoryforfilenameinos.listdir(pcap_directory):iffilename.endswith('.pcap'):# Construct the full file pathfile_path=os.path.join(pcap_directory,filename)# Call the iot() function with the file pathiot(file_path)Filtering TCP PCAP FilesCyberSecTK allows you to filter specific TCP PCAP files using a Python dictionary namedip_filter. This dictionary should be defined in your script before calling theiotfunction.The library usestsharkto extract the features from the given TCP pcap file. Make suretsharkis installed on your system.Theip_filterdictionary uses keys to specify the type of device and values to specify the IP addresses to filter. The filtered pcap file will be saved with its filtered name inside thefiltered_pcapdirectory.Here are the available keys for theip_filterdictionary:TCP_MobileTCP_OutletTCP_AssistantTCP_CameraTCP_MiscellaneousHere's an example of how to define theip_filterdictionary:ip_filter={}ip_filter['TCP_Miscellaneous']="'tcp && (ip.src==192.168.1.216) || (ip.src==192.168.1.46) || (ip.src==192.168.1.84) || (ip.src==192.168.1.91)'"In this example, theTCP_Miscellaneouskey is associated with a string that specifies a TCP filter for several IP addresses. You can replace these IP addresses with the ones you want to filter.To use theip_filterdictionary, pass it as an argument to theiotfunction:fromcybersectk.iotimportiotiot(**ip_filter)MALEWAREThemalwaremodule extracts features from system log files to identify malicious activity.fromcybersectk.malwareimportmalwaremalware()This module outputs a NumPy array, which can be passed directly to a TensorFlow or PyTorch training script.Note: Before running the feature extraction, please ensure that you have created a directory namedlog_filesin the same working directory. Inside thelog_filesdirectory, add the non-malicious system log files with names likeGood1.CSV,Good2.CSV, and so on. For infected log files, please refer to the sample dataset provided for better understanding.You can download the sample dataset from the following link:Sample DatasetFeature DesrciptionsEach module extracts a different set of features. For detailed descriptions of the features extracted by each module, see theFeature Descriptionsdocument.ContributingWe welcome contributions to CyberSecTK! Please see outContributing Guidefor more information.