mirror of
https://github.com/zeek/zeek.git
synced 2025-10-13 20:18:20 +00:00
First commit of file entropy analyzer.
- Code comments need cleaned up still.
This commit is contained in:
parent
2f0671aeeb
commit
b7877792c9
7 changed files with 221 additions and 0 deletions
19
scripts/policy/frameworks/files/entropy.bro
Normal file
19
scripts/policy/frameworks/files/entropy.bro
Normal file
|
@ -0,0 +1,19 @@
|
|||
|
||||
module Files;
|
||||
|
||||
export {
|
||||
redef record Files::Info += {
|
||||
## The information density of the contents of the file, expressed as a number of bits per character.
|
||||
entropy: double &log &optional;
|
||||
};
|
||||
}
|
||||
|
||||
event file_new(f: fa_file)
|
||||
{
|
||||
Files::add_analyzer(f, Files::ANALYZER_ENTROPY);
|
||||
}
|
||||
|
||||
event file_entropy(f: fa_file, ent: entropy_test_result)
|
||||
{
|
||||
f$info$entropy = ent$entropy;
|
||||
}
|
Loading…
Add table
Add a link
Reference in a new issue