oguzy / ovizart Goto Github PK

Mark the SMTP traffic that has attachments at the timeline

Tell something about the project
contact details, email list, twitter account, what is supported, TODO list where to go to add feature request

Explain the visualizations

the demopage linked at https://www.honeynet.org/node/920 is down

Each flow has packets and separate timestamps. [15:05:11 EEST] nicolas.collery: so it would be nice to show for each stream what type it is when it started, when it ended and represent a "line" between the 2

The flow details have hardly readable header parts. They should be humanitized.

The sizes are calculated according to their timestamp, because they are all close, their sizes are also nearly same. But the difference should be made more explicit

While saving the packets, addition to their ip and port numbers, payload should be saved for being displayed.

It may be better to make the site faster

At the flow details, the saved binaries should be displayed with their types also

The uploaded data is saved according to the user_id, better to define a user and a login screen

It handles many things about user integration to the system

IRC can be a good addition to handled protocols, as a malware source

The page will display all the uploaded pcaps one per line with a line based summary like the one at malwr.com site. Clicking on the md5sum will open pcap details page

[15:14:09 EEST] nicolas.collery: what is important though is classify as unknown, what you detect and cannot parse
[15:14:41 EEST] nicolas.collery: and since you mentioned last time about colors, i think unknown should stand clearly.

[15:15:09 EEST] nicolas.collery: so we can also internally later log all the unknown and try to create parsers

It is not readable and meaningful a lot. I should make it better.

from nicolas: "ok, well, 1 page summary that can contain the scatter plot but mostly a line with basic info for each pcap submitted, then each line is clickable, by md5, date or file name or description, whichever
[14:29:53 EEST] nicolas.collery: for each pcap, then you should have a page with various info and graphs"

This page will give information about the pcap at the top like File Details section at http://malwr.com/analysis/778ab45b3f5393e0fc3262261aeaff54/

It will have attachment details, created sub flow pcaps, their downloads

One tab for Summary View. The current summary view will be removed so as to display the per pcap display. The work process and the page for the summary view will be the same.

One tab for Visualization, that will have parallel coordinates

One tab for Flow Details, like the ones http://ow.comu.edu.tr/pcap/visualize/http/size/ or the count one, with links to packet IDs