ail-framework/bin/DomClassifier.py

#!/usr/bin/env python3
# -*-coding:UTF-8 -*

"""
The DomClassifier Module
============================

The DomClassifier modules extract and classify Internet domains/hostnames/IP addresses from
the out output of the Global module.

"""

##################################
# Import External packages
##################################
import os
import sys
import time
from pubsublogger import publisher
import DomainClassifier.domainclassifier

##################################
# Import Project packages
##################################
from module.abstract_module import AbstractModule
from Helper import Process

sys.path.append(os.path.join(os.environ['AIL_BIN'], 'lib'))
import d4
import item_basic


class DomClassifier(AbstractModule):
    """
    DomClassifier module for AIL framework
    """

    def __init__(self):
        super(DomClassifier, self).__init__()

        # Waiting time in secondes between to message proccessed
        self.pending_seconds = 1

        addr_dns = self.process.config.get("DomClassifier", "dns")

        self.redis_logger.info("""ZMQ DomainClassifier is Running""")

        self.c = DomainClassifier.domainclassifier.Extract(rawtext="", nameservers=[addr_dns])

        self.cc = self.process.config.get("DomClassifier", "cc")
        self.cc_tld = self.process.config.get("DomClassifier", "cc_tld")

        # Send module state to logs
        self.redis_logger.info("Module %s initialized" % (self.module_name))


    def compute(self, message):
        try:
            item_content = item_basic.get_item_content(message)
            mimetype = item_basic.get_item_mimetype(message)
            item_basename = item_basic.get_basename(message)
            item_source = item_basic.get_source(message)
            item_date = item_basic.get_item_date(message)

            if mimetype.split('/')[0] == "text":
                self.c.text(rawtext=item_content)
                self.c.potentialdomain()
                self.c.validdomain(passive_dns=True, extended=False)
                self.redis_logger.debug(self.c.vdomain)

                if self.c.vdomain and d4.is_passive_dns_enabled():
                    for dns_record in self.c.vdomain:
                        self.process.populate_set_out(dns_record)

                localizeddomains = self.c.include(expression=self.cc_tld)
                if localizeddomains:
                    self.redis_logger.debug(localizeddomains)
                    self.redis_logger.warning(f"DomainC;{item_source};{item_date};{item_basename};Checked {localizeddomains} located in {self.cc_tld};{message}")
                localizeddomains = self.c.localizedomain(cc=self.cc)

                if localizeddomains:
                    self.redis_logger.debug(localizeddomains)
                    self.redis_logger.warning(f"DomainC;{item_source};{item_date};{item_basename};Checked {localizeddomains} located in {self.cc};{message}")

        except IOError as err:
            self.redis_logger.error(f"Duplicate;{item_source};{item_date};{item_basename};CRC Checksum Failed")
            raise Exception(f"CRC Checksum Failed on: {message}")


if __name__ == "__main__":
    module = DomClassifier()
    module.run()