47：L的暗网监控：蓝队的地下情报收集

import requests
from stem import Signal
from stem.control import Controller
import time

class DarkWebCrawler:
    def __init__(self):
        self.session = requests.session()
        self.session.proxies = {
            'http': 'socks5h://127.0.0.1:9050',
            'https': 'socks5h://127.0.0.1:9050'
        }
        self.headers = {
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36'
        }
    
    def renew_connection(self):
        """更换Tor连接，避免被封锁"""
        with Controller.from_port(port=9051) as controller:
            controller.authenticate()
            controller.signal(Signal.NEWNYM)
        time.sleep(5)  # 等待连接更换
    
    def crawl(self, url, depth=2):
        """爬取暗网内容"""
        results = []
        visited = set()
        queue = [(url, 0)]
        
        while queue:
            current_url, current_depth = queue.pop(0)
            
            if current_url in visited or current_depth >= depth:
                continue
            
            visited.add(current_url)
            
            try:
                # 发送请求
                response = self.session.get(current_url, headers=self.headers, timeout=30)
                
                if response.status_code == 200:
                    # 提取内容
                    content = response.text
                    results.append({
                        'url': current_url,
                        'content': content,
                        'timestamp': time.time()
                    })
                    
                    # 提取链接
                    links = self._extract_links(content, current_url)
                    for link in links:
                        if link not in visited:
                            queue.append((link, current_depth + 1))
                
                # 随机更换连接，避免被封锁
                if len(visited) % 10 == 0:
                    self.renew_connection()
                    
            except Exception as e:
                print(f"Error crawling {current_url}: {e}")
                # 更换连接后重试
                self.renew_connection()
        
        return results
    
    def _extract_links(self, content, base_url):
        """从内容中提取链接"""
        # 这里是提取链接的逻辑
        import re
        links = re.findall(r'href=["\'](http[s]?://[^"]+)["\']', content)
        return links

import nltk
from nltk.tokenize import word_tokenize
from nltk.corpus import stopwords
import string

class KeywordMonitor:
    def __init__(self):
        # 加载停用词
        nltk.download('stopwords')
        nltk.download('punkt')
        self.stop_words = set(stopwords.words('english'))
        self.keywords = {
            'kira': ['kira', '基拉', 'light yagami', '死亡笔记'],
            'malware': ['malware', 'virus', 'trojan', 'ransomware'],
            'attack': ['attack', 'exploit', 'vulnerability', 'breach']
        }
    
    def monitor(self, content):
        """监控内容中的关键词"""
        # 预处理内容
        tokens = self._preprocess(content)
        
        # 检测关键词
        matches = {}
        for category, keyword_list in self.keywords.items():
            category_matches = []
            for keyword in keyword_list:
                if keyword.lower() in tokens:
                    category_matches.append(keyword)
            if category_matches:
                matches[category] = category_matches
        
        return matches
    
    def _preprocess(self, content):
        """预处理内容"""
        # 转换为小写
        content = content.lower()
        
        # 移除标点符号
        translator = str.maketrans('', '', string.punctuation)
        content = content.translate(translator)
        
        # 分词
        tokens = word_tokenize(content)
        
        # 移除停用词
        tokens = [token for token in tokens if token not in self.stop_words]
        
        return tokens

import pandas as pd
import numpy as np
from sklearn.ensemble import RandomForestClassifier
from sklearn.preprocessing import LabelEncoder

class ThreatAnalyzer:
    def __init__(self):
        self.model = RandomForestClassifier(n_estimators=100, random_state=42)
        self.label_encoder = LabelEncoder()
    
    def train_model(self, training_data):
        """训练威胁识别模型"""
        # 特征提取
        X = training_data[['content_length', 'keyword_count', 'malware_terms', 'attack_terms']]
        y = training_data['threat_level']
        
        # 训练模型
        self.model.fit(X, y)
    
    def analyze(self, content):
        """分析内容中的威胁"""
        # 提取特征
        features = {
            'content_length': len(content),
            'keyword_count': self._count_keywords(content),
            'malware_terms': self._count_malware_terms(content),
            'attack_terms': self._count_attack_terms(content)
        }
        
        # 预测威胁等级
        X = pd.DataFrame([features])
        threat_level = self.model.predict(X)[0]
        confidence = self.model.predict_proba(X)[0][np.where(self.model.classes_ == threat_level)[0][0]]
        
        return {
            'threat_level': threat_level,
            'confidence': confidence,
            'features': features
        }
    
    def _count_keywords(self, content):
        """计算关键词数量"""
        # 这里是计算关键词数量的逻辑
        return 0
    
    def _count_malware_terms(self, content):
        """计算恶意软件相关术语数量"""
        # 这里是计算恶意软件相关术语数量的逻辑
        return 0
    
    def _count_attack_terms(self, content):
        """计算攻击相关术语数量"""
        # 这里是计算攻击相关术语数量的逻辑
        return 0