anssi-fr / anomark Goto Github PK

Hi,

I am interested in the method you suggest and wanted to know if you had use of literature paper on the matter, and if you had any to recommend ?

(Sorry for opening an issue for this, it's more a discussion)

Hi @ajunius-ANSSI,

Are you aware of any open-source datasets consisting of benign command lines? We would like to release an open-source version of the AnoMark service that we use in Assemblyline but the model we use cannot be released to the public unfortunately due to the dataset it was trained on.

Kevin

Hi @ajunius-ANSSI et al.

This question obviously depends on the dataset used, but what would a good number to choose for 'order'? The average length of a command line in the dataset? The maximum length of a command line in the dataset? Somewhere in-between?

Thanks,

Kevin 🇨🇦

Hi @ajunius-ANSSI et al,

I see that train_data.csv and train_data.txt are used in the tests, but I cannot seem to find where test_data.csv is being used? If it is not being used anywhere, can it be removed?

Thanks!

Kevin 🇨🇦

Hi @ajunius-ANSSI et al.

When we use the apply_model module to show the top X lines without the store flag, can we also display the "markovScore" value underneath each command to demonstrate why each of these X lines were chosen to be displayed?

It has something to do with the manipulation of the dataframe here

Let me know what you think!

Kevin 🇨🇦