Ransomware detection pipeline (#149)

- Added implementation for ransomware detection pipeline. - Added ransomware models (short, medium, long). - Added AppShield data files. Authors: - https://github.com/bsuryadevara - https://github.com/bsuryadev - Christopher Harris (https://github.com/cwharris) - Michael Demoret (https://github.com/mdemoret-nv) Approvers: - Christopher Harris (https://github.com/cwharris) - Michael Demoret (https://github.com/mdemoret-nv) URL: #149
nv-morpheus · Jun 28, 2022 · 2a96c11 · 2a96c11
1 parent f6e9873
commit 2a96c11
Show file tree

Hide file tree

Showing 229 changed files with 2,430 additions and 1 deletion.
diff --git a/.gitattributes b/.gitattributes
@@ -1,4 +1,4 @@
-examples/data/* filter=lfs diff=lfs merge=lfs -text
+examples/data/** filter=lfs diff=lfs merge=lfs -text
 morpheus/_version.py export-subst
 morpheus/data/* filter=lfs diff=lfs merge=lfs -text
 tests/mock_triton_server/payloads/** filter=lfs diff=lfs merge=lfs -text

diff --git a/examples/data/appshield/Heur/snapshot-1/cmdline_2022-01-30_10-26-00.310528.json b/examples/data/appshield/Heur/snapshot-1/cmdline_2022-01-30_10-26-00.310528.json
diff --git a/examples/data/appshield/Heur/snapshot-1/envars_2022-01-30_10-26-01.017250.json b/examples/data/appshield/Heur/snapshot-1/envars_2022-01-30_10-26-01.017250.json
diff --git a/examples/data/appshield/Heur/snapshot-1/handles_2022-01-30_10-26-04.570268.json b/examples/data/appshield/Heur/snapshot-1/handles_2022-01-30_10-26-04.570268.json
diff --git a/examples/data/appshield/Heur/snapshot-1/ldrmodules_2022-01-30_10-25-59.669333.json b/examples/data/appshield/Heur/snapshot-1/ldrmodules_2022-01-30_10-25-59.669333.json
diff --git a/examples/data/appshield/Heur/snapshot-1/netscan_2022-01-30_10-26-06.701633.json b/examples/data/appshield/Heur/snapshot-1/netscan_2022-01-30_10-26-06.701633.json
diff --git a/examples/data/appshield/Heur/snapshot-1/pslist_2022-01-30_10-25-58.438453.json b/examples/data/appshield/Heur/snapshot-1/pslist_2022-01-30_10-25-58.438453.json
diff --git a/examples/data/appshield/Heur/snapshot-1/threadlist_2022-01-30_10-26-01.670391.json b/examples/data/appshield/Heur/snapshot-1/threadlist_2022-01-30_10-26-01.670391.json
diff --git a/examples/data/appshield/Heur/snapshot-1/vadinfo_2022-01-30_10-26-02.785396.json b/examples/data/appshield/Heur/snapshot-1/vadinfo_2022-01-30_10-26-02.785396.json
diff --git a/examples/data/appshield/Heur/snapshot-10/cmdline_2022-01-30_10-27-20.192845.json b/examples/data/appshield/Heur/snapshot-10/cmdline_2022-01-30_10-27-20.192845.json
diff --git a/examples/data/appshield/Heur/snapshot-10/envars_2022-01-30_10-27-20.824781.json b/examples/data/appshield/Heur/snapshot-10/envars_2022-01-30_10-27-20.824781.json
diff --git a/examples/data/appshield/Heur/snapshot-10/handles_2022-01-30_10-27-24.351073.json b/examples/data/appshield/Heur/snapshot-10/handles_2022-01-30_10-27-24.351073.json
diff --git a/examples/data/appshield/Heur/snapshot-10/ldrmodules_2022-01-30_10-27-19.577763.json b/examples/data/appshield/Heur/snapshot-10/ldrmodules_2022-01-30_10-27-19.577763.json
diff --git a/examples/data/appshield/Heur/snapshot-10/netscan_2022-01-30_10-27-26.651085.json b/examples/data/appshield/Heur/snapshot-10/netscan_2022-01-30_10-27-26.651085.json
diff --git a/examples/data/appshield/Heur/snapshot-10/pslist_2022-01-30_10-27-18.426303.json b/examples/data/appshield/Heur/snapshot-10/pslist_2022-01-30_10-27-18.426303.json
diff --git a/examples/data/appshield/Heur/snapshot-10/threadlist_2022-01-30_10-27-21.436988.json b/examples/data/appshield/Heur/snapshot-10/threadlist_2022-01-30_10-27-21.436988.json
diff --git a/examples/data/appshield/Heur/snapshot-10/vadinfo_2022-01-30_10-27-22.554357.json b/examples/data/appshield/Heur/snapshot-10/vadinfo_2022-01-30_10-27-22.554357.json
diff --git a/examples/data/appshield/Heur/snapshot-11/cmdline_2022-01-30_10-27-29.034400.json b/examples/data/appshield/Heur/snapshot-11/cmdline_2022-01-30_10-27-29.034400.json
diff --git a/examples/data/appshield/Heur/snapshot-11/envars_2022-01-30_10-27-29.696475.json b/examples/data/appshield/Heur/snapshot-11/envars_2022-01-30_10-27-29.696475.json
diff --git a/examples/data/appshield/Heur/snapshot-11/handles_2022-01-30_10-27-33.184160.json b/examples/data/appshield/Heur/snapshot-11/handles_2022-01-30_10-27-33.184160.json
diff --git a/examples/data/appshield/Heur/snapshot-11/ldrmodules_2022-01-30_10-27-28.419808.json b/examples/data/appshield/Heur/snapshot-11/ldrmodules_2022-01-30_10-27-28.419808.json
diff --git a/examples/data/appshield/Heur/snapshot-11/netscan_2022-01-30_10-27-35.412059.json b/examples/data/appshield/Heur/snapshot-11/netscan_2022-01-30_10-27-35.412059.json
diff --git a/examples/data/appshield/Heur/snapshot-11/pslist_2022-01-30_10-27-27.222779.json b/examples/data/appshield/Heur/snapshot-11/pslist_2022-01-30_10-27-27.222779.json
diff --git a/examples/data/appshield/Heur/snapshot-11/threadlist_2022-01-30_10-27-30.310404.json b/examples/data/appshield/Heur/snapshot-11/threadlist_2022-01-30_10-27-30.310404.json
diff --git a/examples/data/appshield/Heur/snapshot-11/vadinfo_2022-01-30_10-27-31.425348.json b/examples/data/appshield/Heur/snapshot-11/vadinfo_2022-01-30_10-27-31.425348.json
diff --git a/examples/data/appshield/Heur/snapshot-12/cmdline_2022-01-30_10-27-37.852093.json b/examples/data/appshield/Heur/snapshot-12/cmdline_2022-01-30_10-27-37.852093.json
diff --git a/examples/data/appshield/Heur/snapshot-12/envars_2022-01-30_10-27-38.523393.json b/examples/data/appshield/Heur/snapshot-12/envars_2022-01-30_10-27-38.523393.json
diff --git a/examples/data/appshield/Heur/snapshot-12/handles_2022-01-30_10-27-42.025544.json b/examples/data/appshield/Heur/snapshot-12/handles_2022-01-30_10-27-42.025544.json
diff --git a/examples/data/appshield/Heur/snapshot-12/ldrmodules_2022-01-30_10-27-37.207563.json b/examples/data/appshield/Heur/snapshot-12/ldrmodules_2022-01-30_10-27-37.207563.json
diff --git a/examples/data/appshield/Heur/snapshot-12/netscan_2022-01-30_10-27-44.388284.json b/examples/data/appshield/Heur/snapshot-12/netscan_2022-01-30_10-27-44.388284.json
diff --git a/examples/data/appshield/Heur/snapshot-12/pslist_2022-01-30_10-27-36.010670.json b/examples/data/appshield/Heur/snapshot-12/pslist_2022-01-30_10-27-36.010670.json
diff --git a/examples/data/appshield/Heur/snapshot-12/threadlist_2022-01-30_10-27-39.142386.json b/examples/data/appshield/Heur/snapshot-12/threadlist_2022-01-30_10-27-39.142386.json
diff --git a/examples/data/appshield/Heur/snapshot-12/vadinfo_2022-01-30_10-27-40.256811.json b/examples/data/appshield/Heur/snapshot-12/vadinfo_2022-01-30_10-27-40.256811.json
diff --git a/examples/data/appshield/Heur/snapshot-13/cmdline_2022-01-30_10-27-46.768326.json b/examples/data/appshield/Heur/snapshot-13/cmdline_2022-01-30_10-27-46.768326.json
diff --git a/examples/data/appshield/Heur/snapshot-13/envars_2022-01-30_10-27-47.392028.json b/examples/data/appshield/Heur/snapshot-13/envars_2022-01-30_10-27-47.392028.json
diff --git a/examples/data/appshield/Heur/snapshot-13/handles_2022-01-30_10-27-50.868866.json b/examples/data/appshield/Heur/snapshot-13/handles_2022-01-30_10-27-50.868866.json
diff --git a/examples/data/appshield/Heur/snapshot-13/ldrmodules_2022-01-30_10-27-46.119774.json b/examples/data/appshield/Heur/snapshot-13/ldrmodules_2022-01-30_10-27-46.119774.json
diff --git a/examples/data/appshield/Heur/snapshot-13/netscan_2022-01-30_10-27-53.140515.json b/examples/data/appshield/Heur/snapshot-13/netscan_2022-01-30_10-27-53.140515.json
diff --git a/examples/data/appshield/Heur/snapshot-13/pslist_2022-01-30_10-27-44.942274.json b/examples/data/appshield/Heur/snapshot-13/pslist_2022-01-30_10-27-44.942274.json
diff --git a/examples/data/appshield/Heur/snapshot-13/threadlist_2022-01-30_10-27-48.010827.json b/examples/data/appshield/Heur/snapshot-13/threadlist_2022-01-30_10-27-48.010827.json
diff --git a/examples/data/appshield/Heur/snapshot-13/vadinfo_2022-01-30_10-27-49.124816.json b/examples/data/appshield/Heur/snapshot-13/vadinfo_2022-01-30_10-27-49.124816.json
diff --git a/examples/data/appshield/Heur/snapshot-14/cmdline_2022-01-30_10-27-55.462305.json b/examples/data/appshield/Heur/snapshot-14/cmdline_2022-01-30_10-27-55.462305.json
diff --git a/examples/data/appshield/Heur/snapshot-14/envars_2022-01-30_10-27-56.125016.json b/examples/data/appshield/Heur/snapshot-14/envars_2022-01-30_10-27-56.125016.json
diff --git a/examples/data/appshield/Heur/snapshot-14/handles_2022-01-30_10-27-59.646114.json b/examples/data/appshield/Heur/snapshot-14/handles_2022-01-30_10-27-59.646114.json
diff --git a/examples/data/appshield/Heur/snapshot-14/ldrmodules_2022-01-30_10-27-54.849536.json b/examples/data/appshield/Heur/snapshot-14/ldrmodules_2022-01-30_10-27-54.849536.json
diff --git a/examples/data/appshield/Heur/snapshot-14/netscan_2022-01-30_10-28-01.868302.json b/examples/data/appshield/Heur/snapshot-14/netscan_2022-01-30_10-28-01.868302.json
diff --git a/examples/data/appshield/Heur/snapshot-14/pslist_2022-01-30_10-27-53.703266.json b/examples/data/appshield/Heur/snapshot-14/pslist_2022-01-30_10-27-53.703266.json
diff --git a/examples/data/appshield/Heur/snapshot-14/threadlist_2022-01-30_10-27-56.742443.json b/examples/data/appshield/Heur/snapshot-14/threadlist_2022-01-30_10-27-56.742443.json
diff --git a/examples/data/appshield/Heur/snapshot-14/vadinfo_2022-01-30_10-27-57.840927.json b/examples/data/appshield/Heur/snapshot-14/vadinfo_2022-01-30_10-27-57.840927.json
diff --git a/examples/data/appshield/Heur/snapshot-15/cmdline_2022-01-30_10-28-04.272964.json b/examples/data/appshield/Heur/snapshot-15/cmdline_2022-01-30_10-28-04.272964.json
diff --git a/examples/data/appshield/Heur/snapshot-15/envars_2022-01-30_10-28-04.953163.json b/examples/data/appshield/Heur/snapshot-15/envars_2022-01-30_10-28-04.953163.json
diff --git a/examples/data/appshield/Heur/snapshot-15/handles_2022-01-30_10-28-08.441869.json b/examples/data/appshield/Heur/snapshot-15/handles_2022-01-30_10-28-08.441869.json
diff --git a/examples/data/appshield/Heur/snapshot-15/ldrmodules_2022-01-30_10-28-03.626127.json b/examples/data/appshield/Heur/snapshot-15/ldrmodules_2022-01-30_10-28-03.626127.json
diff --git a/examples/data/appshield/Heur/snapshot-15/netscan_2022-01-30_10-28-10.736493.json b/examples/data/appshield/Heur/snapshot-15/netscan_2022-01-30_10-28-10.736493.json
diff --git a/examples/data/appshield/Heur/snapshot-15/pslist_2022-01-30_10-28-02.434170.json b/examples/data/appshield/Heur/snapshot-15/pslist_2022-01-30_10-28-02.434170.json
diff --git a/examples/data/appshield/Heur/snapshot-15/threadlist_2022-01-30_10-28-05.546145.json b/examples/data/appshield/Heur/snapshot-15/threadlist_2022-01-30_10-28-05.546145.json
diff --git a/examples/data/appshield/Heur/snapshot-15/vadinfo_2022-01-30_10-28-06.685749.json b/examples/data/appshield/Heur/snapshot-15/vadinfo_2022-01-30_10-28-06.685749.json
diff --git a/examples/data/appshield/Heur/snapshot-16/cmdline_2022-01-30_10-28-13.170175.json b/examples/data/appshield/Heur/snapshot-16/cmdline_2022-01-30_10-28-13.170175.json
diff --git a/examples/data/appshield/Heur/snapshot-16/envars_2022-01-30_10-28-13.853475.json b/examples/data/appshield/Heur/snapshot-16/envars_2022-01-30_10-28-13.853475.json
diff --git a/examples/data/appshield/Heur/snapshot-16/handles_2022-01-30_10-28-17.421832.json b/examples/data/appshield/Heur/snapshot-16/handles_2022-01-30_10-28-17.421832.json
diff --git a/examples/data/appshield/Heur/snapshot-16/ldrmodules_2022-01-30_10-28-12.533518.json b/examples/data/appshield/Heur/snapshot-16/ldrmodules_2022-01-30_10-28-12.533518.json
diff --git a/examples/data/appshield/Heur/snapshot-16/netscan_2022-01-30_10-28-19.820209.json b/examples/data/appshield/Heur/snapshot-16/netscan_2022-01-30_10-28-19.820209.json
diff --git a/examples/data/appshield/Heur/snapshot-16/pslist_2022-01-30_10-28-11.304689.json b/examples/data/appshield/Heur/snapshot-16/pslist_2022-01-30_10-28-11.304689.json
diff --git a/examples/data/appshield/Heur/snapshot-16/threadlist_2022-01-30_10-28-14.474304.json b/examples/data/appshield/Heur/snapshot-16/threadlist_2022-01-30_10-28-14.474304.json
diff --git a/examples/data/appshield/Heur/snapshot-16/vadinfo_2022-01-30_10-28-15.624847.json b/examples/data/appshield/Heur/snapshot-16/vadinfo_2022-01-30_10-28-15.624847.json
diff --git a/examples/data/appshield/Heur/snapshot-17/cmdline_2022-01-30_10-28-22.279820.json b/examples/data/appshield/Heur/snapshot-17/cmdline_2022-01-30_10-28-22.279820.json
diff --git a/examples/data/appshield/Heur/snapshot-17/envars_2022-01-30_10-28-22.961828.json b/examples/data/appshield/Heur/snapshot-17/envars_2022-01-30_10-28-22.961828.json
diff --git a/examples/data/appshield/Heur/snapshot-17/handles_2022-01-30_10-28-26.556573.json b/examples/data/appshield/Heur/snapshot-17/handles_2022-01-30_10-28-26.556573.json
diff --git a/examples/data/appshield/Heur/snapshot-17/ldrmodules_2022-01-30_10-28-21.610465.json b/examples/data/appshield/Heur/snapshot-17/ldrmodules_2022-01-30_10-28-21.610465.json
diff --git a/examples/data/appshield/Heur/snapshot-17/netscan_2022-01-30_10-28-28.935730.json b/examples/data/appshield/Heur/snapshot-17/netscan_2022-01-30_10-28-28.935730.json
diff --git a/examples/data/appshield/Heur/snapshot-17/pslist_2022-01-30_10-28-20.381565.json b/examples/data/appshield/Heur/snapshot-17/pslist_2022-01-30_10-28-20.381565.json
diff --git a/examples/data/appshield/Heur/snapshot-17/threadlist_2022-01-30_10-28-23.581147.json b/examples/data/appshield/Heur/snapshot-17/threadlist_2022-01-30_10-28-23.581147.json
diff --git a/examples/data/appshield/Heur/snapshot-17/vadinfo_2022-01-30_10-28-24.735272.json b/examples/data/appshield/Heur/snapshot-17/vadinfo_2022-01-30_10-28-24.735272.json
diff --git a/examples/data/appshield/Heur/snapshot-18/cmdline_2022-01-30_10-28-31.364334.json b/examples/data/appshield/Heur/snapshot-18/cmdline_2022-01-30_10-28-31.364334.json
diff --git a/examples/data/appshield/Heur/snapshot-18/envars_2022-01-30_10-28-32.009314.json b/examples/data/appshield/Heur/snapshot-18/envars_2022-01-30_10-28-32.009314.json
diff --git a/examples/data/appshield/Heur/snapshot-18/handles_2022-01-30_10-28-35.577547.json b/examples/data/appshield/Heur/snapshot-18/handles_2022-01-30_10-28-35.577547.json
diff --git a/examples/data/appshield/Heur/snapshot-18/ldrmodules_2022-01-30_10-28-30.714518.json b/examples/data/appshield/Heur/snapshot-18/ldrmodules_2022-01-30_10-28-30.714518.json
diff --git a/examples/data/appshield/Heur/snapshot-18/netscan_2022-01-30_10-28-37.943351.json b/examples/data/appshield/Heur/snapshot-18/netscan_2022-01-30_10-28-37.943351.json
diff --git a/examples/data/appshield/Heur/snapshot-18/pslist_2022-01-30_10-28-29.495682.json b/examples/data/appshield/Heur/snapshot-18/pslist_2022-01-30_10-28-29.495682.json
diff --git a/examples/data/appshield/Heur/snapshot-18/threadlist_2022-01-30_10-28-32.626539.json b/examples/data/appshield/Heur/snapshot-18/threadlist_2022-01-30_10-28-32.626539.json
diff --git a/examples/data/appshield/Heur/snapshot-18/vadinfo_2022-01-30_10-28-33.771251.json b/examples/data/appshield/Heur/snapshot-18/vadinfo_2022-01-30_10-28-33.771251.json
diff --git a/examples/data/appshield/Heur/snapshot-19/cmdline_2022-01-30_10-28-40.413905.json b/examples/data/appshield/Heur/snapshot-19/cmdline_2022-01-30_10-28-40.413905.json
diff --git a/examples/data/appshield/Heur/snapshot-19/envars_2022-01-30_10-28-41.081318.json b/examples/data/appshield/Heur/snapshot-19/envars_2022-01-30_10-28-41.081318.json
diff --git a/examples/data/appshield/Heur/snapshot-19/handles_2022-01-30_10-28-44.565776.json b/examples/data/appshield/Heur/snapshot-19/handles_2022-01-30_10-28-44.565776.json
diff --git a/examples/data/appshield/Heur/snapshot-19/ldrmodules_2022-01-30_10-28-39.771264.json b/examples/data/appshield/Heur/snapshot-19/ldrmodules_2022-01-30_10-28-39.771264.json
diff --git a/examples/data/appshield/Heur/snapshot-19/netscan_2022-01-30_10-28-46.868661.json b/examples/data/appshield/Heur/snapshot-19/netscan_2022-01-30_10-28-46.868661.json
diff --git a/examples/data/appshield/Heur/snapshot-19/pslist_2022-01-30_10-28-38.532482.json b/examples/data/appshield/Heur/snapshot-19/pslist_2022-01-30_10-28-38.532482.json
diff --git a/examples/data/appshield/Heur/snapshot-19/threadlist_2022-01-30_10-28-41.704092.json b/examples/data/appshield/Heur/snapshot-19/threadlist_2022-01-30_10-28-41.704092.json
diff --git a/examples/data/appshield/Heur/snapshot-19/vadinfo_2022-01-30_10-28-42.816266.json b/examples/data/appshield/Heur/snapshot-19/vadinfo_2022-01-30_10-28-42.816266.json
diff --git a/examples/data/appshield/Heur/snapshot-2/cmdline_2022-01-30_10-26-09.063587.json b/examples/data/appshield/Heur/snapshot-2/cmdline_2022-01-30_10-26-09.063587.json
diff --git a/examples/data/appshield/Heur/snapshot-2/envars_2022-01-30_10-26-09.741878.json b/examples/data/appshield/Heur/snapshot-2/envars_2022-01-30_10-26-09.741878.json
diff --git a/examples/data/appshield/Heur/snapshot-2/handles_2022-01-30_10-26-13.348160.json b/examples/data/appshield/Heur/snapshot-2/handles_2022-01-30_10-26-13.348160.json
diff --git a/examples/data/appshield/Heur/snapshot-2/ldrmodules_2022-01-30_10-26-08.416585.json b/examples/data/appshield/Heur/snapshot-2/ldrmodules_2022-01-30_10-26-08.416585.json
diff --git a/examples/data/appshield/Heur/snapshot-2/netscan_2022-01-30_10-26-15.507886.json b/examples/data/appshield/Heur/snapshot-2/netscan_2022-01-30_10-26-15.507886.json
diff --git a/examples/data/appshield/Heur/snapshot-2/pslist_2022-01-30_10-26-07.234099.json b/examples/data/appshield/Heur/snapshot-2/pslist_2022-01-30_10-26-07.234099.json
diff --git a/examples/data/appshield/Heur/snapshot-2/threadlist_2022-01-30_10-26-10.364669.json b/examples/data/appshield/Heur/snapshot-2/threadlist_2022-01-30_10-26-10.364669.json
diff --git a/examples/data/appshield/Heur/snapshot-2/vadinfo_2022-01-30_10-26-11.510219.json b/examples/data/appshield/Heur/snapshot-2/vadinfo_2022-01-30_10-26-11.510219.json
diff --git a/examples/data/appshield/Heur/snapshot-20/cmdline_2022-01-30_10-28-49.250538.json b/examples/data/appshield/Heur/snapshot-20/cmdline_2022-01-30_10-28-49.250538.json
diff --git a/examples/data/appshield/Heur/snapshot-20/envars_2022-01-30_10-28-49.915433.json b/examples/data/appshield/Heur/snapshot-20/envars_2022-01-30_10-28-49.915433.json