def rule29(HEADER):
if HKEY_existence(HEADER, 'dkim-signature') == 1 and HKEY_existence(
HEADER, 'received-spf') == 1 and HKEY_existence(
HEADER, 'from') == 1 and HKEY_existence(
HEADER, 'authentication-results') == 1 and HKEY_existence(
HEADER, 'return-path') == 1:
try:
from_dom = reg_domain2.findall(HEADER['from'][0])[0]
except:
from_dom = 'NOFROM_DOM'
try:
rp_dom = reg_domain2.findall(HEADER['return-path'][0])[0]
except:
rp_dom = 'NORP_DOM'
dkim_stat = DKIM_STATUS(HEADER)
try:
dkim_dom = HEADER['dkim-signature'][0].split('d=')[1].split(
' ')[0].split(';')[0]
except:
dkim_dom = '!@#$%^'
if from_dom in rp_dom and HEADER['received-spf'][0].startswith(
'pass') and dkim_dom in from_dom and dkim_stat == 'pass':
return 1
else:
return 0
else:
return -1
def rule25(HEADER):
if HKEY_existence(HEADER, 'received-spf') == 1 and HKEY_existence(
HEADER, 'from') == 1 and HKEY_existence(HEADER,
'return-path') == 1:
# print('true')
rcvd_spf = HEADER['received-spf'][0]
try:
from_dom = reg_domain2.findall(HEADER['from'][0])[0]
except:
from_dom = 'NOFROM_DOM'
try:
rp_dom = reg_domain2.findall(HEADER['return-path'][0])[0]
except:
rp_dom = 'NORP_DOM'
if from_dom in rp_dom and HEADER['received-spf'][0].startswith('fail'):
return 1
else:
return 0
else:
return -1
def rule28(HEADER):
if HKEY_existence(HEADER, 'dkim-signature') == 1 and HKEY_existence(
HEADER, 'from') == 1 and HKEY_existence(
HEADER, 'authentication-results') == 1:
# print('true')
dkim_stat = DKIM_STATUS(HEADER)
try:
dkim_dom = HEADER['dkim-signature'][0].split('d=')[1].split(
' ')[0].split(';')[0]
except:
dkim_dom = '!@#$%^'
try:
from_dom = reg_domain2.findall(HEADER['from'][0])[0]
except:
from_dom = 'NOFROM_DOM'
if dkim_dom not in from_dom and dkim_stat == 'pass':
return 1
else:
return 0
else:
return -1
def _feature_learning(HEADER_LIST_B, HEADER_LIST_PH, zer, yey, ney):
count = 0
hdrs = []
cls = 1
dummy = '^'
for HEADER_LIST in [HEADER_LIST_B, HEADER_LIST_PH]:
for hdr in HEADER_LIST:
hdrf = []
hdr_key = hdr.keys()
#class
hdrf.append(cls)
if 'from' in hdr_key:
# from_dom = extract_domain(hdr,'from')
# from_dom = None
from_dom = DOMAIN(hdr, 'from')
if not from_dom:
from_dom = '$!'
else:
from_dom = '$!'
if 'reply-to' in hdr_key:
repto_dom = DOMAIN(hdr, 'reply-to')
if not repto_dom:
repto_dom = '!&'
else:
repto_dom = '!&'
if 'return-path' in hdr_key:
retpath = DOMAIN(hdr, 'return-path')
if not retpath:
retpath = '#&'
else:
retpath = '#&'
# 'from=originator'
if 'received' in hdr_key:
if from_dom in ORIGINATOR_domain(hdr):
hdrf.append(yey)
else:
hdrf.append(ney)
else:
hdrf.append(zer)
# 'from!=originator'
if 'received' in hdr_key:
if from_dom not in ORIGINATOR_domain(hdr):
hdrf.append(yey)
else:
hdrf.append(ney)
else:
hdrf.append(zer)
# 'from_dom=ret_path'
if 'return-path' in hdr_key:
if retpath in from_dom:
hdrf.append(yey)
else:
hdrf.append(ney)
else:
hdrf.append(zer)
# 'from_dom!=ret_path'
if 'return-path' in hdr_key:
if retpath not in from_dom:
hdrf.append(yey)
else:
hdrf.append(ney)
else:
hdrf.append(zer)
# 'from=reply_to'
if 'reply-to' in hdr_key and 'from' in hdr_key:
if from_dom in repto_dom:
hdrf.append(yey)
else:
hdrf.append(ney)
else:
hdrf.append(zer)
# 'from!=reply_to'
if 'from' in hdr_key and 'reply-to' in hdr_key:
if from_dom not in repto_dom:
hdrf.append(yey)
else:
hdrf.append(ney)
else:
hdrf.append(zer)
# 'originator=ret_path'
if 'received' in hdr_key and 'return-path' in hdr_key:
if retpath in ORIGINATOR_domain(hdr):
hdrf.append(yey)
else:
hdrf.append(ney)
else:
hdrf.append(zer)
# 'originator!=ret_path'
if 'received' in hdr_key and 'return-path' in hdr_key:
if ORIGINATOR_domain(hdr) not in retpath:
hdrf.append(yey)
else:
hdrf.append(ney)
else:
hdrf.append(zer)
# 'SPF(neutral)'
# if HKEY_existence(hdr, 'received-spf') == 1:
# if hdr['received-spf'][0].startswith('neutral'):
# hdrf.append(yey)
# else:
# hdrf.append(ney)
# else:
# hdrf.append(zer)
# # 'SPF(exist)'
# if HKEY_existence(hdr, 'received-spf') == 1:
# hdrf.append(yey)
# else:
# hdrf.append(ney)
# 'SPF(pass\fail)'
if HKEY_existence(hdr, 'received-spf') == 1:
if hdr['received-spf'][0].startswith('pass'):
hdrf.append(yey)
elif hdr['received-spf'][0].startswith('fail'):
hdrf.append(ney)
else:
hdrf.append(ney)
else:
hdrf.append(zer)
# 'DMARC(exist)'
if DMARC_existence(hdr) == 1:
hdrf.append(yey)
else:
hdrf.append(zer)
# 'DMARC(pass)'
if DMARC_existence(hdr) == 1:
print('exist')
if 'dmarc=pass' in ' '.join(hdr['authentication-results']):
hdrf.append(yey)
elif 'dmarc=fail' in ' '.join(hdr['authentication-results']):
hdrf.append(zer)
else:
hdrf.append(zer)
else:
hdrf.append(zer)
hdrs.append(hdrf)
print('item: ', count)
count += 1
cls = -1
return hdrs