Hello Philipp,
the good Konrad pointed me to your project.
I have two questions:
(1) did you publish the code to convert the learned reports i.e. learned_wc.json to cuckooelements2mist.xml?
(2) rather than generating the mist numbering in a sequential manner, would it be possible to integrate it with my code over here: https://github.com/robomotic/cluestering/blob/master/src/scanner/multimistserial.py
In this way we will use the same numbering as used in the existing MIST reports.
For example right now:Process MIST Level 1 is 05 but should be 0A as learned from the CWS Sequential reports.
Why do I need this?
It's handy to pre-load the database with existing classified malware rather than bootstrapping everything with cuckoo reports.
I am thinking I can do the JSON to XML conversion by obeying my learned.
Will let you know.
Here's a better version of the learn_cuckoo.
Hi Paolo,
(1) was performed manually.
(2) i'll try to adopt this, But i would suggest to use the numbering use in my original cws2mist converter.
Regards,
Hello Philipp,
oky will preserve that as the default option!
Cheers.
To make things quicker you could add me as a developer so I can branch and push changes on that.
:-)