Spaces:
Running
Running
File size: 2,177 Bytes
75f5bd8 0e4c3b7 75f5bd8 0e4c3b7 75f5bd8 0e4c3b7 75f5bd8 0e4c3b7 75f5bd8 5472827 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 |
from parse_email import parse_email
from header_analyzer import analyze_headers
from body_analyzer import analyze_body
from url_analyzer import analyze_urls
def analyze(file_path):
headers, body, urls = parse_email(file_path)
# Run individual analyzers (each returns findings + score)
header_findings, header_score = analyze_headers(headers)
body_findings, body_score = analyze_body(body)
url_findings, url_score = analyze_urls(urls)
total_score = header_score + body_score + url_score
# --- Determine verdict ---
if total_score >= 70:
verdict = "🚨 Malicious"
elif 50 <= total_score < 70:
verdict = "⚠️ Suspicious"
elif 30 <= total_score < 50:
verdict = "📩 Spam"
else:
verdict = "✅ Safe"
# --- Attack Type (basic heuristic) ---
if "invoice" in body.lower() or "payment" in body.lower():
attack_type = "Invoice/Payment Fraud"
elif "verify" in body.lower() or "password" in body.lower():
attack_type = "Credential Harvesting"
elif verdict == "📩 Spam":
attack_type = "Spam / Marketing"
else:
attack_type = "General Phishing"
# --- Collect tags ---
tags = []
for finding in header_findings + body_findings + url_findings:
if "domain" in finding.lower():
tags.append("Suspicious Sender Domain")
if "phishing" in finding.lower():
tags.append("Phishing URL")
if "urgent" in finding.lower() or "suspicious phrase" in finding.lower():
tags.append("Urgent Language")
if "spam" in finding.lower():
tags.append("Spam Tone")
# --- Build report ---
report = [
f"Attack Score: {total_score}",
f"Attack Type: {attack_type}",
f"Final Verdict: {verdict}",
"---- Attack Analysis Tags ----",
", ".join(set(tags)) if tags else "No special tags",
"---- Detailed Findings ----",
]
report.extend(header_findings + body_findings + url_findings)
return report
if __name__ == "__main__":
file_path = "sample.eml"
findings = analyze(file_path)
for f in findings:
print(f)
|