ercpe / amavisvt / 13
87%

DEFAULT BRANCH: master
Ran
Jobs 2
Files 7
Run time 17s
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
13

push

travis-ci

ercpe 
New Feature: filename pattern detection

Infected mails often come with similiar named emails - something "unpaid_invoice_1234.zip" or "report_1234.zip".
This EXPERIMENTAL feature maintains a sqlite database with these filenames and reject files that are similiar named and have previously detected as infected.

The filenames is split into chunks (seperator are _, - and .). The resulting tuple is compared against the other filename entries in the database. If another filenames differ at exactly one chunk, the pattern is recorded in the database.

Example
- weekly_report_1234.zip
- weekly_report-5678.zip
- weekly-report.foobar.zip

will all create the pattern 'weekly-report-[RANDOM]-zip'.

AmavisVT will flag these files as infected, if:
- there are more than "min-filename-patterns" (default: 20) entries with this pattern in the database
- more than "infected-percent" (default: 0.7 = 70%) of these entries have been detected as infected

Additionaly, AmavisVT will send these files to Virustotal if the "auto-report" setting is set to true.

WARNING: This will send the actual content of the attachments to Virustotal. DO NOT enable this setting if
         a legitimate attachment may be caught by the pattern detection!

AmavisVT's database requires sqlite support in python.

The filename pattern detection feature requires the fuzzywuzzy library (https://github.com/seatgeek/fuzzywuzzy) to be installed.

280 of 576 relevant lines covered (48.61%)

0.97 hits per line

Jobs
ID Job ID Ran Files Coverage
1 13.1 0
48.61
 Travis Job 13.1
4 13.4 0
48.61
 Travis Job 13.4
Source Files on build 13
Detailed source file information is not available for this build.