LinuxShell2Features | Unix/Linux Shell Feature Extraction Framework for Malware Detection

   

📖 Contents

• Installation Steps
• My Awesome Lists
• Contributing
• Contributors

Installation Steps

Install required tools on Linux

For Ubuntu 18.04, 20.04, 22.04

sudo apt-get update

Install required python libs

pip install

python -m venv w_pe
source w_pe/bin/activate
pip install --upgrade pip
pip install -r requirements.txt

conda install

conda config --add channels conda-forge
conda install --file requirements_conda.txt
python3 setup.py install

Extraction Framework

Extracted Feature	ShellCheck	bashlex	tree-sitter-bash	mvdan-sh	Semgrep	Joern	Regex	LinuxShell2Features
String and Literal Extraction	✅	✅	✅	✅	✅	⚠️	✅	❌
Comment Extraction	✅	✅	✅	✅	✅	⚠️	✅	❌
Token Extraction	✅	✅	✅	✅	⚠️	⚠️	⚠️	❌
Variable Extraction	✅	✅	✅	✅	✅	⚠️	⚠️	❌
Environment Variable Extraction	✅	✅	✅	✅	✅	⚠️	✅	❌
Function Extraction	✅	✅	✅	✅	✅	⚠️	⚠️	❌
Function Parameter Extraction	⚠️	⚠️	⚠️	⚠️	⚠️	⚠️	⚠️	❌
Positional Parameter Extraction	✅	✅	✅	✅	✅	⚠️	✅	❌
Command Extraction	✅	✅	✅	✅	✅	⚠️	⚠️	❌
Built-in Command Extraction	✅	✅	✅	✅	✅	⚠️	⚠️	❌
External Executable Call Extraction	✅	✅	✅	✅	✅	⚠️	⚠️	❌
Command Substitution Extraction	✅	✅	✅	✅	✅	⚠️	✅	❌
Pipeline Extraction	✅	✅	✅	✅	✅	⚠️	⚠️	❌
Redirection Extraction	✅	✅	✅	✅	✅	⚠️	✅	❌
Here-Document Extraction	✅	✅	✅	✅	✅	⚠️	✅	❌
File-System Operation Extraction	⚠️	⚠️	⚠️	⚠️	✅	⚠️	✅	❌
Network Operation Extraction	⚠️	⚠️	⚠️	⚠️	✅	⚠️	✅	❌
Process-Creation Extraction	⚠️	⚠️	⚠️	⚠️	✅	⚠️	⚠️	❌
Privilege-Escalation Command Extraction	⚠️	⚠️	⚠️	⚠️	✅	⚠️	✅	❌
Cron and Scheduled-Task Extraction	⚠️	⚠️	⚠️	⚠️	✅	⚠️	✅	❌
Package-Management Command Extraction	⚠️	⚠️	⚠️	⚠️	✅	⚠️	✅	❌
Service-Management Command Extraction	⚠️	⚠️	⚠️	⚠️	✅	⚠️	✅	❌
Download-and-Execute Pattern Detection	⚠️	⚠️	⚠️	⚠️	✅	⚠️	✅	❌
Dynamic Execution and eval Detection	✅	✅	✅	✅	✅	⚠️	✅	❌
Obfuscation Indicator Extraction	⚠️	⚠️	⚠️	⚠️	✅	⚠️	✅	❌
Base64-Encoded Content Detection	⚠️	⚠️	⚠️	⚠️	✅	⚠️	✅	❌
Suspicious Command Detection	✅	⚠️	⚠️	⚠️	✅	⚠️	✅	❌
Syntax and Parse-Error Detection	✅	✅	✅	✅	✅	⚠️	❌	❌
Portability-Issue Detection	✅	❌	❌	✅	⚠️	❌	❌	❌
Quoting and Word-Splitting Detection	✅	❌	❌	⚠️	⚠️	❌	⚠️	❌

My Awesome Lists

You can access the my awesome lists here

Contributing

Contributions of any kind welcome, just follow the guidelines!

Contributors

Thanks goes to these contributors!

License

🔼 Back to top