AbuseHelper is an open-source project initiated by the computer emergency response teams (CERTs) of Finland and Estonia with ClarifiedNetworks to automatically process incidents notifications.
This tool is being developed for CERTs and Internet Service Providers (ISPs) to help them in their daily job of following and treating a wide range of high-volume information sources. The framework can also be used for automatically processing (standardized) information from a wide range of sources.
CERTs and ISPs have to handle a very high-volume of notifications (E-mail spam, Botnets, ...). These notifications are often normalized per feed (each feed typically uses different formats to report). There is also a lot of information about Internet abuse, available by different feed providers (Zone-H Zone-Hhttp://www.zone-h.org/, DShield Dshieldhttp://www.dshield.org/, Zeus Tracker Zeus (Trojan horse) https://zeustracker.abuse.ch/...). This information is not well utilized, as the amount of information is too big for manual processing. AbuseHelper follows a number of sources and produces actionable reports and dashboard for the people that need to treat all these notifications. AbuseHelper also automates the enriching of information, such as finding the owners of reported IP addresses from public databases (such as Whois).
Technical developments that led to collaborative effort on solving the automated collection of Abuse Information
AbuseHelper is written in Python and developed relying on XMPP protocol (not mandatory) and agents. The base principle is to control agents via a central chat room where all bots are listening. Agents are exchanging information in subrooms. AbuseHelper relies on a modular approach to workflows and attempts to be scalable by keeping every agent simple.
The goal of AbuseHelper is to handle a large panel of sources and try to extract useful information to follow-up on events. Currently, AbuseHelper is able to parse the following types of sources:
The community is working on being able to handle more type of input formats. Each type of input is handled by a dedicated bot.
AbuseHelper is more than a pipe. In the workflow, it could be decided to add extra informations coming from other sources like:
By default, AbuseHelper produces the following kind of reports:
At all steps, there are standard agents:
AbuseHelper is developed by an open-source community composed by: