CoolFace
Apppublic

lyzq/malicious-url-app

sourceHugging Faceupdated 6mo agoView on Hugging Face
0likes
features.cpython-314.pyc37 linesDownload Raw Back to __pycache__
1+
2�!�ia��&�^RIHt^RIt^RIt^RIHt^RIHt^RIH	t	^RI3t^RIt
^RIHtHtRt0Rmt]P&!R4t]P&!R4tR	R4ltRRltR
RltRRltRRltRRltRRlt!RR]]4tR#)�)�annotationsN)�Counter)�Iterable)�urlsplit)�
BaseEstimator�TransformerMixinz\.([a-z]{2,24})$z(?:\d{1,3}\.){3}\d{1,3}c� �V^8�dQhRRRR/#)��url�object�return�str�)�formats"�$E:\malicious_url_app\src\features.py�__annotate__r1s��+�+��+�C�+�c���VfR#\V4P4PR4PR4pV'gR#VPRR4P4#)N��"�'�\�/)r�strip�replace�lower)r�texts& r�standardize_urlr1sP��5�{���s�8�>�>��!�!�#�&�,�,�S�1�D����<�<��c�"�(�(�*�*rc� �V^8�dQhRRRR/#)r6rrr
r)rs"rrr:s��4�4�S�4�S�4rc�2�V'gR#RV9dV#RV2#)rz://zhttp://r)rs&r�ensure_parsable_urlr!:s�����3�,�3�3�g�c�U�O�3rc� �V^8�dQhRRRR/#)r7rrr
�floatr)rs"rrr@s��[�[�#�[�%�[rc�a�V'gR#\V4p\V4o\V3RlVP444)#)�c3�x<"�TF/qS,\P!VS,4,x�K1	R#5i�N)�math�log2)�.0�count�lengths& �r�	<genexpr>�"shannon_entropy.<locals>.<genexpr>Es(����Z�/����4�9�9�U�V�^�#<�<�<�/�s�7:)r�len�sum�values)r�countsr,s& @r�shannon_entropyr3@s5�����
�T�]�F�
��Y�F��Z�&�-�-�/�Z�Z�Z�Zrc�$�V^8�dQhRRRRRR/#)r8�	numeratorr#�denominatorr
r)rs"rrrHs&��I�I�%�I�e�I��Irc�L�V'd\V4\V4,#R#�r%)r#)r5r6s&&r�9safe_ratior9Hs��4?�5���e�K�0�0�H�S�Hrc� �V^8�dQhRRRR/#)r10rrr
zdict[str, float]r)rs"rrrLs��:�:��:�!1�:rc11�"a�\V4o\\S44pVPP	R4R3,pVP12;'gRpVP;'gRpVP;'gRpV'dVRV2MTp\RS44p\RS44p\RS44p	SPR4p13VP	R4Uu.uFq�'gKVNK	pp\\V4^,14^4p
\PV4pV'd\VP^44M^p\VP	R4Uu.uFq�'gKVNK	up4p\V3Rl\44p\V3R	lR444p/R15\S4bR\V4bR\V4bR
\V4bR\V4bRVbRV
bRSPR4bRVbRVbRV	bRSPR4bRSPR4bRSPR4bRSPR4bRSPR4bRSPR4b/R V16bR!VbR"VbR#\!\#\$PV444bR$\!R%V94bR&\!R'S94bR(\!VP&R'8H4bR)\!\#V44bR*\!\#V44bR+\!V17^8�4bR,\!R-V94bR.\!V\(94bR/VbR0\+V\S44bR1\+V	\S44bR2\-S4bC#uupiuupi)5�@r�?c3�@"�TFqP4x�K	R#5ir')�isdigit�r*�chars& rr-�"lexical_signals.<locals>.<genexpr>V����;���l�l�n�n����c3�@"�TFqP4x�K	R#5ir')�isalphar@s& rr-rBWrCrDc3�J"�TFqP4'*x�K	R#5ir')�isalnumr@s& rr-rBXs���A�y�t�L�L�N�*�*�y�s�!#�.rc3�,<"�TF	qS9x�K	R#5ir'r�r*�token�	clean_urls& �rr-rBas���� S�AR��)�!3�AR���c3�,<"�TF	qS9x�K	R#5ir'rrKs& �rr-rBbs����k�6j�U�y�(�6j�rN�18url_length�hostname_length�path_length�query_length�fragment_length�19path_depth�subdomain_count�	dot_count�digit_count�alpha_count�
special_count�hyphen_count�-�underscore_count�_�slash_count�ampersand_count�&�eq_count�=�
percent_count�%�at_count�suspicious_token_count�brand_token_count�contains_ip�contains_punycodezxn--�contains_https_token�https�uses_https_scheme�	has_query�has_fragment�
has_at_symbol�has_double_slash_in_pathz//�is_shortener�20tld_length�digit_ratio�
special_ratio�entropy�����)�paypal�	microsoft�apple�google�amazon)rrr!�netloc�split�path�query�fragmentr0r+�maxr/�TLD_PATTERN�search�group�SUSPICIOUS_TOKENSr#�bool�IPV4_PATTERN�scheme�21SHORTENERSr9r3)r�parsed�hostnamerr�r��	full_pathrXrYrZrf�part�22host_partsrV�	tld_matchrsrUrg�brand_countrMs&                  @r�lexical_signalsr�Ls������$�I�
�)�)�4�
5�F��}�}�"�"�3�'��+�H��;�;���"�D��L�L���B�E����$�$�"�H�%*�4�&��%��!��I��;��;�;�K��;��;�;�K��A�y�A�A�M����s�#�H�#+�>�>�#�#6�?�#6�4�$�$�$�#6�J�?��#�j�/�A�-�q�1�O��"�"�8�,�I�,5��Y�_�_�Q�'�(�1�J��t�z�z�#��?��t�$�d�d��?�@�J� � S�AR� S�S���k�6j�k�k�K�"��c�)�n�"��3�x�=�"�	�s�4�y�"�	��E�23�	"�24	�3�x�=�"�	�j�
"�	�?�"�	�Y�_�_�S�)�"�	�{�"�	�{�"�	��"�	�	����,�"�	�I�O�O�C�0�"�	�y���s�+�"�	�9�?�?�3�/�"� 	�I�O�O�C�(�!"�"	�����-�#"�$	�H�%"�&	!�"8�'"�(	�[�)"�*	�u�T�,�"5�"5�h�"?�@�A�+"�,	�U�6�X�#5�6�-"�.	��g��&:� ;�/"�0	�U�6�=�=�G�#;�<�1"�2	�U�4��;�'�3"�4	��d�8�n�-�5"�6	��x�!�|�,�7"�8	#�E�$�)�*;�$<�9"�:	��h�*�4�5�;"�<	�j�="�>	�z�+�s�9�~�>�?"�@	��M�3�y�>�B�A"�B	�?�9�-�C"�"��@��@s�0	N�>N�3	N�Nc� �V^8�dQhRRRR/#)r25�urls�Iterable[object]r
zpd.DataFramer)rs"rrr�s��*�*�#3�*��*rc��VUu.uFp\\V44NK	pp\P!V4P	R4#uupir8)r�r�pd�	DataFrame�fillna)r�r�rowss&  r�extract_lexical_featuresr��s@��=A�B�T�c�O�O�C�0�1�T�D�B�
�<�<���$�$�S�)�)��Cs�A	c� �V^8�dQhRRRR/#)r26rrr
z	list[str]r)rs"rrr�s����s��y�rc�(�\V4p.pVR,'dVPR4VR,^8�dVPR4VR,^K8�dVPR4VR,^8�dVPR4VR,'dVPR	4VR27,^8Xd!VR,'dVPR4VR
,'dVPR4V'gVPR4V#)riz%Host appears to use a raw IP address.rgzIURL contains multiple high-risk lure words like login, verify, or secure.rPzDURL is unusually long, which often hides redirect or phishing paths.rVz8URL uses several subdomains, a common obfuscation trick.rpz6URL contains '@', which can hide the true destination.rmrkz=The text contains 'https' but the actual scheme is not HTTPS.rrzEURL uses a shortening service that can conceal the final destination.zCNo obvious lexical red flags were triggered by the heuristic layer.)r��append)r�features�messagess&  r�summarize_url_signalsr��s����s�#�H��H��
������?�@��(�)�Q�.����c�d�����#����^�_��!�"�a�'����R�S��� � ����P�Q��#�$��)�h�7M�.N�.N����W�X��������_�`�����]�^��Orc�2�]tRt^�tRRRlltRRltRtR#)�LexicalFeatureExtractorNc�$�V^8�dQhRRRRRR/#)r28�Xr��yrr
z'LexicalFeatureExtractor'r)rs"rr�$LexicalFeatureExtractor.__annotate__�s#����%��&��<U�rc	��V#r'r)�selfr�r�s&&&r�fit�LexicalFeatureExtractor.fit�s���rc� �V^8�dQhRRRR/#)r29r�r�r
z30np.ndarrayr)rs"rrr��s��+�+�+�+�31�+rc	�D�\V4pVP\R7#))�dtype)r��to_numpyr#)r�r��frames&& r�	transform�!LexicalFeatureExtractor.transform�s��(��+���~�~�E�~�*�*rrr')�__name__�32__module__�__qualname__�__firstlineno__r�r��__static_attributes__rrrr�r��s���+�+rr�)�login�verify�update�account�secure�signin�banking�confirm�passwordrx�invoice�wallet�bonus�gift�free>33�t.co�is.gd�ow.ly�bit.ly�goo.gl�buff.ly�cutt.ly�lnkd.in�34rebrand.ly�tinyurl.com)�35__future__rr(�re�collectionsr�typingr�urllib.parser�numpy�np�pandasr��sklearn.baserrr�r��compiler�r�rr!r3r9r�r�r�r�rrr�<module>r�s���"��	���!���8���$�36��j�j�,�-���z�z�4�5��+�4�[�I�:�z*�37�,+�m�-=�+r