{
    "info": {
        "author": "{ ministry of promise }",
        "author_email": "adam.j.nichols@gmail.com",
        "bugtrack_url": null,
        "classifiers": [
            "Development Status :: 3 - Alpha",
            "License :: OSI Approved :: MIT License",
            "Topic :: Utilities"
        ],
        "description": "# threat language parser\n\ntlp is a python library that parses a body of text for indicators of compromise (iocs), leveraging the amazing [textblob](http://textblob.readthedocs.org/en/dev/) and [nltk](http://www.nltk.org/) natural language processing modules to derive context and color around those iocs.  The goal of tlp is to allow security analysts and researchers to extract and store meaningful data from the endless stream of information they encounter daily, without the tedium of endless ctrl+c, ctrl+v workflow.\n\nTo solve this problem, tlp uses a combination of regular expression, part-of-speech tagging, list filters, and simple statistical analysis to extract the following data from narritive-style prose:\n\n- document summary\n- indicators of compromise, with associated stats\n- key words and phrases, with associated stats\n- parser debugging information\n\n## Installation\n\ntlp can be found on PyPi, and installed with:\n    \n    $ pip install tlp\n\nyou are also able to clone this repo, and run:\n\n    $ python setup.py install\n    \n## Dependencies\n\nThe following modules are required for tlp to function:\n\n### TextBlob\nTextBlob will be installed by default.  if you need to install manually, run:\n\n        $ pip install -U textblob\n\n*PLEASE NOTE:* Regardless of whether TextBlob is automatically or manually installed, you'll need to download and install the rest of the nltk corpora by running the following command:\n\n        $ python -m textblob.download_corpora\n    \n### numpy   \nNote that most numpy installs require compilation, so you will probably have to install this as a standalone by running:\n\n        $ pip install -U numpy\n        \n### python-Levenshtein\nThis dependency should be installed by setuptools automatically, but in the event that fails:\n\n        $ pip install -U python-Levenshtein\n        \n## Usage\n\n        >>> from tlp import TLP\n        >>> ...\n        >>> threat_text = get_threat_data_from_something()\n        >>> tlp = TLP(threat_text)\n        >>>\n        >>> # get summary\n        >>> tlp.summary\n        u\"This report outlines a terrible scourge upon our internets: miscreants. We have\n        discovered that miscreants are systematically taking over the series of tubes, and\n        and are attempting to leverage them to proliferate their love of 'My Little Pony.' \n        Let's explore how we punched them repeatedly with our data.\"\n        >>>\n        >>> # get keywords, occurance counts\n        >>> tlp.keywords\n        [\n            (u'miscreant', 97), \n            (u'punch', 39), \n            (u'whiskey', 18)\n        ]\n        >>>\n        >>> # get iocs, sorted by type\n        >>> tlp.iocs\n        {\n            'cve': set([u'cve-2011-0611', \n                        u'cve-2013-1347', \n                        u'cve-2013-2465']),\n            'domain': set([u'miscreantsmustsuffer.com',\n                           u'ministryofpromise.co.uk']),\n            'ip': set([u'8.8.4.4',\n                       u'127.0.0.1']),\n            'md5': set([u'6fc67ebcb6423efa06198cd123ffc3ee']),\n            'sha1': set([]),\n            'sha256': set([])\n        }\n        >>>\n        >>> # get tlp color (if present)\n        >>> tlp.color\n        set([u'white'])\n        >>>\n        >>> # get debug info, including total word count, and word frequency mean/stddev\n        >>> tlp.debug\n        {\n            'keywords': {\n                'std': 2.5559937998299809, \n                'total': 1012, \n                'mean': 2.0321285140562249\n            }, \n            'iocs': {\n                'ip': 2,\n                'domain': 2, \n                'md5': 1\n                'sha1': 0,\n                'sha256': 0,\n                'cve': 3\n            }\n        }\n        >>>\n        >>> # get complete filtered text used for data distillation \n        >>> tlp.text\n        u\"This report outlines a terrible scourge upon our internets: miscreants. We have\n        discovered that miscreants are systematically taking over the series of tubes, and\n        and are attempting to leverage them to proliferate their love of 'My Little Pony.' \n        Let's explore how we punched them repeatedly with our data.\n        ...\n        \n        \"In conclusion -- bottom's up!\"\n        \n\n## Todo\n\n- Improve keyword accuracy with a more robust statistical approach and better contextual language processing\n- Modify ioc filter engine to allow for more modular filter management\n- Allow for more flexibility in parsing and filtering at object creation \n- Grow/improve regex and filter sets\n- Include the use of \"title\" __init__ arg in keyword weighting\n\n## Contributing\nThis is very much an alpha, so we expect some folks will quickly spot inefficiencies or better ways to solve the problem.  All pull requests are welcome. :)\n\nIf you are a threat intelligence publisher who would like to be added to the tlp whitelist, please [contact](mailto:github@ministryofpromise.co.uk) us.\n\n## License\nThe MIT License (MIT)\n\nCopyright (c) 2015 { ministry of promise }\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.",
        "description_content_type": null,
        "docs_url": null,
        "download_url": "UNKNOWN",
        "downloads": {
            "last_day": -1,
            "last_month": -1,
            "last_week": -1
        },
        "home_page": "http://github.com/ministryofpromise/tlp",
        "keywords": "tlp threat language parser ioc nlp textblob nltk",
        "license": "MIT",
        "maintainer": null,
        "maintainer_email": null,
        "name": "tlp",
        "package_url": "https://pypi.org/project/tlp/",
        "platform": "UNKNOWN",
        "project_url": "https://pypi.org/project/tlp/",
        "project_urls": {
            "Download": "UNKNOWN",
            "Homepage": "http://github.com/ministryofpromise/tlp"
        },
        "release_url": "https://pypi.org/project/tlp/0.1.1/",
        "requires_dist": null,
        "requires_python": null,
        "summary": "tlp is a python library that parses a body of text for indicators of compromise (iocs) using natural language processing modules to derive their context.",
        "version": "0.1.1"
    },
    "last_serial": 1511831,
    "releases": {
        "0.1.0": [
            {
                "comment_text": "",
                "digests": {
                    "md5": "4e3cf6069afda3c8635540a3479abe79",
                    "sha256": "2254fd81c49b9fb8a46e9c4d7310da9f9d7dbc4c8de8894c6125208478604449"
                },
                "downloads": -1,
                "filename": "tlp-0.1.0.tar.gz",
                "has_sig": false,
                "md5_digest": "4e3cf6069afda3c8635540a3479abe79",
                "packagetype": "sdist",
                "python_version": "source",
                "requires_python": null,
                "size": 76486,
                "upload_time": "2015-04-19T21:01:17",
                "url": "https://files.pythonhosted.org/packages/66/2e/cb4c4b554920c107501440890867a9323a7997dd526d26b9c97902fe4989/tlp-0.1.0.tar.gz"
            }
        ],
        "0.1.1": [
            {
                "comment_text": "",
                "digests": {
                    "md5": "1aa899bd28a96b369a47a41be629bdff",
                    "sha256": "aae051a643d1961db6fcd6315e71455f1c2f6682cb802ebf6027a2cfb023391a"
                },
                "downloads": -1,
                "filename": "tlp-0.1.1.tar.gz",
                "has_sig": false,
                "md5_digest": "1aa899bd28a96b369a47a41be629bdff",
                "packagetype": "sdist",
                "python_version": "source",
                "requires_python": null,
                "size": 77052,
                "upload_time": "2015-04-19T21:14:39",
                "url": "https://files.pythonhosted.org/packages/82/f3/e939482fef0d51acc9eaa81c09e8b6cba411ae08975472a267c8c981a4eb/tlp-0.1.1.tar.gz"
            }
        ]
    },
    "urls": [
        {
            "comment_text": "",
            "digests": {
                "md5": "1aa899bd28a96b369a47a41be629bdff",
                "sha256": "aae051a643d1961db6fcd6315e71455f1c2f6682cb802ebf6027a2cfb023391a"
            },
            "downloads": -1,
            "filename": "tlp-0.1.1.tar.gz",
            "has_sig": false,
            "md5_digest": "1aa899bd28a96b369a47a41be629bdff",
            "packagetype": "sdist",
            "python_version": "source",
            "requires_python": null,
            "size": 77052,
            "upload_time": "2015-04-19T21:14:39",
            "url": "https://files.pythonhosted.org/packages/82/f3/e939482fef0d51acc9eaa81c09e8b6cba411ae08975472a267c8c981a4eb/tlp-0.1.1.tar.gz"
        }
    ]
}