lisa - Sandbox for automated Linux malware analysis.

项目说明

<p>
<img width="300" height="auto" src="web_frontend/src/logo-white.png" alt="LiSa" />
</p>

Project pro automated Linux malware analysis on CPU architectures.

Table of contents

!LiSa

Features

Get Started

Requirements

1. Get repository.

2. Build.

3. Run the sandbox (default location: ).

Configuration

MaxMind GeoLite2

Sign up to get your API key. Use API key in docker-compose.yml build args section.

Web hosting

Setup your server's IP:port in nginx service in docker-compose.yml.

Scaling

Workers are scalable.

VPN

You can route malware's traffic through OpenVPN. In order to do that:

1. Mount containing Open (named config.ovpn).
2. Set en VPN to Open's directory path.

Blacklists

Default used blacklists are (source):

If you want to use any other blacklist, put .ipset or .netset files into data/blacklists. All of these blacklists are merged during build of worker service.

Adding new sub-analysis modules

Core of LiSa project supports 4 basic modules of analysis: static_analysis, dynamic_analysis, network_analysis and .
Sub-analysis modules are plugin-based. For adding new sub-analysis and appending it's output to final json do following:

1. Create class which inherits from AbstractSubAnalyzer class and implement run_analysis() method eg.:

2. Update list in lisa.config.py :

Running tests

Upcoming features

1. YARA module - YARA module to match patterns in LiSa's JSON output.
2. Images selection - More Linux images containing e.g. IoT firmware.

Contribute

Contributions | feedback | issues | pull requests are welcome.

Related work

License

LiSa is licensed under Apache License 2.0.

项目信息

开发语言：Python

Star 数：487

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Sandbox for automated Linux malware analysis.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。