Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time

Malware Classifier From Network Capture

Malware Classifier is a simple free software project done during an university workshop of 4 hours. The objective of the 4 hours workshop was to introduce network forensic and simple techniques to classify malware network capture (from their execution in a virtual machine). So the software was kept very simple while using and learning existing tools (networkx, redis and Gephi).


  • Python 2.7
  • networkx and redis modules (pip install -r REQUIREMENTS)
  • tshark (part of Wireshark)
  • a Redis server

How to use the Malware Classifier

You'll need of a set of network packet captures. In the workshop, we use a dataset with more than 5000 pcap files generated from the execution of malware in virtual machines.


The filename includes the MD5 malware executed in the virtual machine.

If you want to classify malware communications based on the Server HTTP headers of the (potential) C&C communication.

cd capture
ls -1 . | parallel --gnu "cat {1} | tshark -E header=yes -E separator=, -Tfields -e http.server -r {1} | python ./bin/  -f {1} "

You can add additional attributes like any fields from the dissectors available within tshark (tshark -G fields). You can add additional fields in the command above. This will update the redis data structure. Then when you have enough attributes, you can dump a graph out of the relationships between the attributes and the malware packet captures.

python ./bin/ generates a GEXF file that you can import in gephi.

The output in Gephi can look like this:

a sample graph of clustering per User-Agent of each malware activity

Redis data structure

An overview of the Redis data structure used in MalwareClassifier

Notes for the student

Check the git log and the commits, these include the steps performed during the workshop especially regarding the improvement of the Python scripts.

Slides of the training session

Classifying malware using network traffic analysis. Or how to learn Redis, git, tshark and Python in 4 hours.