new: [vishing-model] Simple model to rapidly decay voice scamming, vishing relying on phone-numbers.

main
Alexandre Dulaunoy 2020-01-07 15:48:44 +01:00
parent 0bf4d8bafc
commit cec0156dae
No known key found for this signature in database
GPG Key ID: 09E2CD4944E6CBCD
2 changed files with 33 additions and 0 deletions

View File

@ -3,10 +3,13 @@
Starting from MISP 2.4.114, a decaying feature is available to apply decaying on attributes in your MISP instance. MISP comes with a set of default decaying models which
can be customised by the users. This repository contains all the default models.
For more information about decaying and expiring attributes/indicators in MISP, the training materials [MISP and Decaying of Indicators](https://www.misp-project.org/misp-training/a.5-decaying-indicators.pdf) is a good start.
## Models
- [nids-simple-model](./models/nids-simple-model.json) - Simple decaying model for Network Intrusion Detection System (NIDS).
- [phishing-model](./models/phishing-model.json) - Simple model to rapidly decay phishing website.
- [vishing-model](./models/vishing-model.json) - Simple model to rapidly decay voice scamming, vishing relying on phone-numbers.
## How to contribute your decaying model?

30
models/vishing-model.json Normal file
View File

@ -0,0 +1,30 @@
{
"uuid": "1097c0fe-06eb-4741-94d9-8098301d92f4",
"name": "Vishing model",
"formula": "Polynomial",
"authors": [
"MISP Project"
],
"ref": [
"https://arxiv.org/abs/1902.03914",
"https://arxiv.org/abs/1803.11052"
],
"parameters": {
"lifetime": 10,
"decay_speed": 2.3,
"threshold": 30,
"default_base_score": 80,
"base_score_config": {
"estimative-language:confidence-in-analytic-judgment": 0.25,
"estimative-language:likelihood-probability": 0.25,
"phishing:psychological-acceptability": 0.25,
"phishing:state": 0.25
}
},
"description": "Simple model to rapidly decay voice scamming, vishing relying on phone-numbers.",
"attribute_types": [
"phone-number",
"prtn"
],
"version": 1
}