{"push_id":1185845341,"size":6,"distinct_size":1,"ref":"refs/heads/master","head":"c4385b3ecaf74beea187ed74bb04d9cc26c7255e","before":"53fc72f696c9b20bb4c57ea08860dc1433d59ecd","commits":[{"sha":"e975e168ebc8202956d2b9a67b3750606cb5716a","author":{"name":"Johann Schmitz","email":"5041977bfe79687f768b58371ff1d950de368907@j-schmitz.net"},"message":"Added basic database handling","distinct":false,"url":"https://api.github.com/repos/ercpe/amavisvt/commits/e975e168ebc8202956d2b9a67b3750606cb5716a"},{"sha":"216cf9e953269dd0d65633cabee0930f4a7b8d20","author":{"name":"Johann Schmitz","email":"5041977bfe79687f768b58371ff1d950de368907@j-schmitz.net"},"message":"Added more database and pattern code for the filename pattern detection","distinct":false,"url":"https://api.github.com/repos/ercpe/amavisvt/commits/216cf9e953269dd0d65633cabee0930f4a7b8d20"},{"sha":"59737134522e83abf0f37eff29c6cb757052e3d6","author":{"name":"Johann Schmitz","email":"5041977bfe79687f768b58371ff1d950de368907@j-schmitz.net"},"message":"Moved `infected` status to vtresponse class\nMore logic to handle database entries","distinct":false,"url":"https://api.github.com/repos/ercpe/amavisvt/commits/59737134522e83abf0f37eff29c6cb757052e3d6"},{"sha":"ac84c4e240a02dfcaf773df37d2daf5475c19405","author":{"name":"Johann Schmitz","email":"5041977bfe79687f768b58371ff1d950de368907@j-schmitz.net"},"message":"Added auto-report feature and actual matching code","distinct":false,"url":"https://api.github.com/repos/ercpe/amavisvt/commits/ac84c4e240a02dfcaf773df37d2daf5475c19405"},{"sha":"b4a34274b6f6d142435eeebc1eae9cf471c0f534","author":{"name":"Johann Schmitz","email":"5041977bfe79687f768b58371ff1d950de368907@j-schmitz.net"},"message":"Some cleanup","distinct":false,"url":"https://api.github.com/repos/ercpe/amavisvt/commits/b4a34274b6f6d142435eeebc1eae9cf471c0f534"},{"sha":"c4385b3ecaf74beea187ed74bb04d9cc26c7255e","author":{"name":"Johann Schmitz","email":"5041977bfe79687f768b58371ff1d950de368907@j-schmitz.net"},"message":"New Feature: filename pattern detection\n\nInfected mails often come with similiar named emails - something \"unpaid_invoice_1234.zip\" or \"report_1234.zip\".\nThis EXPERIMENTAL feature maintains a sqlite database with these filenames and reject files that are similiar named and have previously detected as infected.\n\nThe filenames is split into chunks (seperator are _, - and .). The resulting tuple is compared against the other filename entries in the database. If another filenames differ at exactly one chunk, the pattern is recorded in the database.\n\nExample\n- weekly_report_1234.zip\n- weekly_report-5678.zip\n- weekly-report.foobar.zip\n\nwill all create the pattern 'weekly-report-[RANDOM]-zip'.\n\nAmavisVT will flag these files as infected, if:\n- there are more than \"min-filename-patterns\" (default: 20) entries with this pattern in the database\n- more than \"infected-percent\" (default: 0.7 = 70%) of these entries have been detected as infected\n\nAdditionaly, AmavisVT will send these files to Virustotal if the \"auto-report\" setting is set to true.\n\nWARNING: This will send the actual content of the attachments to Virustotal. DO NOT enable this setting if\n         a legitimate attachment may be caught by the pattern detection!\n\nAmavisVT's database requires sqlite support in python.\n\nThe filename pattern detection feature requires the fuzzywuzzy library (https://github.com/seatgeek/fuzzywuzzy) to be installed.","distinct":true,"url":"https://api.github.com/repos/ercpe/amavisvt/commits/c4385b3ecaf74beea187ed74bb04d9cc26c7255e"}]}
{"actor":{"display_login":"ercpe"}}