IoT_PreTester_V46_Demo/django_project/analyzer

IoT PreTester 4.6 Demo analysis core

analyzer is the framework-independent network-capture analysis package used by both the Django backend and the command-line interface. It accepts .pcap or .pcapng files, normalizes protocol data once, runs independent detectors, and renders Markdown, text, or JSON reports.

Main modules

• context.py defines the normalized CaptureContext records.
• extract_pyshark.py builds the context through tshark/pyshark.
• detectors/ contains one detection concern per module.
• engine.py runs detectors and assembles the final result.
• scoring.py deduplicates and prioritizes findings.
• provenance.py attaches artifacts and packet/stream references.
• artifacts.py extracts URL and hash artifacts from the shared context.
• enrich/ provides optional URL probing and hash recovery.
• reporting/ renders md, txt, and json output.

Command line

From django_project/:

python -m analyzer.cli ../demo_files/demo_capture.pcapng
python -m analyzer.cli capture.pcapng -f json -o report.json
python -m analyzer.cli capture.pcapng -f txt --packet-limit 100000

Exit codes are 0 for no high/critical findings, 2 when at least one high/critical finding exists, and 1 for execution errors.

Python API

from analyzer import AnalysisEngine, render
from analyzer.context import CaptureContext

result = AnalysisEngine().analyze_pcap("capture.pcapng")
print(render(result, "md"))

# Detector logic can also be tested without tshark.
synthetic_result = AnalysisEngine().analyze_context(CaptureContext())

Tests

python -m unittest analyzer.tests.test_analyzer -v

The unit suite uses synthetic contexts and does not require tshark.

Adding a detector

1. Add a focused module under detectors/.
2. Inherit from BaseDetector, apply @register, and return shared Finding objects from detect().
3. Import the module from detectors/__init__.py.
4. Add focused tests under tests/.