Find Malware Trends

This demo illustrates the power of KeyLines when visualising complex cyber-security data. The chart, time bar and side controls allow exploration of the data and discovery of both broad trends and precise details of the infection of particular machines and their immediate environments.

The data, taken from https://www.abuse.ch/, contains information about the infection of machines by 8 different identified malware. The dataset covers a 5 year period, which can be filtered to only show the machines active at the end of the period - the end of December 2015.

When one or more malware are selected the chart shows all infection for that malware, and a colour-coded trend line shows the relative infections rate. Tool tips for the histogram bars and trend lines show total infected machines.

The servers acting as 'Command and Control' ('C&C') machines for a set of botnets are coloured pale blue.

These machines have an association with an 'ISP' and also one or more hosts that are the contact point(s) for their botnets. ISPs are shown with a flag to indicate their geographic location.

The chart provides insight on the detail of C&C machine communications with their botnets, and the geography of infection.

There are two obvious dense clusters in the chart. One represents a set of C&C machines associated with a German ISP (ASN AS24940), the other a French one (AS16276) - which is a possible indication of a poorly managed domain.

Another significant node is the C&C machine 195.16.127.102, scaled larger due to the number of hosts associated with it. This Russian machine has 8 different compromised hosts, each using *.hotmail.ru addresses to communicate with their fleet of botnets.

Key functions used:

Code

import KeyLines from "keylines";
import data from "./data";

let chart;
let timebar;
const IPsLinkedHosts = {};
const maxMalwareSelection = 3;
const tooltipElements = {
  tooltip: document.getElementById("tooltip"),
  servers: document.getElementById("servers"),
};

const onlineOnlyButton = document.getElementById("onlineOnly");

async function doLayout() {
  await chart.layout("organic", {
    time: 400,
    easing: "linear",
    mode: "adaptive",
  });
}

function getSelectionCriteria(malwares) {
  const showOnlyOnline = onlineOnlyButton.value === "Show All";
  return (item) => {
    const status = showOnlyOnline ? item.d.status === "online" : true;

    if (item.d.type === "asn") return true;

    if (malwares) return item.d.malware in malwares && status;
    return status;
  };
}

function highlightMalware(malwares) {
  timebar.selection(Object.values(malwares));
  chart.foreground(
    getSelectionCriteria(Object.keys(malwares).length !== 0 ? malwares : null),
    {
      animate: false,
      type: "link",
    },
  );
}

function showTrends() {
  // Find the checked checkboxes
  const checkedMalwares = Array.from(
    document.querySelectorAll("input[name=malware]:checked"),
  );

  // If there are more than 3, uncheck the 4th one until there are just 3
  while (checkedMalwares.length > maxMalwareSelection) {
    checkedMalwares.pop().checked = false;
  }

  const reachedMaxSelections = checkedMalwares.length === maxMalwareSelection;
  document
    .querySelectorAll("input[name=malware]:not(:checked)")
    .forEach((radioButton) => {
      radioButton.disabled = reachedMaxSelections;
      radioButton.parentElement.style.color = reachedMaxSelections
        ? "DarkGray"
        : "black";
    });

  const malwareNames = {};

  checkedMalwares.forEach((element, index) => {
    const elementColour = element.parentElement
      .getElementsByTagName("dt")
      .item(0).style.background;
    malwareNames[element.value] = { id: [], index, c: elementColour };
  });

  chart.each({ type: "link" }, (link) => {
    if (link.d.malware in malwareNames) {
      malwareNames[link.d.malware].id.push(link.id1);
    }
  });

  // Update timebar selection and chart foregrounding
  timebar.selection([]);
  highlightMalware(malwareNames);
}

function showInfo() {
  const info = document.getElementById("info");

  const selection = chart.selection();

  let title = "";
  let status = "";
  let imageDisplayStyle = "none";

  if (selection.length === 1) {
    const item = chart.getItem(selection[0]);

    if (item.type === "node" && item.d.type === "host") {
      title = item.d.host;
      status = `Current status: <span class="${item.d.status}">${item.d.status}</span>`;
      imageDisplayStyle = "block";
    }
  }
  info.getElementsByTagName("h5").item(0).innerText = title;
  info.getElementsByTagName("p").item(0).innerHTML = status;
  info.getElementsByTagName("img").item(0).style.display = imageDisplayStyle;
}

function mergeObjects(object2, object1) {
  Object.keys(object1).forEach((host) => {
    object2[host] = object1[host];
  });
  return object2;
}

// Cache results for filtering by time. Only host nodes have timestamps so we need
// a reference for other node types to see what they're linked to
function calculateIPsNeighbours() {
  // Build a quick lookup for each item using IP & ISP
  chart.each({ type: "link" }, (link) => {
    if (link.d.type === "Host2IP") {
      IPsLinkedHosts[link.id2] = IPsLinkedHosts[link.id2] || {};
      IPsLinkedHosts[link.id2][link.id1] = 1;
    }
  });

  // Now do another pass to filter for the ISP
  chart.each({ type: "link" }, (link) => {
    if (link.d.type === "IP2ISP") {
      IPsLinkedHosts[link.id2] = IPsLinkedHosts[link.id2] || {};
      // now add all the hosts associated with the IP
      IPsLinkedHosts[link.id2] = mergeObjects(
        IPsLinkedHosts[link.id2],
        IPsLinkedHosts[link.id1],
      );
    }
  });
}

function checkNeighbours(obj) {
  return obj && Object.keys(obj).some((id) => timebar.inRange(id));
}

function filterByTimeRange(item) {
  if (item.type === "node") {
    return timebar.inRange(item.id) || checkNeighbours(IPsLinkedHosts[item.id]);
  }
  return (
    timebar.inRange(item.id1) ||
    timebar.inRange(item.id2) ||
    checkNeighbours(IPsLinkedHosts[item.id1]) ||
    checkNeighbours(IPsLinkedHosts[item.id2])
  );
}

function hideTooltip() {
  tooltipElements.tooltip.classList.add("fadeout");
}

async function filterItemsInTimeRange() {
  hideTooltip();
  // Filter the chart to show only items in the new range
  await chart.filter(filterByTimeRange, {
    animate: false,
    type: "all",
    hideSingletons: true,
  });
  // And then adjust the chart's layout
  doLayout();
}

function showTooltip({ type, value: numberOfServer, tooltipX, tooltipY }) {
  const hoverOverData = type === "bar" || type === "selection";
  const { servers, tooltip } = tooltipElements;
  if (hoverOverData) {
    // If the target is data, update the tooltip content
    servers.innerText = numberOfServer;

    // The top needs to be adjusted to accommodate the height of the tooltip
    const tooltipTop = tooltipY - tooltip.offsetHeight - 15;
    // Shift left by half width to centre it
    const tooltipLeft = tooltipX - tooltip.offsetWidth / 2;
    // Set the position of the tooltip
    tooltip.style.left = `${tooltipLeft}px`;
    tooltip.style.top = `${tooltipTop}px`;
    // Show the tooltip
    tooltip.classList.remove("fadeout");
  } else {
    hideTooltip();
  }
}

function initialiseInteractions() {
  timebar.on("change", filterItemsInTimeRange);
  timebar.on("hover", showTooltip);
  chart.on("selection-change", showInfo);

  const malwareCheckboxes = document.getElementsByClassName("malware");

  Array.from(malwareCheckboxes).forEach((checkbox) => {
    checkbox.addEventListener("change", showTrends);
  });

  document.getElementById("clearFilter").addEventListener("click", () => {
    Array.from(malwareCheckboxes).forEach((checkbox) => {
      checkbox.checked = false;
    });
    showTrends();
    doLayout();
  });

  onlineOnlyButton.addEventListener("click", () => {
    onlineOnlyButton.value =
      onlineOnlyButton.value === "Show All" ? "Only Show Online" : "Show All";
    showTrends();
  });
}

async function loadDataAndLayout() {
  chart.load(data);
  await chart.zoom("fit");
  await timebar.load(data);
  timebar.zoom("fit", { animate: false });
  // Run the layout
  doLayout();
}

async function loadKeyLines() {
  const chartOptions = {
    logo: "/public/images/Logo.png",
    minZoom: 0.01,
    handMode: true,
    linkEnds: { avoidLabels: false },
    overview: {
      icon: false,
      shown: false,
    },
  };

  const timebarOptions = {
    showPlay: false,
    showExtend: true,
    maxRange: {
      value: 5,
      units: "year",
    },
  };

  const components = await KeyLines.create([
    { id: "kl", container: "klchart", options: chartOptions },
    {
      id: "tl",
      container: "kltimebar",
      type: "timebar",
      options: timebarOptions,
    },
  ]);

  chart = components[0];
  timebar = components[1];

  await loadDataAndLayout();
  calculateIPsNeighbours();
  initialiseInteractions();
}

window.addEventListener("DOMContentLoaded", loadKeyLines);

Data

const data = {
  type: "LinkChart",
  items: [
    {
      id: "host-want-to-buy.co.uk",
      type: "node",
      t: "Host\nwant-to-buy.co.uk",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "want-to-buy.co.uk" },
      e: 1,
      dt: [1450224000000],
    },
    {
      id: "185.24.98.175",
      type: "node",
      t: "185.24.98.175",
      d: { type: "ip", sbl: "SBL279785", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS198047",
      type: "node",
      t: "UKWEB-EQX UK Webhosting Ltd,GB\n(AS198047)",
      u: "/public/images/malware/wwwgeonamesorgflagsxgb.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-46.105.161.233",
      type: "node",
      t: "Host\n46.105.161.233",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "unknown", host: "46.105.161.233" },
      e: 1,
      dt: [1450137600000],
    },
    {
      id: "46.105.161.233",
      type: "node",
      t: "46.105.161.233",
      d: { type: "ip", sbl: "Not listed", status: "unknown" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS16276",
      type: "node",
      t: "OVH OVH SAS,FR\n(AS16276)",
      u: "/public/images/malware/wwwgeonamesorgflagsxfr.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-www.presidentialemail.in",
      type: "node",
      t: "Host\nwww.presidentialemail.in",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "www.presidentialemail.in" },
      e: 1,
      dt: [1449878400000],
    },
    {
      id: "162.144.218.223",
      type: "node",
      t: "162.144.218.223",
      d: { type: "ip", sbl: "SBL279557", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS46606",
      type: "node",
      t: "UNIFIEDLAYER-AS-1 - Unified Layer, uS\n(AS46606)",
      u: "/public/images/malware/wwwgeonamesorgflagsxus.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-soundstrategyaccounts.com.au",
      type: "node",
      t: "Host\nsoundstrategyaccounts.com.au",
      u: "/public/images/icons/email.png",
      d: {
        type: "host",
        status: "online",
        host: "soundstrategyaccounts.com.au",
      },
      e: 1,
      dt: [1449792000000],
    },
    {
      id: "27.121.64.42",
      type: "node",
      t: "27.121.64.42",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS24446",
      type: "node",
      t: "NETREGISTRY-AS-AP NetRegistry Pty Ltd.,AU\n(AS24446)",
      u: "/public/images/malware/wwwgeonamesorgflagsxau.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-studio020.com",
      type: "node",
      t: "Host\nstudio020.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "studio020.com" },
      e: 1,
      dt: [1449705600000],
    },
    {
      id: "83.98.177.7",
      type: "node",
      t: "83.98.177.7",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS25525",
      type: "node",
      t: "ASN AS25525",
      u: "/public/images/malware/wwwgeonamesorgflagsxnl.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-ebenezerfm.com",
      type: "node",
      t: "Host\nebenezerfm.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "ebenezerfm.com" },
      e: 1,
      dt: [1449705600000],
    },
    {
      id: "69.4.233.96",
      type: "node",
      t: "69.4.233.96",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS36351",
      type: "node",
      t: "SOFTLAYER - SoftLayer Technologies Inc., uS\n(AS36351)",
      u: "/public/images/malware/wwwgeonamesorgflagsxsg.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-sydneyboatlicence.com",
      type: "node",
      t: "Host\nsydneyboatlicence.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "sydneyboatlicence.com" },
      e: 1,
      dt: [1449705600000],
    },
    {
      id: "27.121.64.40",
      type: "node",
      t: "27.121.64.40",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-mat-update.be",
      type: "node",
      t: "Host\nmat-update.be",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "mat-update.be" },
      e: 1,
      dt: [1449705600000],
    },
    {
      id: "198.105.221.5",
      type: "node",
      t: "198.105.221.5",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 3,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-phoenixtsi.com",
      type: "node",
      t: "Host\nphoenixtsi.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "phoenixtsi.com" },
      e: 1,
      dt: [1449705600000],
    },
    {
      id: "72.167.1.1",
      type: "node",
      t: "72.167.1.1",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS26496",
      type: "node",
      t: "ASN AS26496",
      u: "/public/images/malware/wwwgeonamesorgflagsxus.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-178.32.79.71",
      type: "node",
      t: "Host\n178.32.79.71",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "unknown", host: "178.32.79.71" },
      e: 1,
      dt: [1449705600000],
    },
    {
      id: "178.32.79.71",
      type: "node",
      t: "178.32.79.71",
      d: { type: "ip", sbl: "SBL279073", status: "unknown" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-emreerdem.com.tr",
      type: "node",
      t: "Host\nemreerdem.com.tr",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "emreerdem.com.tr" },
      e: 1,
      dt: [1449619200000],
    },
    {
      id: "85.95.237.78",
      type: "node",
      t: "85.95.237.78",
      d: { type: "ip", sbl: "SBL278986", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS42926",
      type: "node",
      t: "RADORE Radore Veri Merkezi Hizmetleri A.S., tR\n(AS42926)",
      u: "/public/images/malware/wwwgeonamesorgflagsxtr.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-beautifulmindsinc.com",
      type: "node",
      t: "Host\nbeautifulmindsinc.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "beautifulmindsinc.com" },
      e: 1,
      dt: [1449532800000],
    },
    {
      id: "184.168.56.1",
      type: "node",
      t: "184.168.56.1",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-simdie.com",
      type: "node",
      t: "Host\nsimdie.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "simdie.com" },
      e: 1,
      dt: [1449360000000],
    },
    {
      id: "AS29854",
      type: "node",
      t: "ASN AS29854",
      u: "/public/images/malware/wwwgeonamesorgflagsxus.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-secretgardener.melbourne",
      type: "node",
      t: "Host\nsecretgardener.melbourne",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "secretgardener.melbourne" },
      e: 1,
      dt: [1449360000000],
    },
    {
      id: "27.121.64.85",
      type: "node",
      t: "27.121.64.85",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-maminoleinc.tk",
      type: "node",
      t: "Host\nmaminoleinc.tk",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "maminoleinc.tk" },
      e: 1,
      dt: [1449187200000],
    },
    {
      id: "195.20.41.233",
      type: "node",
      t: "195.20.41.233",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS31624",
      type: "node",
      t: "ASN AS31624",
      u: "/public/images/malware/wwwgeonamesorgflagsxnl.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-studentscompanion.in",
      type: "node",
      t: "Host\nstudentscompanion.in",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "studentscompanion.in" },
      e: 1,
      dt: [1449187200000],
    },
    {
      id: "184.95.41.121",
      type: "node",
      t: "184.95.41.121",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 4,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS20454",
      type: "node",
      t: "ASN AS20454",
      u: "/public/images/malware/wwwgeonamesorgflagsxus.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-beemasewakendra.com",
      type: "node",
      t: "Host\nbeemasewakendra.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "beemasewakendra.com" },
      e: 1,
      dt: [1449187200000],
    },
    {
      id: "host-saner.com.au",
      type: "node",
      t: "Host\nsaner.com.au",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "saner.com.au" },
      e: 1,
      dt: [1449100800000],
    },
    {
      id: "27.121.64.74",
      type: "node",
      t: "27.121.64.74",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-sundarbantourpackages.com",
      type: "node",
      t: "Host\nsundarbantourpackages.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "sundarbantourpackages.com" },
      e: 1,
      dt: [1449100800000],
    },
    {
      id: "162.144.156.80",
      type: "node",
      t: "162.144.156.80",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-176.31.66.75",
      type: "node",
      t: "Host\n176.31.66.75",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "unknown", host: "176.31.66.75" },
      e: 1,
      dt: [1449100800000],
    },
    {
      id: "176.31.66.75",
      type: "node",
      t: "176.31.66.75",
      d: { type: "ip", sbl: "Not listed", status: "unknown" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-2becomputers.com",
      type: "node",
      t: "Host\n2becomputers.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "2becomputers.com" },
      e: 1,
      dt: [1448928000000],
    },
    {
      id: "198.50.98.253",
      type: "node",
      t: "198.50.98.253",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS32613",
      type: "node",
      t: "IWEB-AS - iWeb Technologies Inc.,CA\n(AS32613)",
      u: "/public/images/malware/wwwgeonamesorgflagsxca.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-198.27.87.34",
      type: "node",
      t: "Host\n198.27.87.34",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "unknown", host: "198.27.87.34" },
      e: 1,
      dt: [1448928000000],
    },
    {
      id: "198.27.87.34",
      type: "node",
      t: "198.27.87.34",
      d: { type: "ip", sbl: "Not listed", status: "unknown" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-www.lihuazhai.com",
      type: "node",
      t: "Host\nwww.lihuazhai.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "www.lihuazhai.com" },
      e: 1,
      dt: [1448841600000],
    },
    {
      id: "42.96.169.237",
      type: "node",
      t: "42.96.169.237",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS37963",
      type: "node",
      t: "CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.,Ltd.,CN\n(AS37963)",
      u: "/public/images/malware/wwwgeonamesorgflagsxcn.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-helenasoap.si",
      type: "node",
      t: "Host\nhelenasoap.si",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "helenasoap.si" },
      e: 1,
      dt: [1448841600000],
    },
    {
      id: "146.247.25.151",
      type: "node",
      t: "146.247.25.151",
      d: { type: "ip", sbl: "SBL262120", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS57127",
      type: "node",
      t: "ASN AS57127",
      u: "/public/images/malware/wwwgeonamesorgflagsxsi.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-91.236.213.74",
      type: "node",
      t: "Host\n91.236.213.74",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "unknown", host: "91.236.213.74" },
      e: 1,
      dt: [1448755200000],
    },
    {
      id: "91.236.213.74",
      type: "node",
      t: "91.236.213.74",
      d: { type: "ip", sbl: "SBL277887", status: "unknown" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS198582",
      type: "node",
      t: "DONAIR-AS Municipal Enterprise 'International Airport Donetsk', uA\n(AS198582)",
      u: "/public/images/malware/wwwgeonamesorgflagsxua.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-satyamsng.com",
      type: "node",
      t: "Host\nsatyamsng.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "satyamsng.com" },
      e: 1,
      dt: [1448668800000],
    },
    {
      id: "host-192.99.99.251",
      type: "node",
      t: "Host\n192.99.99.251",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "unknown", host: "192.99.99.251" },
      e: 1,
      dt: [1448668800000],
    },
    {
      id: "192.99.99.251",
      type: "node",
      t: "192.99.99.251",
      d: { type: "ip", sbl: "Not listed", status: "unknown" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-omnienergy.com.au",
      type: "node",
      t: "Host\nomnienergy.com.au",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "omnienergy.com.au" },
      e: 1,
      dt: [1448668800000],
    },
    {
      id: "27.121.64.198",
      type: "node",
      t: "27.121.64.198",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-nasscomminc.tk",
      type: "node",
      t: "Host\nnasscomminc.tk",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "nasscomminc.tk" },
      e: 1,
      dt: [1448668800000],
    },
    {
      id: "195.20.44.100",
      type: "node",
      t: "195.20.44.100",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-66.34.9.70",
      type: "node",
      t: "Host\n66.34.9.70",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "unknown", host: "66.34.9.70" },
      e: 1,
      dt: [1448668800000],
    },
    {
      id: "66.34.9.70",
      type: "node",
      t: "66.34.9.70",
      d: { type: "ip", sbl: "Not listed", status: "unknown" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS54489",
      type: "node",
      t: "CORESPACE-DAL - CoreSpace, Inc., uS\n(AS54489)",
      u: "/public/images/malware/wwwgeonamesorgflagsxus.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-janvermeulenmontage.nl",
      type: "node",
      t: "Host\njanvermeulenmontage.nl",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "janvermeulenmontage.nl" },
      e: 1,
      dt: [1448668800000],
    },
    {
      id: "109.72.85.122",
      type: "node",
      t: "109.72.85.122",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS48635",
      type: "node",
      t: "PCEXTREME PCextreme B.V.,NL\n(AS48635)",
      u: "/public/images/malware/wwwgeonamesorgflagsxnl.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-188.165.84.115",
      type: "node",
      t: "Host\n188.165.84.115",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "unknown", host: "188.165.84.115" },
      e: 1,
      dt: [1445558400000],
    },
    {
      id: "188.165.84.115",
      type: "node",
      t: "188.165.84.115",
      d: { type: "ip", sbl: "Not listed", status: "unknown" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-alliedairduct.com",
      type: "node",
      t: "Host\nalliedairduct.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "alliedairduct.com" },
      e: 1,
      dt: [1445472000000],
    },
    {
      id: "205.204.75.242",
      type: "node",
      t: "205.204.75.242",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS10929",
      type: "node",
      t: "NETELLIGENT - Netelligent Hosting Services Inc.,CA\n(AS10929)",
      u: "/public/images/malware/wwwgeonamesorgflagsxca.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-neuberchile.com",
      type: "node",
      t: "Host\nneuberchile.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "neuberchile.com" },
      e: 1,
      dt: [1445472000000],
    },
    {
      id: "190.196.128.198",
      type: "node",
      t: "190.196.128.198",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS14259",
      type: "node",
      t: "ASN AS14259",
      u: "/public/images/malware/wwwgeonamesorgflagsxcl.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-www.kafinvest.com",
      type: "node",
      t: "Host\nwww.kafinvest.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "www.kafinvest.com" },
      e: 1,
      dt: [1445472000000],
    },
    {
      id: "213.229.91.9",
      type: "node",
      t: "213.229.91.9",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS29550",
      type: "node",
      t: "ASN AS29550",
      u: "/public/images/malware/wwwgeonamesorgflagsxgb.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-markhousecm.com",
      type: "node",
      t: "Host\nmarkhousecm.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "markhousecm.com" },
      e: 1,
      dt: [1445472000000],
    },
    {
      id: "122.155.10.197",
      type: "node",
      t: "122.155.10.197",
      d: { type: "ip", sbl: "SBL274049", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS9931",
      type: "node",
      t: "CAT-AP The Communication Authoity of Thailand, CAT, tH\n(AS9931)",
      u: "/public/images/malware/wwwgeonamesorgflagsxth.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-195.62.29.81",
      type: "node",
      t: "Host\n195.62.29.81",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "unknown", host: "195.62.29.81" },
      e: 1,
      dt: [1445212800000],
    },
    {
      id: "195.62.29.81",
      type: "node",
      t: "195.62.29.81",
      d: { type: "ip", sbl: "Not listed", status: "unknown" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-104.166.67.26",
      type: "node",
      t: "Host\n104.166.67.26",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "unknown", host: "104.166.67.26" },
      e: 1,
      dt: [1445126400000],
    },
    {
      id: "104.166.67.26",
      type: "node",
      t: "104.166.67.26",
      d: { type: "ip", sbl: "Not listed", status: "unknown" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS46261",
      type: "node",
      t: "QUICKPACKET - QuickPacket, LLC, uS\n(AS46261)",
      u: "/public/images/malware/wwwgeonamesorgflagsxus.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-chaitanyagroupindia.com",
      type: "node",
      t: "Host\nchaitanyagroupindia.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "chaitanyagroupindia.com" },
      e: 1,
      dt: [1445126400000],
    },
    {
      id: "103.224.243.146",
      type: "node",
      t: "103.224.243.146",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS133295",
      type: "node",
      t: "NEOSOFT-AS Neosoft Technologies International,IN\n(AS133295)",
      u: "/public/images/malware/wwwgeonamesorgflagsxin.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-cheshamfrench.co.uk",
      type: "node",
      t: "Host\ncheshamfrench.co.uk",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "cheshamfrench.co.uk" },
      e: 1,
      dt: [1444867200000],
    },
    {
      id: "69.28.199.60",
      type: "node",
      t: "69.28.199.60",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 3,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS13768",
      type: "node",
      t: "ASN AS13768",
      u: "/public/images/malware/wwwgeonamesorgflagsxus.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-boombuckspartys.com.au",
      type: "node",
      t: "Host\nboombuckspartys.com.au",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "boombuckspartys.com.au" },
      e: 1,
      dt: [1444867200000],
    },
    {
      id: "202.191.62.219",
      type: "node",
      t: "202.191.62.219",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-asagroupltd.com",
      type: "node",
      t: "Host\nasagroupltd.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "asagroupltd.com" },
      e: 1,
      dt: [1444867200000],
    },
    {
      id: "209.147.127.135",
      type: "node",
      t: "209.147.127.135",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS30170",
      type: "node",
      t: "OPTICFUSION - Isomedia, Inc., uS\n(AS30170)",
      u: "/public/images/malware/wwwgeonamesorgflagsxus.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-167.114.89.205",
      type: "node",
      t: "Host\n167.114.89.205",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "unknown", host: "167.114.89.205" },
      e: 1,
      dt: [1444780800000],
    },
    {
      id: "167.114.89.205",
      type: "node",
      t: "167.114.89.205",
      d: { type: "ip", sbl: "Not listed", status: "unknown" },

// ...truncated 27763 lines

HTML

<!doctype html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <title>Find Malware Trends</title>
    <link rel="stylesheet" type="text/css" href="@ci/theme/kl/css/keylines.css">
    <link
      rel="stylesheet"
      type="text/css"
      href="@ci/theme/kl/css/minimalsdk.css"
    >
    <link
      rel="stylesheet"
      type="text/css"
      href="@ci/theme/kl/css/sdk-layout.css"
    >
    <link rel="stylesheet" type="text/css" href="@ci/theme/kl/css/demo.css">
    <link
      rel="stylesheet"
      type="text/css"
      href="@ci/theme/kl/css/examples-chrome.css"
    >
    <link rel="stylesheet" href="./style.css">
  </head>
  <body>
    <div class="chart-wrapper demo-cols">
      <div id="lhs" class="flex1">
        <div
          id="lhsVisual"
          class="toggle-content is-visible"
          style="width: 100%; height: 100%"
        >
          <div id="klchart" class="klchart klchart-timebar"></div>
          <div id="kltimebar" class="kltimebar">
            <div
              class="tooltip fadeout"
              id="tooltip"
              style="position: absolute; pointer-events: none"
            >
              <div class="arrow"></div>
              <div class="inner">
                <p>Servers Detected</p>
                <span id="servers"></span>
              </div>
            </div>
          </div>
        </div>
      </div>
      <div class="rhs citext" id="demorhscontent">
        <div class="tab-content-panel">
          <div id="controlsTab" class="toggle-content is-visible tabcontent">
            <form id="rhsForm" autocomplete="off" onsubmit="return false;">
              <div class="cicontent">
                <fieldset>
                  <p>
                    Explore patterns of malware propagation by visualising the
                    relation between C&amp;C servers and the hosts and ISPs they
                    are linked to.
                  </p>
                </fieldset>
                <fieldset>
                  <legend>Malware Trends</legend>
                  <p>
                    Select up to three malware families to see their
                    distribution over time.
                  </p>
                  <div class="row-fluid">
                    <dl
                      class="span6"
                      style="margin-bottom: 5px; margin-top: 0px"
                    >
                      <label class="checkbox zeus"
                        ><input
                          class="malware"
                          type="checkbox"
                          value="ZeuS"
                          name="malware"
                        >
                        <dt style="background: #e41a1c">&nbsp;</dt>
                        <dd>ZeuS</dd></label
                      ><label class="checkbox iceix"
                        ><input
                          class="malware"
                          type="checkbox"
                          value="Ice IX"
                          name="malware"
                        >
                        <dt style="background: #377eb8">&nbsp;</dt>
                        <dd>IceIX</dd></label
                      ><label class="checkbox vmzeus"
                        ><input
                          class="malware"
                          type="checkbox"
                          value="VMZeuS"
                          name="malware"
                        >
                        <dt style="background: #4daf4a">&nbsp;</dt>
                        <dd>VMZeuS</dd></label
                      ><label class="checkbox citadel"
                        ><input
                          class="malware"
                          type="checkbox"
                          value="Citadel"
                          name="malware"
                        >
                        <dt style="background: #984ea3">&nbsp;</dt>
                        <dd>Citadel</dd></label
                      >
                    </dl>
                    <dl class="span6" style="margin: 0px 0px 5px 0px">
                      <label class="checkbox kins"
                        ><input
                          class="malware"
                          type="checkbox"
                          value="KINS"
                          name="malware"
                        >
                        <dt style="background: #ff7f00">&nbsp;</dt>
                        <dd>KINS</dd></label
                      ><label class="checkbox palevo"
                        ><input
                          class="malware"
                          type="checkbox"
                          value="Palevo"
                          name="malware"
                        >
                        <dt style="background: #ffeb3b">&nbsp;</dt>
                        <dd>Palevo</dd></label
                      ><label class="checkbox feodoc"
                        ><input
                          class="malware"
                          type="checkbox"
                          value="Feodo Version C"
                          name="malware"
                        >
                        <dt style="background: #756bb1">&nbsp;</dt>
                        <dd>Feodo Version C</dd></label
                      ><label class="checkbox feodod"
                        ><input
                          class="malware"
                          type="checkbox"
                          value="Feodo Version D"
                          name="malware"
                        >
                        <dt style="background: #54278f">&nbsp;</dt>
                        <dd>Feodo Version D</dd></label
                      >
                    </dl>
                  </div>
                  <div class="row-fluid">
                    <input
                      class="btn"
                      type="button"
                      value="Clear"
                      id="clearFilter"
                    ><input
                      class="btn pull-right"
                      type="button"
                      value="Only Show Online"
                      id="onlineOnly"
                    >
                  </div>
                </fieldset>
                <fieldset style="min-height: 110px">
                  <p style="margin-top: 10px">
                    Select a host
                    <img
                      src="/public/images/icons/email.png"
                      alt=""
                      style="width: 22px; height: 22px"
                    >
                    to inspect
                  </p>
                  <div class="row-fluid" id="info">
                    <div class="imagediv">
                      <img
                        src="/public/images/icons/email.png"
                        alt=""
                        style="width: 64px; height: 64px; display: none"
                      >
                    </div>
                    <div class="textdiv">
                      <h5></h5>
                      <p></p>
                    </div>
                  </div>
                </fieldset>
              </div>
            </form>
          </div>
        </div>
      </div>
    </div>
    <script type="module" src="./code.js"></script>
  </body>
</html>

CSS

/* --- malware.css --- */
dl {
  margin-bottom: 50px;
}

dl dt {
  color: #fff;
  float: left;
  font-weight: bold;
  margin-right: 10px;
  padding: 3px;
  width: 18px;
  border-radius: 18px;
  line-height: 12px;
}

dl dd {
  margin: 2px 0;
  padding: 5px 0;
  line-height: 12px;
}

span.unknown,
span.online,
span.offline {
  font-weight: bold;
}

.unknown {
  color: grey;
}

.online {
  color: green;
}

.offline {
  color: red;
}

#loadingBarText {
  text-align: center;
  margin-top: -40px;
}

#info {
  height: 70px;
  max-width: 99%;
  border: lightgray solid 1px;
}

/* Tooltip styling */

#tooltip {
  opacity: 0.8;
  transition: opacity 0.3s ease;
  display: block;
  line-height: 18px;
  text-align: center;
  z-index: 1001;
}

#tooltip .inner {
  background-color: grey;
  color: white;
  padding: 4px;
}

#tooltip .arrow {
  position: absolute;
  border: solid 8px grey;
  border-top-color: transparent;
  border-left-color: transparent;
  transform: translate(-5px, 60px) rotateZ(45deg);
  position: absolute;
  top: -10px;
  left: 48px;
  width: 16px;
  height: 16px;
}

#tooltip.fadeout {
  opacity: 0;
}

#servers {
  font-size: 22px;
}

#info {
  display: inline-block;
  width: 100%;
}
#info .imagediv {
  display: inline-block;
  width: 64px;
}
#info .textdiv {
  position: relative;
  top: -10px;
  display: inline-block;
  width: calc(100% - 68px);
}

Search

Terms of use