DarkmonLevenshtein

Computes the minimum Levenshtein edit distance between a domain's root label and a list of brand names. Used by Darkmon - Brand-Targeted NRD Watch to flag typosquatting candidates.

python · Darkmon

Details

ID	`DarkmonLevenshtein`
Language	python
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	darkmon transformer

README

Computes the minimum Levenshtein edit distance between a domain’s root label
and a list of brand names. Used by Darkmon - Brand-Targeted NRD Watch to
flag typosquatting candidates.

Script Data

Name	Description
Script Type	python3
Tags	darkmon, transformer
Cortex XSOAR Version	6.5.0

Used In

This script is used in the following playbooks and scripts.

DarkmonScoreNRDs

Inputs

Argument Name	Description
domain	The domain to compare (only the root label is used).
brands	Comma-separated brand names to compare against.

Outputs

Path	Description	Type
Darkmon.Levenshtein.domain	The input domain (lowercased).	String
Darkmon.Levenshtein.brand	The brand with the smallest distance to the domain root.	String
Darkmon.Levenshtein.distance	The minimum Levenshtein distance found.	Number

Source

DarkmonLevenshtein.py DarkmonLevenshtein_test.py DarkmonLevenshtein.yml

Download History Raw

import DarkmonLevenshtein
import demistomock as demisto  # noqa: F401


def test_levenshtein_identical():
    """
    Given:
        - Two identical strings

    When:
        - levenshtein() is called

    Then:
        - Distance is 0
    """
    assert DarkmonLevenshtein.levenshtein("acme", "acme") == 0


def test_levenshtein_single_substitution():
    """
    Given:
        - Two strings differing by one character

    When:
        - levenshtein() is called

    Then:
        - Distance is 1
    """
    assert DarkmonLevenshtein.levenshtein("acme", "acne") == 1


def test_main_returns_closest_brand(mocker):
    """
    Given:
        - A domain and a list of brand names

    When:
        - main() is called

    Then:
        - return_results is called with the closest brand and its distance
    """
    mocker.patch.object(demisto, "args", return_value={"domain": "acmee.com", "brands": "acme,google"})
    mock_return = mocker.patch.object(DarkmonLevenshtein, "return_results")

    DarkmonLevenshtein.main()

    mock_return.assert_called_once()
    result = mock_return.call_args[0][0]
    assert result["Contents"]["brand"] == "acme"
    assert result["Contents"]["distance"] == 1