Skip to content

ScanNf

Converts RGB image into the HSV (Hue, Saturation, Value) Color Space to determine the noise floor of the image.

This algorithm can be modified to be more/less strict by changing the following variables in the source code: p = minimum saturation percentage threshold per pixel (value between 0 and 1). s_thr = minimum percentage threshold for all the pixels in the image.

Current Setting: At least 25% (s_thr) of pixels must have a saturation value of at least 5% (p)

The higher the value for both variables, the more strict the algorithm is.

Source code in strelka/src/python/strelka/scanners/scan_nf.py 
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
class ScanNf(strelka.Scanner):
    """
    Converts RGB image into the HSV (Hue, Saturation, Value) Color Space
    to determine the noise floor of the image.

    This algorithm can be modified to be more/less strict by changing
    the following variables in the source code:
     p = minimum saturation percentage threshold per pixel (value between 0 and 1).
     s_thr = minimum percentage threshold for all the pixels in the image.

    Current Setting: At least 25% (s_thr) of pixels must have a saturation value of at least 5% (p)

    The higher the value for both variables, the more strict the algorithm is.
    """

    def scan(self, data, file, options, expire_at):
        try:
            # Convert image to HSV color space
            np_array = np.frombuffer(data, np.uint8)
            np_image = cv2.imdecode(
                np_array, cv2.IMREAD_IGNORE_ORIENTATION | cv2.IMREAD_COLOR
            )
            image = cv2.cvtColor(np_image, cv2.COLOR_BGR2HSV)

            # Calculate histogram of saturation channel
            s = cv2.calcHist([image], [1], None, [256], [0, 256])

            # Calculate percentage of pixels with saturation >= p
            p = 0.05
            s_perc = float(np.sum(s[int(p * 255.0) : -1])) / float(
                np.prod(image.shape[0:2])
            )

            # Percentage threshold; above: valid image, below: noise
            s_thr = 0.25
            self.event["percentage"] = s_perc
            self.event["threshold"] = s_thr
            if s_perc < s_thr:
                self.event["noise_floor"] = True  # Potentially dangerous
            else:
                self.event["noise_floor"] = False  # Not dangerous
        except cv2.error:
            self.flags.append(
                f"{self.__class__.__name__} Exception:  Error loading image with cv2 library."
            )
        except Exception as e:
            self.flags.append(f"{self.__class__.__name__} Exception: {str(e)[:50]}")

Features

The features of this scanner are detailed below. These features represent the capabilities and the type of analysis the scanner can perform. This may include support for Indicators of Compromise (IOC), the ability to emit files for further analysis, and the presence of extended documentation for complex analysis techniques.

Feature
Support
IOC Support
Emit Files
Extended Docs
Malware Scanner
Image Thumbnails

Tastes

Strelka's file distribution system assigns scanners to files based on 'flavors' and 'tastes'. Flavors describe the type of file, typically determined by MIME types from libmagic, matches from YARA rules, or characteristics of parent files. Tastes are the criteria used within Strelka to determine which scanners are applied to which files, with positive and negative tastes defining files to be included or excluded respectively.

Source Filetype
Include / Exclude

Scanner Fields

This section provides a list of fields that are extracted from the files processed by this scanner. These fields include the data elements that the scanner extracts from each file, representing the analytical results produced by the scanner. If the test file is missing or cannot be parsed, this section will not contain any data.

Field Name
Field Type
elapsed
str
flags
list
noise_floor
bool
percentage
float
threshold
float

Sample Event

Below is a sample event generated by this scanner, demonstrating the kind of output that can be expected when it processes a file. This sample is derived from a mock scan event configured in the scanner's test file. If no test file is available, this section will not display a sample event.

    test_scan_event = {
        "elapsed": 0.001,
        "flags": [],
        "percentage": 0.0,
        "threshold": 0.25,
        "noise_floor": True,
    }