chopshop
A Python framework for creating protocol decoders and detectors to analyze APT tradecraft in network traffic.
What is chopshop?
ChopShop is a protocol analysis and decoder framework developed by MITRE that enables security analysts to create and execute custom decoders and detectors for analyzing network traffic. It specifically focuses on identifying Advanced Persistent Threat (APT) tradecraft by providing a structured environment for protocol decoding and malicious activity detection.
Security analysts, threat researchers, and network forensic specialists who need to analyze network traffic for APT activity and create custom protocol decoders.
Developers choose ChopShop because it provides a specialized framework specifically designed for APT tradecraft analysis with deep integration with pynids for network traffic processing, offering more flexibility than general-purpose network analysis tools.
Overview
Protocol Analysis/Decoder Framework
Use Cases
Best For
- Analyzing network traffic for Advanced Persistent Threat indicators
- Creating custom protocol decoders for security analysis
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
