Network Defense Lab

# Sample botnet detection signature
botnet_pattern = re.compile(r'X-API-Key:(?:\s)*"random_hash"[^$]*$')
matches = botnet_pattern.finditer(packet_data)

                    

# Anomaly detection using Z-score analysis
def detect_anomalies(stream, threshold):
    mean = np.mean(stream)
    std = np.std(stream)
    anomalies = [val for val in stream if abs(val-mean) > threshold*std]
    return anomalies