dshield-parser 0.0.0__py3-none-any.whl

dshield_parser/utils/enrichment.py

@@ -0,0 +1,458 @@
+import logging, datetime
+import sys
+import re
+import json
+import requests #needs to be installed
+import shodan #needs to be installed
+import dshield_parser.utils as utils
+import dshield_parser.utils.json as dshield_json
+import pandas as pd
+import sys
+import os
+import time
+import ipaddress
+import requests
+import xml.etree.ElementTree as ET
+from pathlib import Path
+from functools import lru_cache
+import datetime
+import socket
+
+#Enter a valid IP Address (e.g. 1.1.1.1), ASN (e.g. AS1234), or TAG (e.g. NORD_VPN)
+@lru_cache
+def get_spur_data(log_source, input, session, api):
+    try:
+        ipaddress.ip_address(input)
+        logging.debug(f"IP Address: {input}")
+    except Exception as e:
+        logging.debug(f"Not an IP Address: {input}")
+
+    session.headers = {'Token': api}
+    url = "https://api.spur.us/v2/context/" + input
+    while True:
+        try:
+            response = session.get(url)
+        except Exception as e:
+            logging.error(f"Exception hit for SPUR query: '{e}'. Pausing for 15 seconds before trying again.")
+            time.sleep(15)
+            continue
+        break
+    json_data = json.loads(response.text)
+    json_data["DShield Log Source"] = log_source
+    json_data["DShield Log Identifier"] = input
+    file = open("spur_data.json", 'a',encoding="utf-8")
+    file.write(json.dumps(json_data) + "\n")
+    file.close()
+    return (json_data)
+
+#URL, IP Address, Domain or file hash
+@lru_cache
+def get_vt_data(input, input_type, api):
+    vt_data = {}
+    headers = {'X-Apikey': api}
+    if input_type == "url":
+        url = "https://www.virustotal.com/api/v3/urls/" + input #url
+    elif input_type == "domain":
+        url = "https://www.virustotal.com/api/v3/domains/" + input #domain
+    elif input_type == "hash":
+        url = "https://www.virustotal.com/api/v3/files/" + input #hash
+    elif input_type == "ip":
+        url = "https://www.virustotal.com/api/v3/ip_addresses/" + input #ip address
+    else:
+        logging.error("Invalid input type given for VirusTotal to process.")
+    
+    while True:
+        try:
+            response = requests.get(url, headers=headers)
+        except Exception as e:
+            logging.error(f"Exception hit for VirusTotal query: '{e}'. Pausing for 15 seconds before trying again.")
+            time.sleep(15)
+            continue
+        break
+    
+    json_response = json.loads(response.text)
+    logging.debug(response.text)
+    if "error" in json_response:
+        for key, value in json_response["error"].items():
+            logging.error(f"VT Error for '{hash}': {value}")
+    elif "data" in json_response:
+        if "attributes" in json_response["data"]:
+            if "last_analysis_stats" in json_response["data"]["attributes"]:
+                for key, value in json_response["data"]["attributes"]["last_analysis_stats"].items():
+                    vt_data[key] = value
+                if "last_analysis_date" in json_response["data"]["attributes"]:
+                    vt_data["last_analysis_date"] = json_response["data"]["attributes"]["last_analysis_date"]
+                if "trid" in json_response["data"]["attributes"]:
+                    vt_data["filetype"] = json_response["data"]["attributes"]["trid"][0]["file_type"]
+                if "type_tag" in json_response["data"]["attributes"]:
+                    vt_data["typetag"] = json_response["data"]["attributes"]["type_tag"]
+                if "type_description" in json_response["data"]["attributes"]:
+                    vt_data["description"] = json_response["data"]["attributes"]["type_description"]
+                if "meaningful_name" in json_response["data"]["attributes"]:
+                    vt_data["filename"] = json_response["data"]["attributes"]["meaningful_name"]
+                if "popular_threat_classification" in json_response["data"]["attributes"]:
+                    vt_data["classification"] = json_response["data"]["attributes"]["popular_threat_classification"]["suggested_threat_label"]
+        
+        filehandle = open("vt_data.json", "a", encoding="utf-8")
+        filehandle.write(json.dumps(vt_data) +"\n")
+        filehandle.close()
+    return(vt_data)
+
+@lru_cache
+def get_uh_data(input):
+    pass
+
+@lru_cache
+def get_whois_data(input):
+    pass
+
+@lru_cache
+def get_isc_data(input):
+    pass
+
+@lru_cache
+def get_shodan_host(input, key):
+    api_shodan = shodan.Shodan(key)
+    try:
+        info = api_shodan.host(input)
+        return info
+    except Exception as e:
+        logging.error(f"Issue looking up {input}: {e}")
+    
+
+@lru_cache
+def get_shodan_domain(input, key):
+    api_shodan = shodan.Shodan(key)
+    try:
+        info = api_shodan.dns.domain_info(input)
+        return info
+    except Exception as e:
+        logging.error(f"Issue looking up {input}: {e}")
+
+#https://proxycheck.io/ 
+@lru_cache
+def get_proxycheck_data(input):
+    pass
+
+#https://ipinfo.io/
+@lru_cache
+def get_ipinfo_data(input):
+    pass
+
+#https://www.abuseipdb.com/
+@lru_cache
+def get_abuseipdb_data(input):
+    pass    
+    
+#https://cybergordon.com/
+@lru_cache
+def get_cybergordon_data(input):
+    pass
+
+@lru_cache
+def get_urlscan_data(input):
+    pass
+
+@lru_cache
+def get_input(input):
+    if "http" in input:
+        logging.debug(f"URL: {input}")
+    elif "." in input:
+        try:
+            ipaddress.ip_address(input)
+            logging.debug(f"IP Address: {input}")
+        except Exception as e:
+            logging.debug(f"Not an IP Address: {input}")
+
+@lru_cache
+def extract_ip_address(input):
+    pass
+
+def isc_cloudapis(email):
+    url = "https://isc.sans.edu/api/cloudips"
+    headers = {
+        'User-Agent': f'Request from {email}',
+    }   
+
+    while True:
+        try:
+            response = requests.get(url, headers=headers)
+        except Exception as e:
+            logging.error(f"Exception hit for Could IP SANS ISC query: '{e}'. Pausing for 15 seconds before trying again.")
+            time.sleep(15)
+            continue
+        break    
+    
+    xml =  response.text
+    root = ET.fromstring(xml)
+    ips = []
+    netmasks = []
+    providers = []
+    comments = []
+    for idx, cidr in enumerate(root.findall("cidr")):
+        for idx2, ip in enumerate(cidr.findall("ip")):
+            #print("IP: ", ip.text)
+            ips.append(ip.text)
+        for idx2, netmask in enumerate(cidr.findall("netmask")):
+            #print("Netmask: ", netmask.text)
+            netmasks.append(netmask.text)
+        for idx2, provider in enumerate(cidr.findall("provider")):
+            #print("Provider: ", provider.text)
+            providers.append(provider.text)
+        for idx2, comment in enumerate(cidr.findall("comment")):
+            #print("Comment: ", comment.text)
+            comments.append(comment.text)
+    d = {'IP Address': ips, 'Netmask': netmasks, 'Provider': providers, 'Comment': comments}
+    return pd.DataFrame(d)
+
+def isc_cloudcidrs(email):
+    url = "https://isc.sans.edu/api/cloudcidrs"
+    headers = {
+        'User-Agent': f'Request from {email}',
+    }   
+    while True:
+        try:
+            response = requests.get(url, headers=headers)
+        except Exception as e:
+            logging.error(f"Exception hit for Cloud CIDR SANS ISC query: '{e}'. Pausing for 15 seconds before trying again.")
+            time.sleep(15)
+            continue
+        break    
+    
+    xml =  response.text
+    root = ET.fromstring(xml)
+    ips = []
+    providers = []
+    comments = []
+    for idx, cidr in enumerate(root.findall("cidr")):
+        for idx2, ip in enumerate(cidr.findall("prefix")):
+            #print("IP: ", ip.text)
+            ips.append(ip.text)
+        for idx2, provider in enumerate(cidr.findall("provider")):
+            #print("Provider: ", provider.text)
+            providers.append(provider.text)
+        for idx2, comment in enumerate(cidr.findall("comment")):
+            #print("Comment: ", comment.text)
+            comments.append(comment.text)
+    d = {'CIDR': ips, 'Provider': providers, 'Comment': comments}
+    return pd.DataFrame(d)
+
+def isc_intelfeed(email):
+    url = "https://isc.sans.edu/api/intelfeed"
+    headers = {
+        f'User-Agent': 'Request from {email}',
+    }   
+
+    while True:
+        try:
+            response = requests.get(url, headers=headers)
+        except Exception as e:
+            logging.error(f"Exception hit for SANS ISC Intel Feed query: '{e}'. Pausing for 15 seconds before trying again.")
+            time.sleep(15)
+            continue
+        break
+    
+    xml =  response.text
+    root = ET.fromstring(xml)
+
+
+    #return pd.DataFrame(d)
+
+@lru_cache
+def isc_ipinfo(ip, email):
+
+    url = f"https://isc.sans.edu/api/ip/{ip}"
+    headers = {
+        'User-Agent': f'Request from {email}',
+    }   
+
+    while True:
+        try:
+            response = requests.get(url, headers=headers) 
+        except Exception as e:
+            logging.error(f"Exception hit for SANS ISC IP info query: '{e}'. Pausing for 15 seconds before trying again.")
+            time.sleep(15)
+            continue
+        break
+
+    while response.status_code != 200:
+        delay = 5
+        if response.status_code == 429:
+            logging.error(f"Request limit reached: {response.text}")
+            try:
+                delay_received = int(re.findall(r'.*Try again after (.*) seconds', response.text)[0])
+                delay = int(delay_received)
+                logging.error(f"Delaying for an additional {delay} seconds")
+            except:
+                logging.error(f"Some issue occured with the delay we recevied: {delay_received}")
+        time.sleep(delay)
+        response = requests.get(url, headers=headers) 
+    if response.status_code == 200:
+        xml =  response.text
+        logging.debug(f"XML Data: {xml}")
+        root = ET.fromstring(xml)
+        ipdata = {}
+        ipdata[ip] = {}
+        ipdata[ip]["number"] = root.findall("number")[0].text
+        ipdata[ip]["count"] = root.findall("count")[0].text
+        ipdata[ip]["attacks"] = root.findall("attacks")[0].text
+        ipdata[ip]["maxdate"] = root.findall("maxdate")[0].text
+        ipdata[ip]["mindate"] = root.findall("mindate")[0].text
+        ipdata[ip]["updated"] = root.findall("updated")[0].text
+        ipdata[ip]["comment"] = root.findall("comment")[0].text
+        ipdata[ip]["maxrisk"] = root.findall("maxrisk")[0].text
+        ipdata[ip]["asabusecontact"] = root.findall("asabusecontact")[0].text
+        ipdata[ip]["as"] = root.findall("as")[0].text
+        ipdata[ip]["asname"] = root.findall("asname")[0].text
+        ipdata[ip]["ascountry"] = root.findall("ascountry")[0].text
+        ipdata[ip]["assize"] = root.findall("assize")[0].text
+        ipdata[ip]["network"] = root.findall("network")[0].text
+        for idx2, webloginfo in enumerate(root.findall("weblogs")):
+            ipdata[ip]["weblog_count"] = webloginfo.findall("count")[0].text
+            ipdata[ip]["weblog_avgauthors"] = webloginfo.findall("avgauthors")[0].text
+            ipdata[ip]["weblog_avgurls"] = webloginfo.findall("avgurls")[0].text
+            ipdata[ip]["weblog_avguseragents"] = webloginfo.findall("avguser_agents")[0].text
+            ipdata[ip]["weblog_firstseen"] = webloginfo.findall("firstseen")[0].text
+            ipdata[ip]["lastseen"] = webloginfo.findall("lastseen")[0].text
+        return ipdata
+
+#<threatcategory>
+#<research>
+#<ipv4>4.16.74.81</ipv4>
+#<added>2020-07-18</added>
+#<lastseen>2024-07-24</lastseen>
+#<type>scorecard</type>
+#</research>
+def isc_research_threats(email, start_date=None, end_date=None):
+    #url = f"https://isc.sans.edu/api/ip/{ip}"
+    date_range = ""
+    if start_date is not None and end_date is not None:
+        date_range = f"{start_date}/{end_date}"
+    url = f"https://isc.sans.edu/api/threatcategory/research/{date_range}"
+    headers = {
+        'User-Agent': f'Request from {email}',
+    }   
+
+    while True:
+        try:
+            response = requests.get(url, headers=headers)
+        except Exception as e:
+            logging.error(f"Exception hit for SANS ISC Research Threats query: '{e}'. Pausing for 15 seconds before trying again.")
+            time.sleep(15)
+            continue
+        break
+        
+    xml =  response.text
+    logging.debug(f"XML Data: {xml}")
+    root = ET.fromstring(xml)
+    threat_intel = []
+    for idx, research_info in enumerate(root.findall("research")):
+        threat_intel.append(
+            {
+                "ipv4": research_info.findall("ipv4")[0].text,
+                "added": research_info.findall("added")[0].text,
+                "lastseen": research_info.findall("lastseen")[0].text,
+                "type": research_info.findall("type")[0].text
+            }
+        )
+
+    return pd.DataFrame(threat_intel)
+
+def binary_edge_minions(email):
+    # bad URL as of 7/6/2025
+    # url = f"https://api.binaryedge.io/krang/v1/minions"
+    url = f"https://api.binaryedge.io/v1/minions"
+
+    headers = {
+        'User-Agent': f'Request from {email}',
+    }   
+
+    while True:
+        try:
+            #this gave error 404 on 7/6/2025
+            response = requests.get(url, headers=headers)  
+        except Exception as e:
+            logging.error(f"Exception hit for Binary Edge query: '{e}'. Pausing for 15 seconds before trying again.")
+            time.sleep(15)
+            continue
+        break    
+      
+    scanners =  json.loads(response.text)['scanners']
+
+    #return a list of binary edge minions (scanning agents)
+    return scanners
+
+def censys_networks(email):
+    url = f"https://support.censys.io/hc/en-us/article_attachments/25644686434196"
+
+    headers = {
+        'User-Agent': f'Request from {email}',
+    }   
+
+    while True:
+        try:
+            response = requests.get(url, headers=headers) 
+        except Exception as e:
+            logging.error(f"Exception hit for Censys query: '{e}'. Pausing for 15 seconds before trying again.")
+            time.sleep(15)
+            continue
+        break
+
+    scanners =  response.text.split("\n")
+
+    #return a list of binary edge minions (scanning agents)
+    return scanners
+
+@lru_cache
+def get_reverse_dns(ipaddress):
+    response = ""
+    try:
+        response = socket.gethostbyaddr(f"{ipaddress}")
+    except Exception as e:
+        if "host not found" in e:
+            logging.info(f"Lookup failed for {ipaddress}: {e}")
+        else:
+            logging.error(f"Lookup failed for {ipaddress}: {e}")
+    if len(response) == 0:
+        return response
+    else:
+        return response[0]
+    
+
+def isc_webhoneypot_useragents(user_agent, day, email):
+    url = f"https://isc.sans.edu/api/webhoneypotreportsbyua/{user_agent}/{day}?json"
+    headers = {
+        'User-Agent': f'Request from {email}',
+    }   
+    while True:
+        try:
+            response = requests.get(url, headers=headers)  
+        except Exception as e:
+            logging.error(f"Exception hit for SANS ISC web honeypot user agent query: '{e}'. Pausing for 15 seconds before trying again.")
+            time.sleep(15)
+            continue
+        break
+    
+    return json.loads(response.text)    
+    
+def extract_ips(data):
+    ips = re.findall(r'(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})', data)
+    return_ips = []
+    for each_ip in ips:
+        try:
+            ip = ipaddress.ip_address(each_ip)
+            return_ips.append(each_ip)
+        except:
+            logging.error(f"Error trying to create IP address object from {each_ip}")
+    return return_ips
+
+def extract_subnets(data):
+    networks = re.findall(r'(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})', data)
+    return_networks = []
+    for each_network in networks:
+        try:
+            network = ipaddress.ip_network(each_network)
+            return_networks.append(each_network)
+        except:
+            logging.error(f"Error trying to create network object from {each_network}")
+    return return_networks   

dshield_parser/utils/file_io.py

@@ -0,0 +1,108 @@
+import logging
+import json
+import dshield_parser.utils as utils
+import dshield_parser.utils.json as dshield_json
+from pathlib import Path
+import sys
+import os
+
+def read_file_string(filename):
+    filehandle = open(filename, encoding="utf-8")
+    string = filehandle.read()
+    return string
+
+def read_file_json(filename):
+    try:
+        filehandle = open(filename, encoding="utf-8")
+        json_data = json.load(filehandle)
+    except:
+        json_data = read_file_json_stream(filename)
+    return json_data
+
+def read_file_json_stream(filename):
+    data = []
+    with open(filename) as file:
+        for line in file:
+            if line[:1] =="{":
+                data.append(json.loads(line))
+    return(data)
+
+def read_file_json_generator(filename):
+    file = open(filename, "r", encoding="utf-8")
+    for line in file:
+        if line[:1] =="{":
+            try:
+                yield json.loads(line) #.replace('\x00','') # added .replace('\x00','') on 8/17/24 to replace null bytes for pandas merge issues
+            except Exception as e:
+                logging.error(f"Exception hit for file '{filename}': {e}")
+                logging.error(f"Text of line with error (limted to first 40 characters): '{line[0:40]}'")
+    file.close()
+
+def get_honeypot_list(path):
+    honeypots = []
+    dir_contents =  os.listdir(path)
+    for each_item in dir_contents:
+        if os.path.isdir(path + "\\" + each_item):
+            honeypots.append(each_item)
+    return honeypots
+
+def get_file_lists(path):
+    cowrie_files = []
+    web_honeypot_files = []
+    firewall_files = []
+    if os.path.exists(f"{path}\\logs\\dshield_firewall_.log"):
+        firewall_files.append(f"{path}\\logs\\dshield_firewall_.log")
+    try:
+        folder_list = Path(path)
+        #file_list = sorted(Path(path).iterdir(), key=os.path.getmtime)
+    except:
+        print(f"{path}: File Listing Error Occurred")
+    for each_item in folder_list.glob('**/*'):
+        if "cowrie.json" in str(each_item):
+            cowrie_files.append(each_item)
+        elif "webhoneypot-" in str(each_item):
+            web_honeypot_files.append(each_item)
+        elif "webhoneypot_" in str(each_item):
+            web_honeypot_files.append(each_item)            
+    cowrie_files = sorted(cowrie_files, key=os.path.getmtime)
+    web_honeypot_files = sorted(web_honeypot_files, key=os.path.getmtime)
+    firewall_files = sorted(firewall_files, key=os.path.getmtime)
+    return cowrie_files, web_honeypot_files, firewall_files
+
+def get_overlapping_file_lists(path):
+    cowrie_files, web_honeypot_files, firewall_files = get_file_lists(path)
+
+def get_honeypot_directories(path):
+    honeypots = []
+    honeypot_dirs = []
+    try:
+        file_list = sorted(Path(path).iterdir(), key=os.path.getmtime)
+    except:
+        print("File Listing Error Occurred")
+    for each_item in file_list:
+        if os.path.isdir(each_item):
+            honeypots.append(os.path.basename(each_item))
+            honeypot_dirs.append(each_item)
+    return honeypots, honeypot_dirs
+
+def save_dict_to_file(dict, filename):
+    logging.info(f"Saving data from dict to file '{filename}'")
+    filehandle = open(filename, "a", encoding="utf-8")
+    for key, value in dict.items():
+        filehandle.write(f"{value}\t{key}\n")
+    filehandle.close()
+
+def save_list_to_file(list, filename):
+    logging.info(f"Saving data from list to file '{filename}'")
+    filehandle = open(filename, "a", encoding="utf-8")
+    for each_item in dict:
+        filehandle.write(f"{each_item}\n")
+    filehandle.close()
+
+# will be used when executing the script
+if __name__ == "__main__":
+    filepath = sys.argv[1]
+    if os.path.exists(filepath):
+        dshield_json.print_json_pretty(sys.argv[1])
+    else:
+        print("Argument supplied is not a file that exists.")

dshield_parser/utils/graphs.py

@@ -0,0 +1,121 @@
+import logging
+import matplotlib.pyplot as plt
+import numpy as np
+import pandas as pd
+
+#def plot_date_counts(dict):
+#    lists = sorted(dict.items())
+#    x, y = zip(*lists)
+
+
+    #plt.locator_params(axis='y', nticks=4)
+    #plt.locator_params(axis='x', nticks=8)
+#    plt.ticklabel_format(style='plain')     
+#    plt.plot(x, y)
+#    plt.xticks(get_ticks(x, 8))
+#    plt.ylabel("Number of Access Attempts")
+#    plt.xlabel("Date")
+#    plt.title("Honeypot Traffic Over Time")
+#    plt.show()
+
+def get_ticks(values, numticks):
+    ticks = []
+    length = len(values)
+    ticks.append(values[0])
+    separation = int((length) / (numticks -1))
+    counter = separation
+    while counter < (length -1):
+        ticks.append(values[counter])
+        counter += separation
+    if len(ticks) < numticks:
+        ticks.append(values[length-1])
+    return ticks
+
+def plot_date_counts(data, main_title, y_label):
+    if len(data) > 1:
+        num_rows = (len(data) // 2) + (len(data) % 2)
+        num_columns = (len(data) // num_rows) + (len(data) % 2)
+        figure, subplots = plt.subplots(num_rows, num_columns, figsize=(20,12), constrained_layout=True)
+    else:
+        figure, subplots = plt.subplots(figsize=(10,6), constrained_layout=True)
+
+    plots = subplots.flatten()
+
+    #overlapping_figure, overlapping_plot = plt.subplots(figsize=(20,12), constrained_layout=True)
+    #overlapping_plot.set_ylabel(y_label)
+    #overlapping_plot.set_xlabel("Date")
+    #overlapping_plot.set_title(main_title)
+
+    plot_index = 0
+
+    figure.suptitle(main_title)
+
+    for honeypotname, honeypot_data in data.items():
+        if len(honeypot_data) == 0:
+            logging.info("Blank data received for {honeypotname}")
+            logging.info("Will ignore plotting graph data for {honeypotname}")
+        else:
+            lists = sorted(honeypot_data.items())
+            x, y = zip(*lists)
+
+            if len(data) == 1:
+                subplots.xaxis.set_major_locator(plt.MaxNLocator(8))
+                subplots.ticklabel_format(style='plain')     
+                subplots.plot(x, y)
+                subplots.set_ylabel(y_label)
+                subplots.set_xlabel("Date")
+                subplots.set_title(honeypotname)                
+            else:
+                plots[plot_index].xaxis.set_major_locator(plt.MaxNLocator(8))
+                #ax.ticklabel_format(style='plain')     
+                plots[plot_index].plot(x, y)
+                #ax.plot([1, 2, 3], label='Inline label')
+                #line.set_label('Label via method')
+                #ax.legend()
+                #overlapping_plot.plot(x, y, label=honeypotname)
+                plots[plot_index].set_ylabel(y_label)
+                plots[plot_index].set_xlabel("Date")
+                plots[plot_index].set_title(honeypotname)
+        plot_index += 1
+
+    #plt.show()
+    plt.tight_layout()
+    plt.savefig(f'{main_title.replace(" ","_")}_multi.png')
+
+
+    #overlapping_plot.legend()
+    #overlapping_plot.plt.savefig(f'{main_title.replace(" ","_")}_overlap.png')
+
+def plot_date_counts_overlapping(data, main_title, y_label):
+    overlapping_figure, overlapping_plot = plt.subplots(figsize=(20,12), constrained_layout=True)
+    overlapping_plot.set_ylabel(y_label)
+    overlapping_plot.set_xlabel("Date")
+    overlapping_plot.set_title(main_title)
+    for honeypotname, honeypot_data in data.items():
+        if len(honeypot_data) == 0:
+            logging.info("Blank data received for {honeypotname}")
+            logging.info("Will ignore plotting graph data for {honeypotname}")
+        else:
+            lists = sorted(honeypot_data.items())
+            x, y = zip(*lists)
+            overlapping_plot.plot(x, y, label=honeypotname)
+    overlapping_plot.legend()
+    overlapping_plot.xaxis.set_major_locator(plt.MaxNLocator(8))
+    plt.tight_layout()
+    plt.savefig(f'{main_title.replace(" ","_")}_overlapping.png')
+
+def plot_time_counts(dict, plottype=None, ylabel=None, xlabel=None, title=None, type=None):
+    lists = sorted(dict.items())
+    x, y = zip(*lists)
+    start = x[0]
+    end = x[-1]  
+    #daterange = pd.timedelta_range(start, end)  
+
+    plt.ticklabel_format(style='plain')     
+    plt.hist(x, y)
+    #plt.xticks(daterange)
+    plt.ylabel("Number of Access Attempts")
+    plt.xlabel("Date")
+    plt.title("Honeypot Traffic Over Time")
+    plt.show()
+