Project Rishi: Identify Bot Contaminated Hosts

News:

[08/22/2012]	New IRC bot nickname signature added, many thanks to Jens Hektor from RWTH-Aachen University for keeping me uptodate!
[04/22/2010]	We are still frequently updating our nickname signatures, so please run ./rishi -u at regular intervals to update to the current list.
[12/22/2009]	Another few updates to the regular expression have been made during the last weeks, so please run ./rishi -u to update to the current list of regular expressions.
[03/13/2009]	Even more feedback lead to the discovery of a little left over from a debugging session which might cause errors when using a different collector than pypcap. For those using other collectors just edit worker_class.py at line 383 and delete the line self.boLogger.info(item['rawpacket']).
[03/13/2009]	Thanks to great feedback from RWTH-Aachen University the regular expressions of Rishi now exceed the one hundred =) So run ./rishi -u to update to the current list of regular expressions.
[10/16/2008]	Alright a minor update to the expression, two new signatures for bot names. More important the URL of the DNS replication changed. Simply change the URL in details.php of the webinterface to http://www.bfk.de/bfk_dnslogger.html. Should be easy to find.
[10/08/2008]	New release v0.9.6 with a few bugfixes. Files are available here.
[06/18/2008]	It is finally there, the next release with a lot of changes. Anybody who is updating from a previous version, make sure to clear the mysql tables, otherwise there will be errors with the anonymization. Files are available here.
[05/30/2008]	For those of you wondering what is going on. we are currently doing some testing for the next release, today i added a new collector method using the pypcap class, which might become the new recommended method. A new webinterface will also be available. i expect the new release to appear somewhen in june.
[03/17/2008]	I got the reply from a lawyer about what needs to be done to preserve privacy of the users, when using Rishi. I am currently working on that, so next release will take some more time. Additionally i am trying to move Rishi to sourceforge.
[02/15/2008]	Three new regex have just been added to match the latest threads found (./rishi -u). I am currently working on the next release which fixes some smaller bugs and implements some privacy related features, like do not log IP addresses of hosts reaching only X points, or anonymize the IP address of all hosts with point value below X.
[11/09/2007]	New Version 0.937b is fixes some small bugs and comes with a new mysql table layout. Additionally, i added a configuration file for regular expression for whitelisted nicknames. That means one can now also define regular expressions to match whitelisted nicknames. Furthermore, i modified the webinterface a little. In the detailed view one can now manually mark a connection as a possible bot.
[11/02/2007]	New Version 0.936b is available. This release fixes some minor issues concerning the mysql modul and some other fixes.
[09/17/2007]	Version 0.935b with MySQL support is available. The new version stores all information to MySQL as well. Additionally, I wrote a little Website to browse the stored data and quickly examine found incidents. However, the new version requires python-mysqldb installed in order to work.