Cyber Threat Intelligence (CTI) & Indicators of Compromise (IoCs)

System Architecture: Docker Components

The entire system is orchestrated using Docker Compose, which defines and manages a multi-container application. Below are the key services, their related files, and their functions:

• `mysqldb`: This container hosts the MySQL database. It serves as the central repository for storing all DNS query records captured by `dns_log_processor` and the detailed threat reports from VirusTotal.
• `dns_log_processor`: Built using `Dockerfile.dns`, this container runs the `dns_log_processor.py` script. Its main task is to continuously monitor the `dns.log` file and parse DNS queries that have a "reply" status. It then inserts this data, including the domain, response IP, and source IP, into the `mysqldb` database.
• `virustotal_scanner`: This is a custom Flask-based web service built with `Dockerfile.virustotal`. It runs the `virus_total.py` script which acts as an API. The service receives domains, queries the official VirusTotal API, and then stores the resulting analysis in the database.
• `dns_scanner`: Built with `Dockerfile.scanner`, this container runs the `dns_scanner.py` script. Its purpose is to automate scanning. It periodically connects to the database, retrieves a list of new domains that have not yet been scanned, and sends them to the `virustotal_scanner` service for analysis.

This modular, containerized approach ensures that each component can be managed independently, making the system robust, scalable, and easy to maintain.

Threat Analysis in Practice: Example Query

To demonstrate the system's effectiveness, a simple SQL query can be run to retrieve a summary of the scanned domains. The query below selects information from a database view, providing an at-a-glance overview of which domains are clean and which have been flagged as malicious.

SELECT url, scan_date, positives_total_scans, permalink FROM v_scanned_domains;

The results clearly show how the system successfully identifies and logs both legitimate and potentially malicious domains. The `positives_total_scans` column indicates the number of security vendors that flagged the URL, while the `permalink` provides a direct link to the full VirusTotal report for a deep-dive analysis.

This example demonstrates that even URLs associated with legitimate services might be flagged if they are part of a larger chain of redirects or have been involved in past malicious activities, highlighting the importance of continuous monitoring.

Automated Threat Response: The Next Frontier

While the current system provides a robust platform for collecting and analyzing threat intelligence, the next logical step is to transition from a passive monitoring solution to a fully automated threat response mechanism. This evolution will introduce dynamic, rule-based logic to actively neutralize threats based on the CTI data collected.

This orchestrated defense strategy will be governed by a predefined threshold based on the VirusTotal analysis results. The `positives_total_scans` metric will serve as the key decision-making factor, creating a tiered response system:

• Tier 1: Deeper Analysis via Suricata
  Domains that have not exceeded a low-risk threshold (e.g., fewer than 3 positives) will not be immediately blocked. Instead, they will be dynamically forwarded to Suricata—an advanced Intrusion Detection System (IDS). This will allow for deeper behavioral analysis within the network traffic. The data from Suricata, including detailed alert information, will be centralized in Graylog for comprehensive logging and analyst review. This approach enables the investigation of suspicious, but not yet confirmed, threats, preventing potential false positives while still providing valuable forensic data.
• Tier 2: Immediate DNS-Level Blocking
  Domains that meet or exceed a critical threat threshold (e.g., 3 or more positives) will be automatically and immediately blocked at the DNS level. This is a high-impact countermeasure designed to prevent any further communication with a known malicious host. By integrating this action directly with the DNS resolver, the system proactively protects all devices on the network, preventing data exfiltration, malware downloads, or other malicious activities from reaching their target.

This automated, two-tiered response pipeline represents a significant leap forward, transforming the home network into an intelligent, self-defending system. It automates the correlation of threat intelligence with active countermeasures, minimizing response time and significantly enhancing the network's overall resilience against sophisticated cyber threats.

Configuration and Source Files

All configuration files, including the `docker-compose.yml` that orchestrates the entire system, can be found in the dedicated GitHub repository.

View all configuration files on GitHub