Tor project analyzer

[srilumpa]

This PR aims to offer a solution to issue #45 with an analyzer extracting data from check.torproject.org to check if an IP address is a registered TOR exit node.

I documented both of the classes but if you need a more advance documentation, please tell me. Also, I hope i coped with your coding standards. If not tell me so I can fix it.

Note that the analyzer implements a caching system to avoid querying continuously the torproject website and to improve the analyzer performances. It takes only a few kB on disk and can be deactivated by setting the cache_duration configuration option to 0.

[3c7]

Hey @srilumpa is there an alternative to pyfscache? Pyfscache only supports python 2.7...

[3c7]

See https://github.com/srilumpa/Cortex-Analyzers/pull/1 for a proposal.

[3c7]

• Functionality

➜  TorProject git:(TorProjectAnalyzer) ✗ . ../../bin/activate
(TorProjectAnalyzer) ➜  TorProject git:(TorProjectAnalyzer) ✗ ./tor_project_analyzer.py <<< '{
"dataType": "ip",
"data": "1.2.3.4"    
}' | jq
{
  "success": true,
  "summary": {
    "taxonomies": [
      {
        "level": "info",
        "namespace": "TorProject",
        "predicate": "Node",
        "value": false
      }
    ]
  },
  "artifacts": [],
  "full": {}
}
(TorProjectAnalyzer) ➜  TorProject git:(TorProjectAnalyzer) ✗ ./tor_project_analyzer.py <<< '{
"dataType": "ip",
"data": "178.20.55.16"
}' | jq
{
  "success": true,
  "summary": {
    "taxonomies": [
      {
        "level": "suspicious",
        "namespace": "TorProject",
        "predicate": "Node",
        "value": true
      }
    ]
  },
  "artifacts": [
    {
      "type": "hash",
      "value": "EFAE44728264982224445E96214C15F9075DEE1D"
    }
  ],
  "full": {
    "node": "EFAE44728264982224445E96214C15F9075DEE1D",
    "last_status": "2017-12-18T07:06:05+0000"
  }
}
(TorProjectAnalyzer) ➜  TorProject git:(TorProjectAnalyzer) ✗ deactivate 

• Integration

[3c7]

Works great, thanks for the contribution.