lib.cuckoo.common.compare

Package lib :: Package cuckoo :: Package common :: Module compare |
[hide private]
[frames] | no frames]

# Source Code for Module lib.cuckoo.common.compare

      1  # Copyright (C) 2010-2013 Claudio Guarnieri.
      2  # Copyright (C) 2014-2016 Cuckoo Foundation.
      3  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
      4  # See the file 'docs/LICENSE' for copying permission.
      5
      6  import os
      7  import collections
      8
      9  from lib.cuckoo.common.constants import CUCKOO_ROOT
     10
     11  ANALYSIS_ROOT = os.path.join(CUCKOO_ROOT, "storage", "analyses")
     12
     13 -def behavior_categories_percent(calls):
     14      catcounts = collections.defaultdict(lambda: 0)
     15
     16      for call in calls:
     17          catcounts[call.get("category", "none")] += 1
     18
     19      return dict(catcounts)
     20
     21 -def combine_behavior_percentages(stats):
     22      # get all categories present
     23      cats = set()
     24      for v in stats.values():
     25          for v2 in v.values():
     26              cats |= set(v2.keys())
     27
     28      sums = {}
     29      for tid in stats:
     30          sums[tid] = {}
     31          for cat in cats:
     32              sums[tid][cat] = sum(j.get(cat, 0) for j in stats[tid].values())
     33
     34      totals = dict((k, sum(v.values())) for k, v in sums.items())
     35
     36      percentages = {}
     37      for tid in stats:
     38          percentages[tid] = {}
     39          for cat in cats:
     40              percentages[tid][cat] = round(sums[tid][cat] * 1.0 / totals[tid] * 100, 2)
     41
     42      return percentages
     43
     44 -def iter_task_process_logfiles(tid):
     45      tpath = os.path.join(ANALYSIS_ROOT, str(tid), "logs")
     46
     47      for fname in os.listdir(tpath):
     48          fpath = os.path.join(tpath, fname)
     49          pid = int(fname.split(".")[0])
     50          yield (pid, fpath)
     51
     52 -def helper_percentages_storage(tid1, tid2):
     53      counts = {}
     54
     55      for tid in [tid1, tid2]:
     56          counts[tid] = {}
     57
     58          for pid, fpath in iter_task_process_logfiles(tid):
     59              # ppl = ParseProcessLog(fpath)
     60              # category_counts = behavior_categories_percent(ppl.calls)
     61              category_counts = None
     62
     63              counts[tid][pid] = category_counts
     64
     65      return combine_behavior_percentages(counts)
     66
     67 -def helper_percentages_mongo(results_db, tid1, tid2, ignore_categories=["misc"]):
     68      counts = {}
     69
     70      for tid in[tid1, tid2]:
     71          counts[tid] = {}
     72
     73          pids_calls = results_db.analysis.find_one(
     74              {
     75                  "info.id": int(tid),
     76              },
     77              {
     78                  "behavior.processes.pid": 1,
     79                  "behavior.processes.calls": 1
     80              }
     81          )
     82
     83          if not pids_calls:
     84              continue
     85
     86          for pdoc in pids_calls["behavior"]["processes"]:
     87              pid = pdoc["pid"]
     88              counts[tid][pid] = {}
     89
     90              for coid in pdoc["calls"]:
     91                  chunk = results_db.calls.find_one({"_id": coid}, {"calls.category": 1})
     92                  category_counts = behavior_categories_percent(chunk["calls"])
     93                  for cat, count in category_counts.items():
     94                      if cat in ignore_categories:
     95                          continue
     96
     97                      counts[tid][pid][cat] = counts[tid][pid].get(cat, 0) + count
     98
     99      return combine_behavior_percentages(counts)
    100