modules.processing.behavior.BehaviorAnalysis

Package modules :: Package processing :: Module behavior :: Class BehaviorAnalysis |
[hide private]
[frames] | no frames]

# Class BehaviorAnalysis

source code

                                object --+
                                         |
    lib.cuckoo.common.abstracts.Processing --+
                                             |
                                            BehaviorAnalysis

Behavior Analyzer.

The behavior key in the results dict will contain both default content keys that contain generic / abstracted analysis info, available on any platform, as well as platform / analyzer specific output.

Typically the analyzer behavior contains some sort of "process" separation as we're tracking different processes in most cases.

There are several handlers that produce the respective keys / subkeys. Overall the platform / analyzer specific ones parse / process the captured data and yield both their own output, but also a standard structure that is then captured by the "generic" handlers so they can generate the standard result structures.

The resulting structure contains some iterator onions for the monitored function calls that stream the content when some sink (reporting, signatures) needs it, thereby reducing memory footprint.

So hopefully in the end each analysis should be fine with 2 passes over the results, once during processing (creating the generic output, summaries, etc) and once during reporting (well once for each report type if multiple are enabled).

Instance Methods | [hide private]
_enum_logs(self) Enumerate all behavior logs. | source code
run(self) Run analysis. | source code
Inherited from `lib.cuckoo.common.abstracts.Processing`: `__init__`, `set_baseline`, `set_options`, `set_path`, `set_results`, `set_task` Inherited from `object`: `__delattr__`, `__format__`, `__getattribute__`, `__hash__`, `__new__`, `__reduce__`, `__reduce_ex__`, `__repr__`, `__setattr__`, `__sizeof__`, `__str__`, `__subclasshook__`

Class Variables | [hide private]
| key = `"behavior"`
Inherited from `lib.cuckoo.common.abstracts.Processing`: `enabled`, `order`

Properties | [hide private]
Inherited from `object`: `__class__`

Method Details | [hide private]

### run(self) | source code
Run analysis. Returns: results dict. Raises: `NotImplementedError` - this method is abstract. Overrides: lib.cuckoo.common.abstracts.Processing.run