Package lib :: Package cuckoo :: Package common :: Module compare
[hide private]
[frames] | no frames]

Source Code for Module lib.cuckoo.common.compare

 1  # Copyright (C) 2010-2015 Cuckoo Foundation. 
 2  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 
 3  # See the file 'docs/LICENSE' for copying permission. 
 4   
 5  import os 
 6  import collections 
 7   
 8  from lib.cuckoo.common.constants import CUCKOO_ROOT 
 9  from modules.processing.behavior import ParseProcessLog 
10   
11  ANALYSIS_ROOT = os.path.join(CUCKOO_ROOT, "storage", "analyses") 
12   
13 -def behavior_categories_percent(calls):
14 catcounts = collections.defaultdict(lambda: 0) 15 16 for call in calls: 17 catcounts[call.get("category", "none")] += 1 18 19 return dict(catcounts)
20
21 -def combine_behavior_percentages(stats):
22 # get all categories present 23 cats = set() 24 for v in stats.values(): 25 for v2 in v.values(): 26 cats |= set(v2.keys()) 27 28 sums = {} 29 for tid in stats: 30 sums[tid] = {} 31 for cat in cats: 32 sums[tid][cat] = sum(j.get(cat, 0) for j in stats[tid].values()) 33 34 totals = dict((k, sum(v.values())) for k, v in sums.items()) 35 36 percentages = {} 37 for tid in stats: 38 percentages[tid] = {} 39 for cat in cats: 40 percentages[tid][cat] = round(sums[tid][cat] * 1.0 / totals[tid] * 100, 2) 41 42 return percentages
43
44 -def iter_task_process_logfiles(tid):
45 tpath = os.path.join(ANALYSIS_ROOT, str(tid), "logs") 46 47 for fname in os.listdir(tpath): 48 fpath = os.path.join(tpath, fname) 49 pid = int(fname.split(".")[0]) 50 yield (pid, fpath)
51
52 -def helper_percentages_storage(tid1, tid2):
53 counts = {} 54 55 for tid in [tid1, tid2]: 56 counts[tid] = {} 57 58 for pid, fpath in iter_task_process_logfiles(tid): 59 ppl = ParseProcessLog(fpath) 60 category_counts = behavior_categories_percent(ppl.calls) 61 62 counts[tid][pid] = category_counts 63 64 return combine_behavior_percentages(counts)
65
66 -def helper_percentages_mongo(results_db, tid1, tid2, ignore_categories=["misc"]):
67 counts = {} 68 69 for tid in[tid1, tid2]: 70 counts[tid] = {} 71 72 pids_calls = results_db.analysis.find_one( 73 { 74 "info.id": int(tid), 75 }, 76 { 77 "behavior.processes.process_id": 1, 78 "behavior.processes.calls": 1 79 } 80 ) 81 82 if not pids_calls: 83 continue 84 85 for pdoc in pids_calls["behavior"]["processes"]: 86 pid = pdoc["process_id"] 87 counts[tid][pid] = {} 88 89 for coid in pdoc["calls"]: 90 chunk = results_db.calls.find_one({"_id": coid}, {"calls.category": 1}) 91 category_counts = behavior_categories_percent(chunk["calls"]) 92 for cat, count in category_counts.items(): 93 if cat in ignore_categories: continue 94 counts[tid][pid][cat] = counts[tid][pid].get(cat, 0) + count 95 96 return combine_behavior_percentages(counts)
97