1
2
3
4
5 import os
6 import collections
7
8 from lib.cuckoo.common.constants import CUCKOO_ROOT
9 from modules.processing.behavior import ParseProcessLog
10
11 ANALYSIS_ROOT = os.path.join(CUCKOO_ROOT, "storage", "analyses")
12
14 catcounts = collections.defaultdict(lambda: 0)
15
16 for call in calls:
17 catcounts[call.get("category", "none")] += 1
18
19 return dict(catcounts)
20
22
23 cats = set()
24 for v in stats.values():
25 for v2 in v.values():
26 cats |= set(v2.keys())
27
28 sums = {}
29 for tid in stats:
30 sums[tid] = {}
31 for cat in cats:
32 sums[tid][cat] = sum(j.get(cat, 0) for j in stats[tid].values())
33
34 totals = dict((k, sum(v.values())) for k, v in sums.items())
35
36 percentages = {}
37 for tid in stats:
38 percentages[tid] = {}
39 for cat in cats:
40 percentages[tid][cat] = round(sums[tid][cat] * 1.0 / totals[tid] * 100, 2)
41
42 return percentages
43
45 tpath = os.path.join(ANALYSIS_ROOT, str(tid), "logs")
46
47 for fname in os.listdir(tpath):
48 fpath = os.path.join(tpath, fname)
49 pid = int(fname.split(".")[0])
50 yield (pid, fpath)
51
65
67 counts = {}
68
69 for tid in[tid1, tid2]:
70 counts[tid] = {}
71
72 pids_calls = results_db.analysis.find_one(
73 {
74 "info.id": int(tid),
75 },
76 {
77 "behavior.processes.process_id": 1,
78 "behavior.processes.calls": 1
79 }
80 )
81
82 if not pids_calls:
83 continue
84
85 for pdoc in pids_calls["behavior"]["processes"]:
86 pid = pdoc["process_id"]
87 counts[tid][pid] = {}
88
89 for coid in pdoc["calls"]:
90 chunk = results_db.calls.find_one({"_id": coid}, {"calls.category": 1})
91 category_counts = behavior_categories_percent(chunk["calls"])
92 for cat, count in category_counts.items():
93 if cat in ignore_categories: continue
94 counts[tid][pid][cat] = counts[tid][pid].get(cat, 0) + count
95
96 return combine_behavior_percentages(counts)
97