Class BehaviorAnalysis
source code
object --+
|
lib.cuckoo.common.abstracts.Processing --+
|
BehaviorAnalysis
Behavior Analyzer.
The behavior key in the results dict will contain both default content
keys that contain generic / abstracted analysis info, available on any
platform, as well as platform / analyzer specific output.
Typically the analyzer behavior contains some sort of
"process" separation as we're tracking different processes in
most cases.
There are several handlers that produce the respective keys / subkeys.
Overall the platform / analyzer specific ones parse / process the
captured data and yield both their own output, but also a standard
structure that is then captured by the "generic" handlers so
they can generate the standard result structures.
The resulting structure contains some iterator onions for the
monitored function calls that stream the content when some sink
(reporting, signatures) needs it, thereby reducing memory footprint.
So hopefully in the end each analysis should be fine with 2 passes
over the results, once during processing (creating the generic output,
summaries, etc) and once during reporting (well once for each report type
if multiple are enabled).
|
_enum_logs(self)
Enumerate all behavior logs. |
source code
|
|
|
|
Inherited from lib.cuckoo.common.abstracts.Processing :
__init__ ,
set_baseline ,
set_options ,
set_path ,
set_results ,
set_task
Inherited from object :
__delattr__ ,
__format__ ,
__getattribute__ ,
__hash__ ,
__new__ ,
__reduce__ ,
__reduce_ex__ ,
__repr__ ,
__setattr__ ,
__sizeof__ ,
__str__ ,
__subclasshook__
|
Inherited from object :
__class__
|