1
2
3
4
5
6 import os
7 import collections
8
9 from lib.cuckoo.common.constants import CUCKOO_ROOT
10
11 ANALYSIS_ROOT = os.path.join(CUCKOO_ROOT, "storage", "analyses")
12
14 catcounts = collections.defaultdict(lambda: 0)
15
16 for call in calls:
17 catcounts[call.get("category", "none")] += 1
18
19 return dict(catcounts)
20
22
23 cats = set()
24 for v in stats.values():
25 for v2 in v.values():
26 cats |= set(v2.keys())
27
28 sums = {}
29 for tid in stats:
30 sums[tid] = {}
31 for cat in cats:
32 sums[tid][cat] = sum(j.get(cat, 0) for j in stats[tid].values())
33
34 totals = dict((k, sum(v.values())) for k, v in sums.items())
35
36 percentages = {}
37 for tid in stats:
38 percentages[tid] = {}
39 for cat in cats:
40 percentages[tid][cat] = round(sums[tid][cat] * 1.0 / totals[tid] * 100, 2)
41
42 return percentages
43
45 tpath = os.path.join(ANALYSIS_ROOT, str(tid), "logs")
46
47 for fname in os.listdir(tpath):
48 fpath = os.path.join(tpath, fname)
49 pid = int(fname.split(".")[0])
50 yield (pid, fpath)
51
66
68 counts = {}
69
70 for tid in[tid1, tid2]:
71 counts[tid] = {}
72
73 pids_calls = results_db.analysis.find_one(
74 {
75 "info.id": int(tid),
76 },
77 {
78 "behavior.processes.pid": 1,
79 "behavior.processes.calls": 1
80 }
81 )
82
83 if not pids_calls:
84 continue
85
86 for pdoc in pids_calls["behavior"]["processes"]:
87 pid = pdoc["pid"]
88 counts[tid][pid] = {}
89
90 for coid in pdoc["calls"]:
91 chunk = results_db.calls.find_one({"_id": coid}, {"calls.category": 1})
92 category_counts = behavior_categories_percent(chunk["calls"])
93 for cat, count in category_counts.items():
94 if cat in ignore_categories:
95 continue
96
97 counts[tid][pid][cat] = counts[tid][pid].get(cat, 0) + count
98
99 return combine_behavior_percentages(counts)
100