Package modules :: Package processing :: Module behavior :: Class BehaviorAnalysis
[hide private]
[frames] | no frames]

Class BehaviorAnalysis

source code

                            object --+    
                                     |    
lib.cuckoo.common.abstracts.Processing --+
                                         |
                                        BehaviorAnalysis

Behavior Analyzer.

The behavior key in the results dict will contain both default content keys that contain generic / abstracted analysis info, available on any platform, as well as platform / analyzer specific output.

Typically the analyzer behavior contains some sort of "process" separation as we're tracking different processes in most cases.

There are several handlers that produce the respective keys / subkeys. Overall the platform / analyzer specific ones parse / process the captured data and yield both their own output, but also a standard structure that is then captured by the "generic" handlers so they can generate the standard result structures.

The resulting structure contains some iterator onions for the monitored function calls that stream the content when some sink (reporting, signatures) needs it, thereby reducing memory footprint.

So hopefully in the end each analysis should be fine with 2 passes over the results, once during processing (creating the generic output, summaries, etc) and once during reporting (well once for each report type if multiple are enabled).

Instance Methods [hide private]
 
_enum_logs(self)
Enumerate all behavior logs.
source code
 
run(self)
Run analysis.
source code

Inherited from lib.cuckoo.common.abstracts.Processing: __init__, set_baseline, set_options, set_path, set_results, set_task

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Variables [hide private]
  key = "behavior"

Inherited from lib.cuckoo.common.abstracts.Processing: enabled, order

Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

run(self)

source code 

Run analysis.

Returns:
results dict.
Raises:
  • NotImplementedError - this method is abstract.
Overrides: lib.cuckoo.common.abstracts.Processing.run