Package lib :: Package cuckoo :: Package common :: Module compare
[hide private]
[frames] | no frames]

Source Code for Module lib.cuckoo.common.compare

  1  # Copyright (C) 2010-2013 Claudio Guarnieri. 
  2  # Copyright (C) 2014-2016 Cuckoo Foundation. 
  3  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 
  4  # See the file 'docs/LICENSE' for copying permission. 
  5   
  6  import os 
  7  import collections 
  8   
  9  from lib.cuckoo.common.constants import CUCKOO_ROOT 
 10   
 11  ANALYSIS_ROOT = os.path.join(CUCKOO_ROOT, "storage", "analyses") 
 12   
13 -def behavior_categories_percent(calls):
14 catcounts = collections.defaultdict(lambda: 0) 15 16 for call in calls: 17 catcounts[call.get("category", "none")] += 1 18 19 return dict(catcounts)
20
21 -def combine_behavior_percentages(stats):
22 # get all categories present 23 cats = set() 24 for v in stats.values(): 25 for v2 in v.values(): 26 cats |= set(v2.keys()) 27 28 sums = {} 29 for tid in stats: 30 sums[tid] = {} 31 for cat in cats: 32 sums[tid][cat] = sum(j.get(cat, 0) for j in stats[tid].values()) 33 34 totals = dict((k, sum(v.values())) for k, v in sums.items()) 35 36 percentages = {} 37 for tid in stats: 38 percentages[tid] = {} 39 for cat in cats: 40 percentages[tid][cat] = round(sums[tid][cat] * 1.0 / totals[tid] * 100, 2) 41 42 return percentages
43
44 -def iter_task_process_logfiles(tid):
45 tpath = os.path.join(ANALYSIS_ROOT, str(tid), "logs") 46 47 for fname in os.listdir(tpath): 48 fpath = os.path.join(tpath, fname) 49 pid = int(fname.split(".")[0]) 50 yield (pid, fpath)
51
52 -def helper_percentages_storage(tid1, tid2):
53 counts = {} 54 55 for tid in [tid1, tid2]: 56 counts[tid] = {} 57 58 for pid, fpath in iter_task_process_logfiles(tid): 59 # ppl = ParseProcessLog(fpath) 60 # category_counts = behavior_categories_percent(ppl.calls) 61 category_counts = None 62 63 counts[tid][pid] = category_counts 64 65 return combine_behavior_percentages(counts)
66
67 -def helper_percentages_mongo(results_db, tid1, tid2, ignore_categories=["misc"]):
68 counts = {} 69 70 for tid in[tid1, tid2]: 71 counts[tid] = {} 72 73 pids_calls = results_db.analysis.find_one( 74 { 75 "info.id": int(tid), 76 }, 77 { 78 "behavior.processes.pid": 1, 79 "behavior.processes.calls": 1 80 } 81 ) 82 83 if not pids_calls: 84 continue 85 86 for pdoc in pids_calls["behavior"]["processes"]: 87 pid = pdoc["pid"] 88 counts[tid][pid] = {} 89 90 for coid in pdoc["calls"]: 91 chunk = results_db.calls.find_one({"_id": coid}, {"calls.category": 1}) 92 category_counts = behavior_categories_percent(chunk["calls"]) 93 for cat, count in category_counts.items(): 94 if cat in ignore_categories: 95 continue 96 97 counts[tid][pid][cat] = counts[tid][pid].get(cat, 0) + count 98 99 return combine_behavior_percentages(counts)
100