MalwareDetection/ExtractDynamic.py at master · kasangeri/MalwareDetection · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
# -*- coding: utf-8 -*-
"""Dynamic1.ipynb

Automatically generated by Colaboratory.

Original file is located at
    https://colab.research.google.com/drive/1sJUfWutxLrhRUccKEuVz6ctNYxETLaHz
"""

from google.colab import drive
drive.mount('/content/drive')

!7z x /content/drive/My\ Drive/Colab\ Notebooks/Dynamic_Analysis_Data_Part1.7z

import numpy as np
import os
import json
import csv
from collections import OrderedDict

# benign_dir = "/content/Dynamic_Analysis_Data_Part1/Benign"
malware_dir = "/content/Dynamic_Analysis_Data_Part1/Malware/Trojan"
network = ["tls", "udp", "dns", "http", "icmp", "smtp", "tcp", "hosts", "domains", "irc"]
summary = ["file_created", "file_recreated", "dll_loaded", "file_opened", "file_read", "file_written", "regkey_opened", "regkey_read"]
cat = ["synchronisation", "system", "__notification__", "certificate", "netapi", "file", "misc", "process", "ole", "registry", "services", "network", "resource", "ui", "crypto", "exception", "iexplore"]
with open("trojan1.txt", 'w', newline='') as csvfile:
  spamwriter = csv.writer(csvfile, delimiter=',', quotechar='|', quoting=csv.QUOTE_MINIMAL)
  headers = ['f']*37
  for filename in os.listdir(malware_dir):
    calls = OrderedDict()
    for c in cat:
      calls[c] = 0
    values = []
    with open(malware_dir+"/"+filename) as json_file:
      data = json.load(json_file)
      values.append(data["info"]["duration"])
      for n in network:
        try:
          values.append(len(data["network"][n]))
        except:
          values.append(0)
      for s in summary:
        try:
          sums = 0
          for g in data["behavior"]["generic"]:
            sums += len(g["summary"][s])
          values.append(sums)
        except:
          values.append(0)
      try:
        values.append(len(data["behavior"]["processes"]))
      except:
        values.append(0)
      for p in data["behavior"]["processes"]:
          c = p["calls"]
          for cats in c:
            calls[cats["category"]] += 1

      for c in calls:
        values.append(calls[c])
    spamwriter.writerow(values)