|
6 | 6 | from collections import Counter
|
7 | 7 | from datetime import datetime as dt
|
8 | 8 |
|
| 9 | +count = int(os.sys.argv[5]) |
9 | 10 | # Usage Message
|
10 | 11 | if len(os.sys.argv) < 5:
|
11 | 12 | print "Usage: ./classifier -i [path to malware sample] -t [path to training set directory]"
|
@@ -67,15 +68,15 @@ def compair(unknownFeatureList, trainingFeatureList):
|
67 | 68 | return result
|
68 | 69 |
|
69 | 70 | def main(inSample):
|
70 |
| - global trainingSetPath |
| 71 | + global trainingSetPath, count |
71 | 72 |
|
72 | 73 | # Generate nttrace file for given input sample
|
73 | 74 |
|
74 | 75 | cmd = 'nttrace ' + str(inSample)
|
75 | 76 | with open('C:\Users\user\AppData\Local\mlmc\\' + os.path.splitext(os.path.basename(str(inSample)))[0] + '.trace', 'w') as traceFile:
|
76 | 77 | ps = sp.Popen(cmd, stderr=sp.PIPE, stdout=traceFile, shell=True)
|
77 | 78 |
|
78 |
| - time.sleep(2) |
| 79 | + time.sleep(1) |
79 | 80 | ps.terminate()
|
80 | 81 |
|
81 | 82 | featureLists = [] # [[3gramList],[4gramList], [5gramList], ...]
|
@@ -114,23 +115,24 @@ def main(inSample):
|
114 | 115 | # print 'Similarity with 3,4,5,6,7-gram feature = {0:3.2f} %'.format(sum(finalResult) / float(len(finalResult)) * 100)
|
115 | 116 |
|
116 | 117 | # Combine output for many samples in to a file
|
117 |
| - with open('Z:\Desktop\output.txt', 'a') as outFile: |
118 |
| - outFile.write("{0:2.5f} \t + {1:s} \n".format(sum(finalResult) / float(len(finalResult)) * 100, inSample)) |
119 |
| - print "{0:2.5f} \t {1:s} \n".format(sum(finalResult) / float(len(finalResult)) * 100, inSample) |
| 118 | + with open('Z:\Desktop\output7000.txt', 'a') as outFile: |
| 119 | + outFile.write("{0:2.5f} \t {1:s} \n".format(sum(finalResult) / float(len(finalResult)) * 100, inSample)) |
| 120 | + print "{0:2.5f} \t {1:s} \t".format(sum(finalResult) / float(len(finalResult)) * 100, inSample), count, '\n' |
| 121 | + count += 1 |
120 | 122 |
|
121 | 123 | # Kill the dangling NtTrace process if any
|
122 | 124 | os.system("taskkill /IM NtTrace.exe /F")
|
| 125 | + # os.system("taskkill /IM 979971590.exe /F") |
| 126 | + |
123 | 127 |
|
124 | 128 | def test():
|
125 | 129 | global inSample
|
126 | 130 | if os.path.isfile(inSample):
|
127 |
| - print inSample |
128 | 131 | main(inSample)
|
129 | 132 | elif os.path.isdir(inSample):
|
130 | 133 | filelist = os.listdir(inSample)
|
131 |
| - for sample in filelist: |
| 134 | + for sample in sorted(filelist)[count:]: |
132 | 135 | if sample.endswith('.malware'):
|
133 |
| - print inSample + sample |
134 | 136 | main(inSample + sample)
|
135 | 137 |
|
136 | 138 | if __name__ == '__main__':
|
|
0 commit comments