Malicious_Process_Identification.py

import os

malware_sample_list = []
benign_sample_list = []


class Process_Identifcation:

    def __init__(self):
        pass

    def process_identification(self):
        pscan_benign, pscan_malware = self.import_pscan_details()
        pslist_benign, pslist_malware = self.import_pslist_details()
        processes_malware, scan_type_malware, processes_benign, scan_type_benign = self.import_psxview_details()
        self.name_filter()
        malware_process_list = []
        for i in range(0, len(processes_malware)):
            # print(malware_sample_list[i])
            malware_process_list.append(self.complete_process_details(pscan_malware[i], pslist_malware[i], processes_malware[i],scan_type_malware[i]))
        # print((malware_process_list))
        benign_process_list=[]
        for i in range(0,len(processes_benign)):
            # print(benign_sample_list[i])
            benign_process_list.append(self.complete_process_details(pscan_benign[i],pslist_benign[i],processes_benign[i],scan_type_benign[i]))
        # print(benign_process_list)
        return malware_process_list,benign_process_list

    def import_pscan_details(self):
        rootdir = './scans/psscan/'

        file_name = []
        sub_dir = []
        for subdir, dirs, files in os.walk(rootdir):
            for file in files:
                file_name.append(file)
                sub_dir.append(subdir)

        # print(file_name)
        # print(sub_dir)
        processes_benign = []
        processes_malware = []
        # print(sub_dir)
        for z in range(0, len(file_name)):
            if sub_dir[z]=='./scans/psscan/Benign Samples':
                f = open(sub_dir[z] + '/' + file_name[z], "r").read()
                f = f.split('\n')
                # print(file_name[z])
                # print(list(filter(None, f[0].split(' '))))
                headers = [list(filter(None, f[0].split(' ')))[1], list(filter(None, f[0].split(' ')))[2],
                           list(filter(None, f[0].split(' ')))[3]]
                # print(headers)
                benign = []
                for i in range(2, len(f) - 1):
                    benign.append([list(filter(None, f[i].split(' ')))[1], list(filter(None, f[i].split(' ')))[2],
                                    list(filter(None, f[i].split(' ')))[3]])
                processes_benign.append(benign)
                # print(benign)
                # print()
            else:
                f = open(sub_dir[z] + '/' + file_name[z], "r").read()
                f = f.split('\n')
                # print(file_name[z])
                # print(list(filter(None, f[0].split(' '))))
                headers = [list(filter(None, f[0].split(' ')))[1], list(filter(None, f[0].split(' ')))[2],
                           list(filter(None, f[0].split(' ')))[3]]
                # print(headers)
                malware = []
                for i in range(2, len(f) - 1):
                    malware.append([list(filter(None, f[i].split(' ')))[1], list(filter(None, f[i].split(' ')))[2],
                                    list(filter(None, f[i].split(' ')))[3]])
                processes_malware.append(malware)
                # print(malware)
                # print()

        return processes_benign,processes_malware

    def import_pslist_details(self):
        rootdir = './scans/pslist/'
        file_name = []
        sub_dir = []
        for subdir, dirs, files in os.walk(rootdir):
            for file in files:
                file_name.append(file)
                sub_dir.append(subdir)

        # print(file_name)
        processes_benign = []
        processes_malware = []
        # print(sub_dir)
        for z in range(0, len(file_name)):
            if sub_dir[z] == './scans/pslist/Benign Samples':
                f = open(sub_dir[z] + '/' + file_name[z], "r").read()
                f = f.split('\n')
                # print(file_name[z])
                # print(list(filter(None, f[0].split(' '))))
                headers = [list(filter(None, f[0].split(' ')))[1], list(filter(None, f[0].split(' ')))[2],
                           list(filter(None, f[0].split(' ')))[3]]
                # print(headers)
                benign = []
                for i in range(2, len(f) - 1):
                    benign.append([list(filter(None, f[i].split(' ')))[1], list(filter(None, f[i].split(' ')))[2],
                                   list(filter(None, f[i].split(' ')))[3]])
                processes_benign.append(benign)
                # print(benign)
                # print()
            else:
                f = open(sub_dir[z] + '/' + file_name[z], "r").read()
                f = f.split('\n')
                # print(file_name[z])
                # print(list(filter(None, f[0].split(' '))))
                headers = [list(filter(None, f[0].split(' ')))[1], list(filter(None, f[0].split(' ')))[2],
                           list(filter(None, f[0].split(' ')))[3]]
                # print(headers)
                malware = []
                for i in range(2, len(f) - 1):
                    malware.append([list(filter(None, f[i].split(' ')))[1], list(filter(None, f[i].split(' ')))[2],
                                    list(filter(None, f[i].split(' ')))[3]])
                processes_malware.append(malware)
                # print(malware)
                # print()
        return processes_benign, processes_malware

    def import_psxview_details(self):
        rootdir = './scans/psxview/'
        file_name = []
        sub_dir = []
        for subdir, dirs, files in os.walk(rootdir):
            for file in files:
                file_name.append(file)
                sub_dir.append(subdir)

        # print(file_name)
        processes_malware= []
        values_p_malware= []
        values_s_malware = []
        scan_type_malware= []
        processes_benign = []
        values_p_benign = []
        values_s_benign = []
        scan_type_benign = []

        for z in range(0, len(file_name)):
            if sub_dir[z] == './scans/psxview/Benign Samples':
                benign_sample_list.append(file_name[z])
                f = open(sub_dir[z] + '/' + file_name[z], "r").read()
                f = f.split('\n')
                # print(f)
                values_p_benign = []
                values_s_benign = []
                for i in range(2, len(f) - 1):
                    values_p_benign.append(
                        [list(filter(None, f[i].split(' ')))[1], list(filter(None, f[i].split(' ')))[2]])
                    values_s_benign.append(
                        [list(filter(None, f[i].split(' ')))[3], list(filter(None, f[i].split(' ')))[4]])
                processes_benign.append(values_p_benign)
                scan_type_benign.append((values_s_benign))
                # print(processes)
                # print(scan_type)
            else:
                malware_sample_list.append(file_name[z])
                f = open(sub_dir[z] + '/' + file_name[z], "r").read()
                f = f.split('\n')
                # print(f)
                # print(file_name[z])
                # print(list(filter(None, f[0].split(' '))))
                headers = [list(filter(None, f[0].split(' ')))[1], list(filter(None, f[0].split(' ')))[2],
                           list(filter(None, f[0].split(' ')))[3],list(filter(None, f[0].split(' ')))[4]]
                # print(headers)
                values_p_malware = []
                values_s_malware = []
                for i in range(2, len(f) - 1):
                    values_p_malware.append([list(filter(None, f[i].split(' ')))[1], list(filter(None, f[i].split(' ')))[2]])
                    values_s_malware.append([list(filter(None, f[i].split(' ')))[3],list(filter(None, f[i].split(' ')))[4]])
                processes_malware.append(values_p_malware)
                scan_type_malware.append((values_s_malware))
                # print(processes)
                # print(scan_type)
        return processes_malware,scan_type_malware,processes_benign,scan_type_benign

    def name_filter(self):
            for i in range(0, len(malware_sample_list)):
                malware_sample_list[i] = malware_sample_list[i].split('_')[0]
            # print((malware_sample_list))

            for i in range(0, len(benign_sample_list)):
                benign_sample_list[i] = benign_sample_list[i].split('_')[0]
            # print((benign_sample_list))


    def complete_process_details(self,psscan,pslist,processes,scan_type):

        complete_list=[]
        for i in range(0,len(processes)):
            pslist_val = bool(scan_type[i][0])
            psscan_val = bool(scan_type[i][1])
            process_detail= [processes[i][0],processes[i][1]]
            # print(processes[i][0],processes[i][1],pslist_val,psscan_val)
            if pslist_val==True:
                for j in range(0,len(pslist)):
                    if pslist[j][0]==process_detail[0] and pslist[j][1]==process_detail[1]:
                        complete_list.append([pslist[j][0],pslist[j][1],pslist[j][2]])
                        break
                    else:
                        continue
            else:
                for j in range(0,len(psscan)):
                    if psscan[j][0]==process_detail[0] and psscan[j][1]==process_detail[1]:
                        complete_list.append([psscan[j][0],psscan[j][1],psscan[j][2]])
                        break
                    else:
                        continue
        # print(complete_list)
        return complete_list



process_combined=Process_Identifcation()
malware_process_list,benign_process_list=process_combined.process_identification()

index1 = benign_sample_list.index("1")

# print(index1)

benign_sample_list[0], benign_sample_list[index1] = benign_sample_list[index1], benign_sample_list[0]
benign_process_list[0], benign_process_list[index1] = benign_process_list[index1],benign_process_list[0]


for i in range(0,len(malware_sample_list)):
    print('Number of Processes:',len(malware_process_list[i]))
    print('Name of Sample:',malware_sample_list[i])
    print(malware_process_list[i])

print()
for i in range(0,len(benign_sample_list)):
    print('Number of Processes:', len(benign_process_list[i]))
    print('Name of Sample:',benign_sample_list[i])
    print(benign_process_list[i])


class Malicious_Process_Identification:
    pid_malware = []
    name_malware = []
    ppid_malware = []

    pid_benign = []
    name_benign = []
    ppid_benign = []

    def __init__(self,malware_process_list,benign_process_list,malware_sample_list,benign_sample_list):
        self.malware_process_list=malware_process_list
        self.malware_sample_list = malware_sample_list
        self.benign_process_list = benign_process_list
        self.benign_sample_list = benign_sample_list

    def unique_process_return(self):
        self.segregate_name_pid_ppid()
        unique_processes = self.unique_process_identification()
        return unique_processes

    def segregate_name_pid_ppid(self):
        for i in range(0, len(self.malware_process_list)):
            temp_name = []
            temp_pid = []
            temp_ppid = []
            # All Unique entries in table thus no need to remove
            for j in range(0, len(self.malware_process_list[i])):
                temp_name.append(self.malware_process_list[i][j][0])
                temp_pid.append(self.malware_process_list[i][j][1])
                temp_ppid.append(self.malware_process_list[i][j][2])
            self.pid_malware.append(temp_pid)
            self.name_malware.append(temp_name)
            self.ppid_malware.append(temp_ppid)
        #
        for i in range(0, len(benign_process_list)):
            temp_name = []
            temp_pid = []
            temp_ppid = []
            # All Unique entries in table thus no need to remove
            for j in range(0, len(self.benign_process_list[i])):
                temp_name.append(self.benign_process_list[i][j][0])
                temp_pid.append(self.benign_process_list[i][j][1])
                temp_ppid.append(self.benign_process_list[i][j][2])
            self.pid_benign.append(temp_pid)
            self.name_benign.append(temp_name)
            self.ppid_benign.append(temp_ppid)


    def analyze_malware_benign(self):
        for i in range(0, len(self.malware_process_list)):
            print()
            print('PID')
            print('Processes in File', self.benign_sample_list[0], ':', len(self.pid_benign[0]), len(set(self.pid_benign[0])))
            print('Processes in File', self.malware_sample_list[i], ':', len(self.pid_malware[i]), len(set(self.pid_malware[i])))

            print('Common PID:')
            print(len(set(self.pid_benign[0]) & set(self.pid_malware[i])))
            print((set(self.pid_benign[0]) & set(self.pid_malware[i])))
            if len(self.pid_malware[i])<len(self.pid_benign[0]):
                index_pid_common = [j for j, item in enumerate(self.pid_malware[i]) if item in self.pid_benign[0]]
            else:
                index_pid_common = [j for j, item in enumerate(self.pid_benign[0]) if item in self.pid_malware[i]]
            print(index_pid_common)

            print('Different PID:')
            print('Uncommon Processes in:', benign_sample_list[0])
            print(len(set(self.pid_benign[0]) - set(self.pid_malware[i])))
            print((set(self.pid_benign[0]) - set(self.pid_malware[i])))
            index_pid_uncommon_1 = [j for j, item in enumerate(self.pid_benign[0]) if not item in self.pid_malware[i]]
            print([j for j, item in enumerate(self.pid_benign[0]) if not item in self.pid_malware[i]])
            print('Uncommon Processes in:', malware_sample_list[i])
            print(len(set(self.pid_malware[i]) - set(self.pid_benign[0])))
            print((set(self.pid_malware[i]) - set(self.pid_benign[0])))
            index_pid_uncommon_2 = [j for j, item in enumerate(self.pid_malware[i]) if not item in self.pid_benign[0]]
            print([j for j, item in enumerate(self.pid_malware[i]) if not item in self.pid_benign[0]])

            print()
            print('NAME')
            print('Processes Name in File', self.benign_sample_list[0], ':', len(self.name_benign[0]), len(set(self.name_benign[0])))
            print('Processes Name in File', self.malware_sample_list[i], ':', len(self.name_malware[i]), len(set(self.name_malware[i])))

            print('Common NAME:')
            print(len(set(self.name_benign[0]) & set(self.name_malware[i])))
            print((set(self.name_benign[0]) & set(self.name_malware[i])))
            if len(self.name_malware[i]) < len(self.name_benign[0]):
                index_name_common = [j for j, item in enumerate(self.name_malware[i]) if item in self.name_benign[0]]
            else:
                index_name_common = [j for j, item in enumerate(self.name_benign[0]) if item in self.name_malware[i]]
            print(index_name_common)

            print('Different NAME:')
            print('Uncmommon Process Names in file:', benign_sample_list[0])
            print(len(set(self.name_benign[0]) - set(self.name_malware[i])))
            print((set(self.name_benign[0]) - set(self.name_malware[i])))
            index_name_uncommon_1 = [j for j, item in enumerate(self.name_benign[0]) if not item in self.name_malware[i]]
            print([j for j, item in enumerate(self.name_benign[0]) if not item in self.name_malware[i]])
            print('Uncmommon Process Names in file:', malware_sample_list[i])
            print(len(set(self.name_malware[i]) - set(self.name_benign[0])))
            print((set(self.name_malware[i]) - set(self.name_benign[0])))
            index_name_uncommon_2 = [j for j, item in enumerate(self.name_malware[i]) if not item in self.name_benign[0]]
            print([j for j, item in enumerate(self.name_malware[i]) if not item in self.name_benign[0]])

        print()
        for j in index_pid_common:
            if (self.name_benign[0][j]==self.name_malware[i][j]) and self.ppid_benign[0][j]==self.ppid_malware[i][j]:
                pass
            else:
                print(j)
                print(self.pid_benign[0][j],self.name_benign[0][j],self.ppid_benign[0][j])
                print(self.pid_malware[i][j],self.name_malware[i][j],self.ppid_malware[i][j])

    def unique_process_identification(self):
        base_process = {}
        unique_names = set([self.benign_process_list[0][i][0] for i in range(0, len(self.benign_process_list[0]))])
        # print(unique_names)
        # print(len(pid_benign[0]))
        #
        for i in range(0, len(self.benign_process_list)):
            for j in unique_names:
                pid_ppid = []
                for k in range(0, len(self.benign_process_list[0])):
                    if j == (self.benign_process_list[0][k][0]):
                        pid_ppid.append([self.benign_process_list[0][k][1], self.benign_process_list[0][k][2]])
                    else:
                        continue
                base_process[j] = pid_ppid
        unique_processes = []
        c = 0
        c1 = 0
        common_process = []
        # print(len(processes[1]))
        for i in range(0, len(self.malware_process_list)):
            # print()
            # print(file_name[i])
            temp = []
            for j in range(0, len(self.name_malware[i])):
                if (self.name_malware[i][j]) in base_process:
                    c = c + 1
                    # print(name[i][j],base_process[name[i][j]][0])
                    # print(pid[i][j], ppid[i][j])
                    for k in (base_process[self.name_malware[i][j]]):
                        if self.pid_malware[i][j] in k and self.ppid_malware[i][j] in k:
                            c1 = c1 + 1
                            common_process.append([self.name_malware[i][j], self.pid_malware[i][j], self.ppid_malware[i][j]])
                        else:
                            continue
                else:
                    # print(name[i][j],pid[i][j],ppid[i][j])
                    temp.append([self.name_malware[i][j], self.pid_malware[i][j], self.ppid_malware[i][j]])
                    continue
            unique_processes.append(temp)
        # for i in range(0, len(unique_processes)):
        #     print(malware_sample_list[i])
        #     for j in range(0, len(unique_processes[i])):
        #         print(unique_processes[i][j][0], ':', unique_processes[i][j][1])
        return unique_processes

mal=Malicious_Process_Identification(malware_process_list,benign_process_list,malware_sample_list,benign_sample_list)
unique_processes=mal.unique_process_return()

f = open("Malicious_Processes.txt", "w")
for i in range(0, len(unique_processes)):
    f.write(malware_sample_list[i]+'\n')
    for j in range(0, len(unique_processes[i])):
        name_pid=str(unique_processes[i][j][0])+ ':'+ str(unique_processes[i][j][1]+'\n')
        f.write(name_pid)

f.close()