android-malware-analysis/find_top_features.py at master · mwleeds/android-malware-analysis · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
#!/usr/bin/python3

"""
This script prints each feature in the given JSON file along with
how many apps use it, and how many of each type (malicious or benign).
"""

import sys
import json

def main():
    with open(sys.argv[1]) as f:
        j = json.load(f)
        all_features = j['features']
        num_apps_each = {}
        for app in j['apps']:
            for i,bit in enumerate(j['apps'][app]['vector']):
                if bit == 1:
                    if j['apps'][app]['malicious'] == [1,0]:
                        if all_features[i] in num_apps_each:
                            num_apps_each[all_features[i]][0] += 1
                        else:
                            num_apps_each[all_features[i]] = [1,0]
                    else:
                        if all_features[i] in num_apps_each:
                            num_apps_each[all_features[i]][1] += 1
                        else:
                            num_apps_each[all_features[i]] = [0,1]
        # This sorts by number of malicious apps using it, but can easily be changed
        for feature in sorted(num_apps_each.items(), key=lambda item: item[1][0], reverse=True):
            print('{} was used by {} apps ({} malicious and {} benign)'.format(feature[0], str(feature[1][0] + feature[1][1]), str(feature[1][0]), str(feature[1][1])))

if __name__=='__main__':
    if len(sys.argv) == 1:
        print('Usage: python3 {} <json_filename>'.format(sys.argv[0]))
        sys.exit(1)
    main()