Welcome to mirror list, hosted at ThFree Co, Russian Federation.

github.com/undo-ransomware/ransomware_detection.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authorMatthias Held <ilovemilk@wusa.io>2019-05-16 22:03:17 +0300
committerMatthias Held <ilovemilk@wusa.io>2019-05-16 22:03:17 +0300
commit4d79e6d40d1e80c0f131533cfec210e6d0758df0 (patch)
tree2bb26710c8614a225ee64639aec9a813ce505c47 /lib
parent8b057b70a8aa48644a6678e56c6600e3d0dce6e1 (diff)
use mean and standard deviation calculation of stream
Diffstat (limited to 'lib')
-rw-r--r--lib/Analyzer/EntropyAnalyzer.php32
-rw-r--r--lib/Entropy/Entropy.php14
2 files changed, 26 insertions, 20 deletions
diff --git a/lib/Analyzer/EntropyAnalyzer.php b/lib/Analyzer/EntropyAnalyzer.php
index 744ffe9..0e8d00d 100644
--- a/lib/Analyzer/EntropyAnalyzer.php
+++ b/lib/Analyzer/EntropyAnalyzer.php
@@ -104,8 +104,7 @@ class EntropyAnalyzer
{
$entropy = $this->calculateEntropyOfFile($node);
if ($entropy > self::ENTROPY_CUT_OFF) {
- $entropyArray = $this->createEntropyArrayFromFile($node, self::BLOCK_SIZE);
- $standardDeviation = $this->calculateStandardDeviationOfEntropy($entropyArray);
+ $standardDeviation = $this->calculateStandardDeviationOfEntropy($node, self::BLOCK_SIZE);
if ($standardDeviation > self::SD_CUT_OFF) {
return new EntropyResult(EntropyResult::COMPRESSED, $entropy, $standardDeviation);
}
@@ -124,9 +123,12 @@ class EntropyAnalyzer
*
* @return array
*/
- protected function createEntropyArrayFromFile($node, $blockSize)
+ protected function calculateStandardDeviationOfEntropy($node, $blockSize)
{
- $entropyArray = array();
+ $sum = 0.0;
+ $standardDeviation = 0.0;
+ $mean = 1;
+ $step = 1;
$handle = $node->fopen('r');
if (!$handle) {
@@ -137,27 +139,17 @@ class EntropyAnalyzer
while (!feof($handle)) {
$data = fread($handle, $blockSize);
+ $step = $step + 1;
if (strlen($data) === $blockSize) {
- array_push($entropyArray, $this->entropy->calculateEntropy($data));
+ $entropy = $this->entropy->calculateEntropy($data);
+ $sum = $sum + pow($entropy, 2);
+ $mean = $this->entropy->streamMean($mean, $entropy, $step);
+ $standardDeviation = $this->entropy->streamStandardDeviation($step, $sum, $mean);
}
}
fclose($handle);
- return $entropyArray;
- }
-
- /**
- * Calculates standard deviation of the entropy of multiple data blocks.
- *
- * @param array $entropyArray
- *
- * @return float
- */
- protected function calculateStandardDeviationOfEntropy($entropyArray)
- {
- $sd = $this->entropy->sd($entropyArray);
-
- return $sd;
+ return $standardDeviation;
}
/**
diff --git a/lib/Entropy/Entropy.php b/lib/Entropy/Entropy.php
index 36fde3c..798db8b 100644
--- a/lib/Entropy/Entropy.php
+++ b/lib/Entropy/Entropy.php
@@ -57,6 +57,10 @@ class Entropy
return $entropy;
}
+ public function streamStandardDeviation($n, $sum, $mean) {
+ return sqrt((1 / $n) * $sum - pow($mean, 2));
+ }
+
/**
* Calculates the standard deviation.
*
@@ -83,4 +87,14 @@ class Entropy
return 0.0;
}
+
+ public function streamMean($oldMean, $value, $step) {
+ $mean = 0;
+ if ($step === 1) {
+ $mean = (($step - 1) / $step) + ($value / $step);
+ } else {
+ $mean = $oldMean * (($step - 1) / $step) + ($value / $step);
+ }
+ return $mean;
+ }
}