-
Notifications
You must be signed in to change notification settings - Fork 2
/
barplot.py
81 lines (66 loc) · 2.17 KB
/
barplot.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
import io
import json
import numpy as np
from collections import Counter
import matplotlib.pyplot as plt
from matplotlib.backends.backend_pdf import PdfPages
with io.open('samples.json', 'rb') as infile:
ransomware = json.load(infile)
labelcounts = Counter()
familycounts = Counter()
for hash, data in ransomware.items():
if len(data['families']) > 0:
for family in data['families']:
familycounts[family] += 1
else:
labelcounts[data['label']] += 1
single = 0
for family in labelcounts.keys():
if labelcounts[family] == 1:
single += 1
del labelcounts[family]
print 'Ignoring', single, 'labels with only one sample'
print 'Number of familis: ' + str(len(familycounts.keys()))
print 'Number of labels: ' + str(len(labelcounts.keys()))
def families(counts):
return sorted(counts.keys(), key=lambda family: -counts[family])
def render(counts, pdf, cutoff, label):
plt.figure(figsize=(12, 10))
plt.ylabel('Number of samples')
plt.xlabel(label)
#plt.title('Most popular ransomware families')
plt.yscale('log')
bars = []
height = []
for family in families(counts):
if counts[family] > cutoff:
bars.append(family)
height.append(counts[family])
x_pos = np.arange(len(bars))
pbars = plt.bar(x_pos, height, 0.8)
# create names on the x-axis
plt.xticks(x_pos, bars, rotation=-90, size=7)
for rect in pbars:
height = rect.get_height()
plt.text(rect.get_x() + rect.get_width()/2.0, height, '%d' % int(height), ha='center', va='bottom', rotation=-90, size=7)
plt.subplots_adjust(bottom=0.15)
pdf.savefig()
with PdfPages('ransomware-families.pdf') as pdf:
render(familycounts, pdf, 0, 'Ransomware families')
render(labelcounts, pdf, 500, 'AVclass labels')
plt.figure(figsize=(12, 10))
plt.ylabel('Number of samples')
plt.xlabel('AVclass label (rank)')
plt.title('Distribution of ransomware labels')
plt.yscale('log')
bars = []
height = []
for family in families(labelcounts):
bars.append(family)
height.append(labelcounts[family])
# this is too dense to actually distinguish individual bars anyway, so let's
# just fill the entire area. that's way faster anyway.
x_pos = np.arange(len(bars))
plt.fill_between(x_pos, 0, height)
pdf.savefig()
plt.close()