pypi-malware-checks-analysis.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 1,
   "id": "47197f96",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Importing necessary libraries\n",
    "import os\n",
    "from typing import Dict\n",
    "from typing import List\n",
    "import pandas as pd\n",
    "import pickle"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "6c50f93d",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Collecting number of rules of the packages\n",
    "def parse_analysis_result(packages_scanning_results: Dict[str, str]) -> List[str]:\n",
    "    for package, files in packages_scanning_results.items():\n",
    "        for file_ in files: \n",
    "            if file_['rule']:\n",
    "                # if a file has a rule, 1\n",
    "                yield (package, file_[\"target\"], file_['rule'], 1)\n",
    "            else:\n",
    "                # if a file does not have a rule, 0\n",
    "                yield (package, file_[\"target\"], \"\", 0)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "81788647",
   "metadata": {},
   "source": [
    "## Analyzing Malicious packages"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "id": "b5fe03d3",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Loading the existing results\n",
    "with open(os.path.abspath(os.path.join(\"results\", \"malicious_packages.pkl\")), 'rb') as fp:\n",
    "    malicious_packages_scanning_results = pickle.load(fp)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "5ff25405",
   "metadata": {},
   "source": [
    "### Triggered rules and subpatterns in all Python files in malicious packages"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "id": "601e5e18",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Collect the alerts and transform them into datafarame\n",
    "malicious_packages_rules = parse_analysis_result(malicious_packages_scanning_results)\n",
    "malicious_packages_rules_df = pd.DataFrame(malicious_packages_rules, columns=[\"package\", \"target\", \"rule\", \"has_rule\"])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "id": "e2fa2632",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Total number of rules: 850\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "count    168.000000\n",
       "mean       5.059524\n",
       "std       12.944702\n",
       "min        0.000000\n",
       "25%        1.000000\n",
       "50%        2.000000\n",
       "75%        4.000000\n",
       "max      118.000000\n",
       "Name: has_rule, dtype: float64"
      ]
     },
     "execution_count": 5,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Number of rules per package\n",
    "malicious_packages_rules_groupby = malicious_packages_rules_df.groupby('package')['has_rule']\n",
    "print(f\"Total number of rules: {malicious_packages_rules_groupby.sum().sum()}\")\n",
    "malicious_packages_rules_groupby.sum().describe()"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "7b946fe5",
   "metadata": {},
   "source": [
    "### Triggered rules and subpatterns in all setup.py files in malicious packages"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "id": "a6d55e1e",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Selecting only setup.py files\n",
    "malicious_packages_rules_setup_df = malicious_packages_rules_df[malicious_packages_rules_df['target'].str.contains('setup.py')]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "id": "89198cb9",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Total number of rules: 175\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "count    163.000000\n",
       "mean       1.073620\n",
       "std        1.057357\n",
       "min        0.000000\n",
       "25%        0.000000\n",
       "50%        1.000000\n",
       "75%        2.000000\n",
       "max        3.000000\n",
       "Name: has_rule, dtype: float64"
      ]
     },
     "execution_count": 7,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Number of rules per package\n",
    "malicious_packages_rules_setup_groupby = malicious_packages_rules_setup_df.groupby('package')['has_rule']\n",
    "print(f\"Total number of rules: {malicious_packages_rules_setup_groupby.sum().sum()}\")\n",
    "malicious_packages_rules_setup_groupby.sum().describe()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "id": "d6292629",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Selecting setup.py files having at least one alert\n",
    "malicious_packages_setup_has_rules_df = malicious_packages_rules_setup_df[malicious_packages_rules_setup_df['has_rule'] != 0]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "id": "887c4762",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Total number of rules: 175\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "count    99.000000\n",
       "mean      1.767677\n",
       "std       0.780218\n",
       "min       1.000000\n",
       "25%       1.000000\n",
       "50%       2.000000\n",
       "75%       2.000000\n",
       "max       3.000000\n",
       "Name: has_rule, dtype: float64"
      ]
     },
     "execution_count": 9,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Number of rules per package\n",
    "malicious_packages_setup_has_rules_groupby = malicious_packages_setup_has_rules_df.groupby('package')['has_rule']\n",
    "print(f\"Total number of rules: {malicious_packages_setup_has_rules_groupby.sum().sum()}\")\n",
    "malicious_packages_setup_has_rules_groupby.sum().describe()"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "d276b3bd",
   "metadata": {},
   "source": [
    "## Analyzing Popular packages"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "id": "cfa9288c",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Loading the existing result in case we do not want to rescan the packages\n",
    "with open(os.path.abspath(os.path.join(\"results\", \"popular_packages.pkl\")), \"rb\") as fp:\n",
    "    popular_packages_scanning_results = pickle.load(fp)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "896cfc24",
   "metadata": {},
   "source": [
    "### Triggered rules and subpatterns in all Python files in popular packages"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "id": "90c190d4",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Collect the alerts and transform them into datafarame\n",
    "popular_packages_rules = parse_analysis_result(popular_packages_scanning_results)\n",
    "popular_packages_rules_df = pd.DataFrame(popular_packages_rules, columns=[\"package\", \"target\", \"rule\", \"has_rule\"])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "id": "158da8e3",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Total number of rules: 51283\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "count    1430.000000\n",
       "mean       35.862238\n",
       "std       163.910398\n",
       "min         0.000000\n",
       "25%         3.000000\n",
       "50%         8.000000\n",
       "75%        27.000000\n",
       "max      5377.000000\n",
       "Name: has_rule, dtype: float64"
      ]
     },
     "execution_count": 12,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Number of rules per package\n",
    "popular_packages_rules_groupby = popular_packages_rules_df.groupby('package')['has_rule']\n",
    "print(f\"Total number of rules: {popular_packages_rules_groupby.sum().sum()}\")\n",
    "popular_packages_rules_groupby.sum().describe()"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "5dc4e6b4",
   "metadata": {},
   "source": [
    "### Triggered rules in all setup.py files in popular packages"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "id": "2054363a",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Selecting only setup.py files\n",
    "popular_packages_rules_setup_df = popular_packages_rules_df[popular_packages_rules_df['target'].str.contains('setup.py')]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "id": "20c69925",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Total number of rules: 768\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "count    1320.000000\n",
       "mean        0.581818\n",
       "std         1.568541\n",
       "min         0.000000\n",
       "25%         0.000000\n",
       "50%         0.000000\n",
       "75%         1.000000\n",
       "max        45.000000\n",
       "Name: has_rule, dtype: float64"
      ]
     },
     "execution_count": 14,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Number of rules per package\n",
    "popular_packages_rules_setup_groupby = popular_packages_rules_setup_df.groupby('package')['has_rule']\n",
    "print(f\"Total number of rules: {popular_packages_rules_setup_groupby.sum().sum()}\")\n",
    "popular_packages_rules_setup_groupby.sum().describe()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "id": "84c6c58f",
   "metadata": {},
   "outputs": [],
   "source": [
    "# setup.py files in popular packages that have at least one alert\n",
    "popular_packages_setup_has_rules_df = popular_packages_rules_setup_df[popular_packages_rules_setup_df['has_rule'] != 0]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "id": "9667ae38",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Total number of rules: 768\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "count    474.000000\n",
       "mean       1.620253\n",
       "std        2.274802\n",
       "min        1.000000\n",
       "25%        1.000000\n",
       "50%        1.000000\n",
       "75%        2.000000\n",
       "max       45.000000\n",
       "Name: has_rule, dtype: float64"
      ]
     },
     "execution_count": 16,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Number of rules per package\n",
    "popular_packages_setup_has_rules_groupby = popular_packages_setup_has_rules_df.groupby('package')['has_rule']\n",
    "print(f\"Total number of rules: {popular_packages_setup_has_rules_groupby.sum().sum()}\")\n",
    "popular_packages_setup_has_rules_groupby.sum().describe()"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "471e19c0",
   "metadata": {},
   "source": [
    "## Analyzing Random packages"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f5abd576",
   "metadata": {},
   "source": [
    "### Triggered rules in all Python files in random packages"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "id": "2e0ae8e3",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Loading the existing result\n",
    "with open(os.path.abspath(os.path.join(\"results\", \"random_packages.pkl\")), 'rb') as fp:\n",
    "    random_packages_scanning_results = pickle.load(fp)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "id": "10b947d5",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Collect the alerts and transform them into datafarame\n",
    "random_packages_rules = parse_analysis_result(random_packages_scanning_results)\n",
    "random_packages_rules_df = pd.DataFrame(random_packages_rules, columns=[\"package\", \"target\", \"rule\", \"has_rule\"])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "id": "90571347",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Total number of rules: 5460\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "count    986.000000\n",
       "mean       5.537525\n",
       "std       31.223431\n",
       "min        0.000000\n",
       "25%        0.000000\n",
       "50%        1.000000\n",
       "75%        4.000000\n",
       "max      728.000000\n",
       "Name: has_rule, dtype: float64"
      ]
     },
     "execution_count": 19,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Number of rules per package\n",
    "random_packages_rules_groupby = random_packages_rules_df.groupby('package')['has_rule']\n",
    "print(f\"Total number of rules: {random_packages_rules_groupby.sum().sum()}\")\n",
    "random_packages_rules_groupby.sum().describe()"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "70c9a4b6",
   "metadata": {},
   "source": [
    "### Triggered rules in all setup.py files in random packages"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "id": "a6defe41",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Selecting only setup.py files\n",
    "random_packages_rules_setup_df = random_packages_rules_df[random_packages_rules_df['target'].str.contains('setup.py')]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "id": "dab96638",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Total number of rules: 197\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "count    868.000000\n",
       "mean       0.226959\n",
       "std        0.633812\n",
       "min        0.000000\n",
       "25%        0.000000\n",
       "50%        0.000000\n",
       "75%        0.000000\n",
       "max        9.000000\n",
       "Name: has_rule, dtype: float64"
      ]
     },
     "execution_count": 21,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Number of rules per package\n",
    "random_packages_rules_setup_groupby = random_packages_rules_setup_df.groupby('package')['has_rule']\n",
    "print(f\"Total number of rules: {random_packages_rules_setup_groupby.sum().sum()}\")\n",
    "random_packages_rules_setup_groupby.sum().describe()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "id": "e0dcba18",
   "metadata": {},
   "outputs": [],
   "source": [
    "# random packages whose setup.py files having at least one alert\n",
    "random_packages_setup_has_rules_df = random_packages_rules_setup_df[random_packages_rules_setup_df['has_rule'] != 0]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "id": "92582c30",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Total number of rules: 197\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "count    147.000000\n",
       "mean       1.340136\n",
       "std        0.939955\n",
       "min        1.000000\n",
       "25%        1.000000\n",
       "50%        1.000000\n",
       "75%        1.000000\n",
       "max        9.000000\n",
       "Name: has_rule, dtype: float64"
      ]
     },
     "execution_count": 23,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Number of rules per package\n",
    "random_packages_rules_setup_has_rules_groupby = random_packages_setup_has_rules_df.groupby('package')['has_rule']\n",
    "print(f\"Total number of rules: {random_packages_rules_setup_has_rules_groupby.sum().sum()}\")\n",
    "random_packages_rules_setup_has_rules_groupby.sum().describe()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "be82c665",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.10"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}