Struct owlyshield_ransom::predictions::prediction::input_tensors::PredictionRow

pub struct PredictionRow {

    pub ops_read: u64,
    pub ops_setinfo: u64,
    pub ops_written: u64,
    pub ops_open: u64,
    pub bytes_read: u64,
    pub bytes_written: u64,
    pub entropy_read: f32,
    pub entropy_written: f32,
    pub files_opened: usize,
    pub files_deleted: usize,
    pub files_read: usize,
    pub files_renamed: usize,
    pub files_written: usize,
    pub extensions_read: usize,
    pub extensions_written: usize,
    pub extensions_written_doc: usize,
    pub extensions_written_archives: usize,
    pub extensions_written_db: usize,
    pub extensions_written_code: usize,
    pub extensions_written_exe: usize,
    pub dirs_with_files_created: usize,
    pub dirs_with_files_updated: usize,
    pub pids: usize,
    pub exe_exists: bool,
    pub clusters: usize,
    pub clusters_max_size: usize,
    pub alters_email_file: bool,
    pub password_vault_read_count: usize,
    pub alters_event_log_file: bool,
    pub alters_ssh_file: bool,
    pub on_shared_drive_read_count: u32,
    pub on_shared_drive_write_count: u32,
    pub on_removable_drive_read_count: u32,
    pub on_removable_drive_write_count: u32,
}

Record of the features used to feed models’ inputs tensors. Features are the results of aggregate functions (mainly sum, max and count) applied to:

1. Data that comes from the driver (ops_read, entropy_read…)
2. Calculations done in this project crate::process module (clustering)

Fields

ops_read: u64

Count of Read operations crate::driver_com::IrpMajorOp::IrpRead

ops_setinfo: u64

Count of SetInfo operations crate::driver_com::IrpMajorOp::IrpSetInfo

ops_written: u64

Count of Write operations crate::driver_com::IrpMajorOp::IrpWrite

ops_open: u64

Count of Handle Creation operations crate::driver_com::IrpMajorOp::IrpCreate

bytes_read: u64

Total bytes read (by gid)

bytes_written: u64

Total bytes written (by gid)

entropy_read: f32

Total entropy read

entropy_written: f32

Total entropy write

files_opened: usize

File descriptors created

files_deleted: usize

File descriptors deleted

files_read: usize

File descriptors read

files_renamed: usize

File descriptors renamed

files_written: usize

File descriptors written

extensions_read: usize

Unique extensions read count

extensions_written: usize

Unique extensions write count

extensions_written_doc: usize

Unique extensions written count (documents)

extensions_written_archives: usize

Unique extensions written count (archives)

extensions_written_db: usize

Unique extensions written count (DB)

extensions_written_code: usize

Unique extensions written count (code)

extensions_written_exe: usize

Unique extensions written count (executables)

dirs_with_files_created: usize

Directories having files created

dirs_with_files_updated: usize

Directories having files updated

pids: usize

Number of pids in this gid process family

exe_exists: bool

Process exe file still exists (father)?

clusters: usize

Number of directories (with files updated) clusters created

clusters_max_size: usize

Deepest cluster size

alters_email_file: bool

Is process altering (reading, writing) email files

password_vault_read_count: usize

Number of distinct password vault files read

alters_event_log_file: bool

Is process altering (reading, writing) Windows log files

alters_ssh_file: bool

Is process altering (reading, writing) ssh files

on_shared_drive_read_count: u32

Count of Read operations crate::driver_com::IrpMajorOp::IrpRead on a shared (remote) drive

on_shared_drive_write_count: u32

Count of Write operations crate::driver_com::IrpMajorOp::IrpWrite on a shared (remote) drive

on_removable_drive_read_count: u32

Count of Read operations crate::driver_com::IrpMajorOp::IrpRead on a removable drive

on_removable_drive_write_count: u32

Count of Write operations crate::driver_com::IrpMajorOp::IrpWrite on a removable drive

Implementations

impl PredictionRow

pub fn from(proc: &ProcessRecord) -> PredictionRow

pub fn to_vec_f32(&self) -> Vec<f32>

fn order_magnitude(a: f64) -> u32

Trait Implementations

impl Debug for PredictionRow

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.