Automated evaluation, rating and scoring

[michaelweiser]

Is your feature request related to a problem? Please describe.
We'd like to use DRAKVUF Sandbox for automated malware analysis and blocking. What seems to be missing currently is any automated evaluation, rating and scoring of maliciousness of a sample. I'm thinking of something like Cuckoo's signatures which produce a numeric malware score as well as a list of signatures that have been triggered.

Describe the solution you'd like
Looking at the code it seems there's already a concept of plugins in the postprocessor. Could there be a postprocessing plugin that applies signatures to the analysis logs which rate what's been observed for maliciousness?

I'm willing to do a PoC on this. What would be the best way to go about implementing this? Could the logs be massaged in such a way that they could be fed to the Cuckoo signatures directly, recycling all the work that's gone into them already?

https://cuckoo.readthedocs.io/en/latest/customization/signatures/