0
$\begingroup$

I am new to Python and want to store a nested dictionary keys as rows in a pandas dataframe. Specifically, here is how the dictionary looks like:

apicalls= [{'GetNativeSystemInfo': 1, 'DeviceIoControl': 2, 'RegCloseKey': 1, 'NtDuplicateObject': 
 1,'NtSetInformationFile': 5,{'NtDuplicateObject': 3, 'DeviceIoControl': 1, 'GetVolumePathNameW': 1, 'RegCloseKey': 1, 'NtQueryKey': 2,'NtQueryValueKey': 6}, {'LdrUnloadDll': 1, 'LdrGetDllHandle': 2, 'NtCreateSection': 1, 'NtOpenKey': 3, 'LdrGetProcedureAddress': 4, 'SetUnhandledExceptionFilter': 5}]

The above are list of API calls extracted from 3 executable files during dynamic analysis.

I have tried to generate the data frame using the following line of code, but it is not giving me what I want.

api_frame = pd.DataFrame(apicalls)

I want the data frame that looks like the one below. kindly help.

enter image description here

Improve this question
$\endgroup$
2
  • $\begingroup$ Your output image is not clear, could you update it, please? $\endgroup$
    – Carmoreno
    Oct 24, 2021 at 1:14
  • 1
    $\begingroup$ sorry, I have now updated the image. $\endgroup$
    – Angelica
    Oct 24, 2021 at 3:51

1 Answer 1

Reset to default
0
$\begingroup$

Since the data sample you provided does not follow the python syntax, I assumed that the data looks like this:

apicalls = [
    {'GetNativeSystemInfo': 1, 'DeviceIoControl': 2, 'RegCloseKey': 1, 'NtDuplicateObject': 1,'NtSetInformationFile': 5},
    {'NtDuplicateObject': 3, 'DeviceIoControl': 1, 'GetVolumePathNameW': 1, 'RegCloseKey': 1, 'NtQueryKey': 2,'NtQueryValueKey': 6},
    {'LdrUnloadDll': 1, 'LdrGetDllHandle': 2, 'NtCreateSection': 1, 'NtOpenKey': 3, 'LdrGetProcedureAddress': 4, 'SetUnhandledExceptionFilter': 5}
]

You can simply loop over the list to get the keys for each dictionary using the .keys() method, and then pass that list to pandas.DataFrame:

import pandas as pd

pd.DataFrame([call.keys() for call in apicalls])

This results in the following dataframe:

0 1 2 3 4 5
GetNativeSystemInfo DeviceIoControl RegCloseKey NtDuplicateObject NtSetInformationFile
NtDuplicateObject DeviceIoControl GetVolumePathNameW RegCloseKey NtQueryKey NtQueryValueKey
LdrUnloadDll LdrGetDllHandle NtCreateSection NtOpenKey LdrGetProcedureAddress SetUnhandledExceptionFilter
Improve this answer
$\endgroup$
3
  • $\begingroup$ Hey @Oxbowerce thank you, this is exactly what I wanted . Just one more thing, when I use your code, I got None in the first row, under column 5 (cell 6). How can I remove it and keep the cell empty as it looks in your data frame?. For other rows it's fine. $\endgroup$
    – Angelica
    Oct 24, 2021 at 5:21
  • $\begingroup$ That cell will be null since there is no fifth value for that row, when converting it to markdown it will simply be an empty string. If you want any null values to actually be an empty string, you can use the .fillna() method, which allows you to fill all na/null values with a specific value. $\endgroup$
    – Oxbowerce
    Oct 24, 2021 at 15:30
  • $\begingroup$ I used both methods and they worked well. Many thanks @ Oxbowerce $\endgroup$
    – Angelica
    Oct 25, 2021 at 5:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.