1 package edu.uci.iotproject;
3 import edu.uci.iotproject.comparison.ComparisonFunctions;
4 import edu.uci.iotproject.comparison.CompleteMatchPatternComparisonResult;
5 import edu.uci.iotproject.comparison.PatternComparisonTask;
6 import org.pcap4j.core.NotOpenException;
7 import org.pcap4j.core.PcapHandle;
8 import org.pcap4j.core.PcapNativeException;
9 import org.pcap4j.core.PcapPacket;
10 import org.pcap4j.packet.DnsPacket;
11 import org.pcap4j.packet.IpV4Packet;
12 import org.pcap4j.packet.TcpPacket;
14 import java.io.EOFException;
15 import java.net.UnknownHostException;
17 import java.util.concurrent.*;
21 * <p>Provides functionality for searching for the presence of a {@link FlowPattern} in a PCAP trace.</p>
24 * The (entire) PCAP trace is traversed and parsed on one thread (specifically, the thread that calls
25 * {@link #findFlowPattern()}). This thread builds a {@link DnsMap} using the DNS packets present in the trace and uses
26 * that {@code DnsMap} to reassemble {@link Conversation}s that <em>potentially</em> match the provided
27 * {@link FlowPattern} (in that one end/party of said conversations matches the hostname(s) specified by the given
28 * {@code FlowPattern}).
29 * These potential matches are then examined on background worker thread(s) to determine if they are indeed a (complete)
30 * matches of the provided {@code FlowPattern}.
33 * @author Janus Varmarken {@literal <jvarmark@uci.edu>}
34 * @author Rahmadi Trimananda {@literal <rtrimana@uci.edu>}
36 public class FlowPatternFinder {
38 /* Begin class properties */
40 * {@link ExecutorService} responsible for parallelizing pattern searches.
41 * Declared as static to allow for reuse of threads across different instances of {@code FlowPatternFinder} and to
42 * avoid the overhead of initializing a new thread pool for each {@code FlowPatternFinder} instance.
44 private static final ExecutorService EXECUTOR_SERVICE = Executors.newCachedThreadPool();
45 /* End class properties */
47 /* Begin instance properties */
49 * Holds a set of {@link Conversation}s that <em>potentially</em> match {@link #mPattern} since each individual
50 * {@code Conversation} is communication with the hostname identified by {@code mPattern.getHostname()}.
51 * Note that due to limitations of the {@link Set} interface (specifically, there is no {@code get(T t)} method),
52 * we have to resort to a {@link Map} (in which keys map to themselves) to "mimic" a set with {@code get(T t)}
55 * @see <a href="https://stackoverflow.com/questions/7283338/getting-an-element-from-a-set">this question on StackOverflow.com</a>
57 private final Map<Conversation, Conversation> mConversations;
59 private final DnsMap mDnsMap;
60 private final PcapHandle mPcap;
61 private final FlowPattern mPattern;
63 private final List<Future<CompleteMatchPatternComparisonResult>> mPendingComparisons = new ArrayList<>();
64 /* End instance properties */
67 * Constructs a new {@code FlowPatternFinder}.
68 * @param pcap an <em>open</em> {@link PcapHandle} that provides access to the trace that is to be examined.
69 * @param pattern the {@link FlowPattern} to search for.
71 public FlowPatternFinder(PcapHandle pcap, FlowPattern pattern) {
72 this.mConversations = new HashMap<>();
73 this.mDnsMap = new DnsMap();
74 this.mPcap = Objects.requireNonNull(pcap,
75 String.format("Argument of type '%s' cannot be null", PcapHandle.class.getSimpleName()));
76 this.mPattern = Objects.requireNonNull(pattern,
77 String.format("Argument of type '%s' cannot be null", FlowPattern.class.getSimpleName()));
81 * Starts the pattern search.
88 * Find patterns based on the FlowPattern object (run by a thread)
90 private void findFlowPattern() {
93 int patternLength = mPattern.getLength();
94 while ((packet = mPcap.getNextPacketEx()) != null) {
95 // Let DnsMap handle DNS packets.
96 if (packet.get(DnsPacket.class) != null) {
97 // Check if this is a valid DNS packet
98 mDnsMap.validateAndAddNewEntry(packet);
101 // For now, we only work support pattern search in TCP over IPv4.
102 IpV4Packet ipPacket = packet.get(IpV4Packet.class);
103 TcpPacket tcpPacket = packet.get(TcpPacket.class);
104 if (ipPacket == null || tcpPacket == null) {
107 String srcAddress = ipPacket.getHeader().getSrcAddr().getHostAddress();
108 String dstAddress = ipPacket.getHeader().getDstAddr().getHostAddress();
109 int srcPort = tcpPacket.getHeader().getSrcPort().valueAsInt();
110 int dstPort = tcpPacket.getHeader().getDstPort().valueAsInt();
111 // Is this packet related to the pattern; i.e. is it going to (or coming from) the cloud server?
112 boolean fromServer = mDnsMap.isRelatedToCloudServer(srcAddress, mPattern.getHostname());
113 boolean fromClient = mDnsMap.isRelatedToCloudServer(dstAddress, mPattern.getHostname());
114 if (!fromServer && !fromClient) {
115 // Packet not related to pattern, skip it.
118 if (tcpPacket.getPayload() == null) {
119 // We skip non-payload control packets as these are less predictable
122 // Conversations (connections/sessions) are identified by the four-tuple
123 // (clientIp, clientPort, serverIp, serverPort) (see Conversation Javadoc).
124 // Create "dummy" conversation for looking up an existing entry.
125 Conversation conversation = fromClient ? new Conversation(srcAddress, srcPort, dstAddress, dstPort) :
126 new Conversation(dstAddress, dstPort, srcAddress, srcPort);
127 // Add the packet so that the "dummy" conversation can be immediately added to the map if no entry
128 // exists for the conversation that the current packet belongs to.
129 conversation.addPacket(packet, true);
130 // Add the new conversation to the map if an equal entry is not already present.
131 // If an existing entry is already present, the current packet is simply added to that conversation.
132 mConversations.merge(conversation, conversation, (existingEntry, toMerge) -> {
133 // toMerge only has a single packet, which is the same as referred to by 'packet' variable, but need
134 // this hack as 'packet' is not final and hence cannot be referred to in a lambda.
135 existingEntry.addPacket(toMerge.getPackets().get(0), true);
136 return existingEntry;
138 // Refresh reference to point to entry in map (in case packet was added to existing entry).
139 conversation = mConversations.get(conversation);
140 if (conversation.getPackets().size() == mPattern.getLength()) {
141 // Conversation reached a size that matches the expected size.
142 // Remove the Conversation from the map and start the analysis.
143 // Any future packets identified by the same four tuple will be tied to a new Conversation instance.
144 // This might, for example, occur if the same conversation is reused for multiple events.
145 mConversations.remove(conversation);
146 // Create comparison task and send to executor service.
147 PatternComparisonTask<CompleteMatchPatternComparisonResult> comparisonTask =
148 new PatternComparisonTask<>(conversation, mPattern, ComparisonFunctions.COMPLETE_MATCH);
149 mPendingComparisons.add(EXECUTOR_SERVICE.submit(comparisonTask));
152 } catch (EOFException eofe) {
153 System.out.println("[ findFlowPattern ] Finished processing entire PCAP stream!");
154 System.out.println("[ findFlowPattern ] Now waiting for comparisons to finish...");
155 // Wait for all comparisons to finish, then output their results to std.out.
156 for(Future<CompleteMatchPatternComparisonResult> comparisonTask : mPendingComparisons) {
158 // Blocks until result is ready.
159 CompleteMatchPatternComparisonResult comparisonResult = comparisonTask.get();
160 if (comparisonResult.getResult()) {
161 System.out.println(comparisonResult.getTextualDescription());
163 } catch (InterruptedException|ExecutionException e) {
167 } catch (UnknownHostException |
168 PcapNativeException |
170 TimeoutException ex) {
171 ex.printStackTrace();