Code/Projects/PacketLevelSignatureExtractor/src/main/java/edu/uci/iotproject/detection/layer2/Layer2SequenceMatcher.java

   1 package edu.uci.iotproject.detection.layer2;
   2
   3 import edu.uci.iotproject.analysis.TriggerTrafficExtractor;
   4 import edu.uci.iotproject.util.PcapPacketUtils;
   5 import org.pcap4j.core.PcapPacket;
   6 import org.pcap4j.util.MacAddress;
   7
   8 import java.util.ArrayList;
   9 import java.util.List;
  10
  11 /**
  12  * Attempts to detect the presence of a specific packet sequence in the set of packets provided through multiple calls
  13  * to {@link #matchPacket(PcapPacket)}, considering only layer 2 information.
  14  *
  15  * @author Janus Varmarken {@literal <jvarmark@uci.edu>}
  16  * @author Rahmadi Trimananda {@literal <rtrimana@uci.edu>}
  17  */
  18 public class Layer2SequenceMatcher {
  19
  20     /**
  21      * The sequence this {@link Layer2SequenceMatcher} is searching for.
  22      */
  23     private final List<PcapPacket> mSequence;
  24
  25     /**
  26      * Buffer of actual packets seen so far that match the searched sequence (i.e., constitutes a subsequence of the
  27      * searched sequence).
  28      */
  29     private final List<PcapPacket> mMatchedPackets = new ArrayList<>();
  30
  31     /**
  32      * Models the directions of packets in {@link #mSequence}. As the sequence matcher assumes that it is only presented
  33      * with packet from a single flow (packets exchanged between two devices), we can model the packet directions with a
  34      * single bit. We don't have any notion "phone to device" or "device to phone" as we don't know the MAC addresses
  35      * of devices in advance during matching.
  36      */
  37     private final boolean[] mPacketDirections;
  38
  39     /**
  40      * Create a {@code Layer2SequenceMatcher}.
  41      * @param sequence The sequence to match against (search for).
  42      */
  43     public Layer2SequenceMatcher(List<PcapPacket> sequence) {
  44         mSequence = sequence;
  45         // Compute packet directions for sequence.
  46         mPacketDirections = new boolean[sequence.size()];
  47         for (int i = 0; i < sequence.size(); i++) {
  48             if (i == 0) {
  49                 // No previous packet; boolean parameter is ignored in this special case.
  50                 mPacketDirections[i] = getPacketDirection(null, true, sequence.get(i));
  51             } else {
  52                 // Base direction marker on direction of previous packet.
  53                 PcapPacket prevPkt = mSequence.get(i-1);
  54                 boolean prevPktDirection = mPacketDirections[i-1];
  55                 mPacketDirections[i] = getPacketDirection(prevPkt, prevPktDirection, sequence.get(i));
  56             }
  57         }
  58     }
  59
  60     /**
  61      * Attempt to advance this {@code Layer2SequenceMatcher} by matching {@code packet} against the packet that this
  62      * {@code Layer2SequenceMatcher} expects as the next packet of the sequence it is searching for.
  63      * @param packet
  64      * @return {@code true} if this {@code Layer2SequenceMatcher} could advance by adding {@code packet} to its set of
  65      *         matched packets, {@code false} otherwise.
  66      */
  67     public boolean matchPacket(PcapPacket packet) {
  68         if (getMatchedPacketsCount() == getTargetSequencePacketCount()) {
  69             // We already matched the entire sequence, so we can't match any more packets.
  70             return false;
  71         }
  72
  73         // Verify that new packet pertains to same flow as previously matched packets, if any.
  74         if (getMatchedPacketsCount() > 0) {
  75             MacAddress pktSrc = PcapPacketUtils.getEthSrcAddr(packet);
  76             MacAddress pktDst = PcapPacketUtils.getEthDstAddr(packet);
  77             MacAddress earlierPktSrc = PcapPacketUtils.getEthSrcAddr(mMatchedPackets.get(0));
  78             MacAddress earlierPktDst = PcapPacketUtils.getEthDstAddr(mMatchedPackets.get(0));
  79             if (!(pktSrc.equals(earlierPktSrc) && pktDst.equals(earlierPktDst) ||
  80                     pktSrc.equals(earlierPktDst) && pktDst.equals(earlierPktSrc))) {
  81                 return false;
  82             }
  83         }
  84
  85         // Get representative of the packet we expect to match next.
  86         PcapPacket expected = mSequence.get(mMatchedPackets.size());
  87         // First verify if the received packet has the length we're looking for.
  88         if (packet.getOriginalLength() == expected.getOriginalLength()) {
  89             // If this is the first packet, we only need to verify that its length is correct. Time constraints are
  90             // obviously satisfied as there are no previous packets. Furthermore, direction matches by definition as we
  91             // don't know the MAC of the device (or phone) in advance, so we can't enforce a rule saying "first packet
  92             // must originate from this particular MAC".
  93             if (getMatchedPacketsCount() == 0) {
  94                 // Store packet as matched and advance.
  95                 mMatchedPackets.add(packet);
  96                 return true;
  97             }
  98             // Check if direction of packet matches expected direction.
  99             boolean actualDirection = getPacketDirection(mMatchedPackets.get(getMatchedPacketsCount()-1),
 100                     mPacketDirections[getMatchedPacketsCount()-1], packet);
 101             boolean expectedDirection = mPacketDirections[getMatchedPacketsCount()];
 102             if (actualDirection != expectedDirection) {
 103                 return false;
 104             }
 105             // Next apply timing constraints:
 106             // 1: to be a match, the packet must have a later timestamp than any other packet currently matched
 107             // 2: does adding the packet cause the max allowed time between first packet and last packet to be exceeded?
 108             if (!packet.getTimestamp().isAfter(mMatchedPackets.get(getMatchedPacketsCount()-1).getTimestamp())) {
 109                 return false;
 110             }
 111             if (packet.getTimestamp().isAfter(mMatchedPackets.get(0).getTimestamp().
 112                             plusMillis(TriggerTrafficExtractor.INCLUSION_WINDOW_MILLIS))) {
 113                 return false;
 114             }
 115             // If we made it here, it means that this packet has the expected length, direction, and obeys the timing
 116             // constraints, so we store it and advance.
 117             mMatchedPackets.add(packet);
 118             if (mMatchedPackets.size() == mSequence.size()) {
 119                 // TODO report (to observers?) that we are done?
 120             }
 121             return true;
 122         }
 123         return false;
 124     }
 125
 126     public int getMatchedPacketsCount() {
 127         return mMatchedPackets.size();
 128     }
 129
 130     public int getTargetSequencePacketCount() {
 131         return mSequence.size();
 132     }
 133
 134     public List<PcapPacket> getTargetSequence() {
 135         return mSequence;
 136     }
 137
 138     public List<PcapPacket> getMatchedPackets() {
 139         return mMatchedPackets;
 140     }
 141
 142     /**
 143      * Utility for {@code getMatchedPackets().get(getMatchedPackets().size()-1)}.
 144      * @return The last matched packet, or {@code null} if no packets have been matched yet.
 145      */
 146     public PcapPacket getLastPacket() {
 147         return mSequence.size() > 0 ? mSequence.get(mSequence.size()-1) : null;
 148     }
 149
 150     /**
 151      * Compute the direction of a packet based on the previous packet. If no previous packet is provided, the direction
 152      * of {@code currPkt} is {@code true} by definition.
 153      * @param prevPkt The previous packet, if any.
 154      * @param prevPktDirection The computed direction of the previous packet
 155      * @param currPkt The current packet for which the direction is to be determined.
 156      * @return The direction of {@code currPkt}.
 157      */
 158     private boolean getPacketDirection(PcapPacket prevPkt, boolean prevPktDirection, PcapPacket currPkt) {
 159         if (prevPkt == null) {
 160             // By definition, use true as direction marker for first packet
 161             return true;
 162         }
 163         if (PcapPacketUtils.getEthSrcAddr(prevPkt).equals(PcapPacketUtils.getEthSrcAddr(currPkt))) {
 164             // Current packet goes in same direction as previous packet.
 165             return prevPktDirection;
 166         } else {
 167             // Current packet goes in opposite direction of previous packet.
 168             return !prevPktDirection;
 169         }
 170     }
 171
 172
 173 }