Code/Projects/PacketLevelSignatureExtractor/src/main/java/edu/uci/iotproject/detection/layer3/SignatureDetector.java

   1 package edu.uci.iotproject.detection.layer3;
   2
   3 import edu.uci.iotproject.analysis.TriggerTrafficExtractor;
   4 import edu.uci.iotproject.analysis.UserAction;
   5 import edu.uci.iotproject.detection.AbstractClusterMatcher;
   6 import edu.uci.iotproject.detection.ClusterMatcherObserver;
   7 import edu.uci.iotproject.io.PcapHandleReader;
   8 import edu.uci.iotproject.util.PcapPacketUtils;
   9 import edu.uci.iotproject.util.PrintUtils;
  10 import org.apache.commons.math3.distribution.AbstractRealDistribution;
  11 import org.apache.commons.math3.distribution.NormalDistribution;
  12 import org.jgrapht.GraphPath;
  13 import org.jgrapht.alg.shortestpath.DijkstraShortestPath;
  14 import org.jgrapht.graph.DefaultWeightedEdge;
  15 import org.jgrapht.graph.SimpleDirectedWeightedGraph;
  16 import org.pcap4j.core.*;
  17
  18 import java.time.Duration;
  19 import java.time.ZoneId;
  20 import java.time.format.DateTimeFormatter;
  21 import java.time.format.FormatStyle;
  22 import java.util.*;
  23 import java.util.function.Consumer;
  24
  25 /**
  26  * Detects an event signature that spans one or multiple TCP connections.
  27  *
  28  * @author Janus Varmarken {@literal <jvarmark@uci.edu>}
  29  * @author Rahmadi Trimananda {@literal <rtrimana@uci.edu>}
  30  */
  31 public class SignatureDetector implements PacketListener, ClusterMatcherObserver {
  32
  33     // Test client
  34     public static void main(String[] args) throws PcapNativeException, NotOpenException {
  35 //        if (args.length < 3) {
  36 //            String errMsg = String.format("Usage: %s inputPcapFile onSignatureFile offSignatureFile",
  37 //                    SignatureDetector.class.getSimpleName());
  38 //            System.out.println(errMsg);
  39 //            return;
  40 //        }
  41 //        final String inputPcapFile = args[0];
  42 //        final String onSignatureFile = args[1];
  43 //        final String offSignatureFile = args[2];
  44
  45         String path = "/scratch/July-2018"; // Rahmadi
  46 //        String path = "/Users/varmarken/temp/UCI IoT Project/experiments"; // Janus
  47 //        String path = "/home/jvarmark/iot_project/datasets"; // Hera (server)
  48 //        String path = "/raid/varmarken/iot_project/datasets"; // Zeus (server)
  49
  50         // No activity test
  51         //final String inputPcapFile = path + "/evaluation/no-activity/no-activity.wlan1.pcap";
  52
  53         // D-Link Siren experiment
  54 //        final String inputPcapFile = path + "/evaluation/dlink-siren/dlink-siren.data.wlan1.pcap";
  55 //        final String inputPcapFile = path + "/evaluation/dlink-siren/dlink-siren.eth0.local.pcap";
  56         // D-Link Siren DEVICE signatures
  57 //        final String onSignatureFile = path + "/2018-08/dlink-siren/onSignature-DLink-Siren-device.sig";
  58 //        final String offSignatureFile = path + "/2018-08/dlink-siren/offSignature-DLink-Siren-device.sig";
  59         // D-Link Siren PHONE signatures
  60 //        final String onSignatureFile = path + "/2018-08/dlink-siren/onSignature-DLink-Siren-phone.sig";
  61 //        final String offSignatureFile = path + "/2018-08/dlink-siren/offSignature-DLink-Siren-phone.sig";
  62         // TODO: EXPERIMENT - November 19, 2018
  63         // Hue Bulb experiment
  64 //        final String inputPcapFile = path + "/2018-08/hue-bulb/hue-bulb.wlan1.local.pcap";
  65         // Hue Bulb PHONE signatures
  66 //        final String onSignatureFile = path + "/experimental_result/standalone/hue-bulb/signatures/hue-bulb-onSignature-phone-side.sig";
  67 //        final String offSignatureFile = path + "/experimental_result/standalone/hue-bulb/signatures/hue-bulb-offSignature-phone-side.sig";
  68
  69         /*
  70         // Kwikset Doorlock Sep 12 experiment
  71 //        final String inputPcapFile = path + "/evaluation/kwikset-doorlock/kwikset-doorlock.data.wlan1.pcap";
  72         final String inputPcapFile = path + "/evaluation/kwikset-doorlock/kwikset-doorlock.data.eth0.pcap";
  73 //        // Kwikset Doorlock PHONE signatures
  74         final String onSignatureFile = path + "/2018-08/kwikset-doorlock/onSignature-Kwikset-Doorlock-phone-new.sig";
  75         final String offSignatureFile = path + "/2018-08/kwikset-doorlock/offSignature-Kwikset-Doorlock-phone-new.sig";
  76         */
  77
  78         // D-Link Plug experiment
  79         //final String inputPcapFile = path + "/evaluation/dlink/dlink-plug.data.wlan1.pcap";
  80 //        final String inputPcapFile = path + "/evaluation/dlink/dlink-plug.data.eth0.pcap";
  81
  82         // D-Link Plug DEVICE signatures
  83 //        final String onSignatureFile = path + "/2018-07/dlink/onSignature-DLink-Plug-device.sig";
  84 //        final String offSignatureFile = path + "/2018-07/dlink/offSignature-DLink-Plug-device.sig";
  85         // D-Link Plug PHONE signatures
  86 //        final String onSignatureFile = path + "/2018-07/dlink/onSignature-DLink-Plug-phone.sig";
  87 //        final String offSignatureFile = path + "/2018-07/dlink/offSignature-DLink-Plug-phone.sig";
  88
  89         // TODO: The following are negative tests against the PCAP file from UNSW
  90 //        final String inputPcapFile = path + "/UNSW/16-10-04.pcap"; // TODO: Seems to be broken! Zero-payload!
  91 //          final String inputPcapFile = path + "/UNSW/16-10-12.pcap";
  92
  93 //        final String inputPcapFile = path + "/UNSW/16-09-28.pcap"; // TODO: Seems to be broken! Zero-payload!
  94 //        final String inputPcapFile = path + "/UNSW/16-10-02.pcap"; // TODO: Seems to be broken!
  95 //        final String inputPcapFile = path + "/UNSW/16-10-03.pcap"; // TODO: Seems to be broken!
  96 //        final String inputPcapFile = path + "/UNSW/16-10-04-a.pcap"; // TODO: Seems to be broken! Zero-payload!
  97 //        final String inputPcapFile = path + "/UNSW/16-10-04-b.pcap"; // TODO: Seems to be broken! Zero-payload!
  98 //        final String inputPcapFile = path + "/UNSW/16-10-07.pcap"; // TODO: Seems to be broken!
  99 //        final String inputPcapFile = path + "/UNSW/16-10-08.pcap"; // TODO: Seems to be broken!
 100 //        final String inputPcapFile = path + "/UNSW/16-10-09.pcap"; // TODO: Seems to be broken!
 101 //        final String inputPcapFile = path + "/UNSW/16-10-10.pcap"; // TODO: Seems to be broken!
 102 //        final String inputPcapFile = path + "/UNSW/16-10-11.pcap"; // TODO: Seems to be broken!
 103         // TODO: The following one is very long!!! - Split into smaller files!
 104 //        final String inputPcapFile = path + "/UNSW/16-10-12-a.pcap";
 105 //        final String inputPcapFile = path + "/UNSW/16-10-12-b.pcap";
 106 //        final String inputPcapFile = path + "/UNSW/16-10-12-c.pcap";
 107 //        final String inputPcapFile = path + "/UNSW/16-10-12-d.pcap";
 108
 109 //        final String inputPcapFile = path + "/UNSW/16-09-23.pcap";
 110 //        final String inputPcapFile = path + "/UNSW/16-09-24.pcap";
 111 //        final String inputPcapFile = path + "/UNSW/16-09-25.pcap";
 112 //        final String inputPcapFile = path + "/UNSW/16-09-26.pcap";
 113 //        final String inputPcapFile = path + "/UNSW/16-09-27.pcap";
 114 //        final String inputPcapFile = path + "/UNSW/16-09-29.pcap";
 115 //        final String inputPcapFile = path + "/UNSW/16-10-01.pcap";
 116 //        final String inputPcapFile = path + "/UNSW/16-10-06.pcap";
 117         // Negative test: dataset from UNB
 118 //        final String inputPcapFile = path + "/evaluation/negative-datasets/UNB/Monday-WorkingHours_one-local-endpoint-001.pcap";
 119
 120         // TODO: The following are tests for signatures against training data
 121
 122         // TODO: D-LINK PLUG experiment
 123 //        final String inputPcapFile = path + "/training/dlink-plug/wlan1/dlink-plug.wlan1.local.pcap";
 124         // D-Link Plug DEVICE signatures
 125 //        final String onSignatureFile = path + "/training/dlink-plug/signatures/dlink-plug-onSignature-device-side.sig";
 126 //        final String offSignatureFile = path + "/training/dlink-plug/signatures/dlink-plug-offSignature-device-side.sig";
 127         // D-Link Plug PHONE signatures
 128 //        final String onSignatureFile = path + "/training/dlink-plug/signatures/dlink-plug-onSignature-phone-side.sig";
 129 //        final String offSignatureFile = path + "/training/dlink-plug/signatures/dlink-plug-offSignature-phone-side.sig";
 130
 131         // TODO: EXPERIMENT - November 7, 2018
 132         // D-Link Plug experiment
 133 //        //final String inputPcapFile = path + "/experimental_result/standalone/dlink-plug/wlan1/dlink-plug.wlan1.local.pcap";
 134 //        final String inputPcapFile = path + "/experimental_result/smarthome/dlink-plug/wlan1/dlink-plug.wlan1.detection.pcap";
 135 //        //final String inputPcapFile = path + "/experimental_result/smarthome/dlink-plug/eth0/dlink-plug.eth0.detection.pcap";
 136 //        // D-Link Plug DEVICE signatures
 137 //        final String onSignatureFile = path + "/experimental_result/standalone/dlink-plug/signatures/dlink-plug-onSignature-device-side.sig";
 138 //        final String offSignatureFile = path + "/experimental_result/standalone/dlink-plug/signatures/dlink-plug-offSignature-device-side.sig";
 139 //        final String onClusterAnalysisFile = path + "/experimental_result/standalone/dlink-plug/analysis/dlink-plug-onClusters-device-side.cls";
 140 //        final String offClusterAnalysisFile = path + "/experimental_result/standalone/dlink-plug/analysis/dlink-plug-offClusters-device-side.cls";
 141         // D-Link Plug PHONE signatures
 142 //        final String onSignatureFile = path + "/experimental_result/standalone/dlink-plug/signatures/dlink-plug-onSignature-phone-side.sig";
 143 //        final String offSignatureFile = path + "/experimental_result/standalone/dlink-plug/signatures/dlink-plug-offSignature-phone-side.sig";
 144 //        final String onClusterAnalysisFile = path + "/experimental_result/standalone/dlink-plug/analysis/dlink-plug-onClusters-phone-side.cls";
 145 //        final String offClusterAnalysisFile = path + "/experimental_result/standalone/dlink-plug/analysis/dlink-plug-offClusters-phone-side.cls";
 146
 147         // TODO: EXPERIMENT - November 9, 2018
 148         // TODO: D-LINK SIREN experiment
 149         //final String inputPcapFile = path + "/experimental_result/standalone/dlink-siren/wlan1/dlink-siren.wlan1.local.pcap";
 150         //final String inputPcapFile = path + "/experimental_result/smarthome/dlink-siren/wlan1/dlink-siren.wlan1.detection.pcap";
 151 //        final String inputPcapFile = path + "/experimental_result/smarthome/dlink-siren/eth0/dlink-siren.eth0.detection.pcap";
 152 //        // D-Link Siren DEVICE signatures
 153 //        // TODO: The device signature does not have pairs---only one packet which is 216, so we don't consider this as a signature
 154 //        final String onSignatureFile = path + "/experimental_result/standalone/dlink-siren/signatures/dlink-siren-onSignature-device-side.sig";
 155 //        final String offSignatureFile = path + "/experimental_result/standalone/dlink-siren/signatures/dlink-siren-offSignature-device-side.sig";
 156         // D-Link Siren PHONE signatures
 157 //        final String onSignatureFile = path + "/experimental_result/standalone/dlink-siren/signatures/dlink-siren-onSignature-phone-side.sig";
 158 //        final String offSignatureFile = path + "/experimental_result/standalone/dlink-siren/signatures/dlink-siren-offSignature-phone-side.sig";
 159 //        final String onSignatureFile = path + "/training/signatures/dlink-siren/dlink-siren-onSignature-phone-side.sig";
 160 //        final String offSignatureFile = path + "/training/signatures/dlink-siren/dlink-siren-offSignature-phone-side.sig";
 161 //        final String onClusterAnalysisFile = path + "/experimental_result/standalone/dlink-siren/analysis/dlink-siren-onClusters-phone-side.cls";
 162 //        final String offClusterAnalysisFile = path + "/experimental_result/standalone/dlink-siren/analysis/dlink-siren-offClusters-phone-side.cls";
 163
 164         // TODO: TP-LINK PLUG experiment
 165 ////        final String inputPcapFile = path + "/training/tplink-plug/wlan1/tplink-plug.wlan1.local.pcap";
 166 ////        final String inputPcapFile = path + "/experimental_result/wifi-Sniffer/tests2/airtool_2019-01-04_11.08.45.AM.pcap";
 167 //        final String inputPcapFile = path + "/experimental_result/wifi-Sniffer/tests2/command-frames-only.pcap";
 168 //        // TP-Link Plug DEVICE signatures
 169 //        final String onSignatureFile = path + "/training/tplink-plug/signatures/tplink-plug-onSignature-device-side.sig";
 170 //        final String offSignatureFile = path + "/training/tplink-plug/signatures/tplink-plug-offSignature-device-side.sig";
 171         // TODO: EXPERIMENT - November 8, 2018
 172         // TP-Link Plug experiment
 173 //        final String inputPcapFile = path + "/experimental_result/standalone/tplink-plug/wlan1/tplink-plug.wlan1.local.pcap";
 174 ////        final String inputPcapFile = path + "/experimental_result/standalone/tplink-plug/eth0/tplink-plug.eth0.local.pcap";
 175 ////        final String inputPcapFile = path + "/experimental_result/smarthome/tplink-plug/wlan1/tplink-plug.wlan1.detection.pcap";
 176 //        final String inputPcapFile = path + "/experimental_result/smarthome/tplink-plug/eth0/tplink-plug.eth0.detection.pcap";
 177 ////        // TP-Link Plug DEVICE signatures
 178 ////        final String onSignatureFile = path + "/experimental_result/standalone/tplink-plug/signatures/tplink-plug-onSignature-device-side.sig";
 179 ////        final String offSignatureFile = path + "/experimental_result/standalone/tplink-plug/signatures/tplink-plug-offSignature-device-side.sig";
 180 //        final String onSignatureFile = path + "/experimental_result/standalone/tplink-plug/signatures/tplink-plug-onSignature-device-side-outbound.sig";
 181 //        final String offSignatureFile = path + "/experimental_result/standalone/tplink-plug/signatures/tplink-plug-offSignature-device-side-outbound.sig";
 182 //        // TP-Link Plug PHONE signatures
 183 ////        final String onSignatureFile = path + "/experimental_result/standalone/tplink-plug/signatures/tplink-plug-onSignature-phone-side.sig";
 184 ////        final String offSignatureFile = path + "/experimental_result/standalone/tplink-plug/signatures/tplink-plug-offSignature-phone-side.sig";
 185 //        // TP-Link Plug cluster analyses
 186 //        final String onClusterAnalysisFile = path + "/experimental_result/standalone/tplink-plug/analysis/tplink-plug-onClusters.cls";
 187 //        final String offClusterAnalysisFile = path + "/experimental_result/standalone/tplink-plug/analysis/tplink-plug-offClusters.cls";
 188
 189         // Amazon Alexa experiment
 190 //        final String inputPcapFile = path + "/training/amazon-alexa/wlan1/alexa2.wlan1.local.pcap";
 191 //        // TP-Link Plug DEVICE signatures
 192 //        final String onSignatureFile = path + "/training/amazon-alexa/signatures/amazon-alexa-onSignature-device-side.sig";
 193 //        final String offSignatureFile = path + "/training/amazon-alexa/signatures/amazon-alexa-offSignature-device-side.sig";
 194
 195         // TODO: KWIKSET DOORLOCK Sep 12 experiment
 196 //        final String inputPcapFile = path + "/2018-08/kwikset-doorlock/kwikset3.wlan1.local.pcap";
 197 //        // Kwikset Doorlock PHONE signatures
 198 //        final String onSignatureFile = path + "/2018-08/kwikset-doorlock/onSignature-Kwikset-Doorlock-phone.sig";
 199 //        final String offSignatureFile = path + "/2018-08/kwikset-doorlock/offSignature-Kwikset-Doorlock-phone.sig";
 200         // TODO: EXPERIMENT - November 10, 2018
 201         // Kwikset Door lock experiment
 202 //        final String inputPcapFile = path + "/experimental_result/standalone/kwikset-doorlock/wlan1/kwikset-doorlock.wlan1.local.pcap";
 203         //final String inputPcapFile = path + "/experimental_result/smarthome/kwikset-doorlock/wlan1/kwikset-doorlock.wlan1.detection.pcap";
 204 //        final String inputPcapFile = path + "/experimental_result/smarthome/kwikset-doorlock/eth0/kwikset-doorlock.eth0.detection.pcap";
 205 //        // Kwikset Door lock PHONE signatures
 206 //        final String onSignatureFile = path + "/experimental_result/standalone/kwikset-doorlock/signatures/kwikset-doorlock-onSignature-phone-side.sig";
 207 //        final String offSignatureFile = path + "/experimental_result/standalone/kwikset-doorlock/signatures/kwikset-doorlock-offSignature-phone-side.sig";
 208 ////        final String onSignatureFile = path + "/training/signatures/kwikset-doorlock/kwikset-doorlock-onSignature-phone-side.sig";
 209 ////        final String offSignatureFile = path + "/training/signatures/kwikset-doorlock/kwikset-doorlock-offSignature-phone-side.sig";
 210 //        final String onClusterAnalysisFile = path + "/experimental_result/standalone/kwikset-doorlock/analysis/kwikset-doorlock-onClusters-phone-side.cls";
 211 //        final String offClusterAnalysisFile = path + "/experimental_result/standalone/kwikset-doorlock/analysis/kwikset-doorlock-offClusters-phone-side.cls";
 212
 213         // TODO: SMARTTHINGS PLUG experiment
 214 //        final String inputPcapFile = path + "/training/st-plug/wlan1/st-plug.wlan1.local.pcap";
 215 //        // SmartThings Plug DEVICE signatures
 216 //        //final String onSignatureFile = path + "/training/st-plug/signatures/st-plug-onSignature-device-side.sig";
 217 //        //final String offSignatureFile = path + "/training/st-plug/signatures/st-plug-offSignature-device-side.sig";
 218 //        // SmartThings Plug PHONE signatures
 219 //        final String onSignatureFile = path + "/training/st-plug/signatures/st-plug-onSignature-phone-side.sig";
 220 //        final String offSignatureFile = path + "/training/st-plug/signatures/st-plug-offSignature-phone-side.sig";
 221         // TODO: EXPERIMENT - November 12, 2018
 222         // SmartThings Plug experiment
 223 //        final String inputPcapFile = path + "/experimental_result/standalone/st-plug/wlan1/st-plug.wlan1.local.pcap";
 224 //        final String inputPcapFile = path + "/experimental_result/standalone/st-plug/eth0/st-plug.eth0.local.pcap";
 225 //        //final String inputPcapFile = path + "/experimental_result/smarthome/st-plug/wlan1/st-plug.wlan1.detection.pcap";
 226 //        final String inputPcapFile = path + "/experimental_result/smarthome/st-plug/eth0/st-plug.eth0.detection.pcap";
 227 ////        // SmartThings Plug PHONE signatures
 228 //        final String onSignatureFile = path + "/experimental_result/standalone/st-plug/signatures/st-plug-onSignature-phone-side.sig";
 229 //        final String offSignatureFile = path + "/experimental_result/standalone/st-plug/signatures/st-plug-offSignature-phone-side.sig";
 230 //        final String onSignatureFile = path + "/training/signatures/st-plug/st-plug-onSignature-phone-side.sig";
 231 //        final String offSignatureFile = path + "/training/signatures/st-plug/st-plug-offSignature-phone-side.sig";
 232 //        final String onClusterAnalysisFile = path + "/experimental_result/standalone/st-plug/analysis/st-plug-onClusters-phone-side.cls";
 233 //        final String offClusterAnalysisFile = path + "/experimental_result/standalone/st-plug/analysis/st-plug-offClusters-phone-side.cls";
 234
 235         // TODO: ARLO CAMERA experiment
 236 //        final String inputPcapFile = path + "/training/arlo-camera/wlan1/arlo-camera.wlan1.local.pcap";
 237 ////        // TP-Link Plug DEVICE signatures
 238 //        final String onSignatureFile = path + "/training/arlo-camera/signatures/arlo-camera-onSignature-phone-side.sig";
 239 //        final String offSignatureFile = path + "/training/arlo-camera/signatures/arlo-camera-offSignature-phone-side.sig";
 240         // TODO: EXPERIMENT - November 13, 2018
 241         // Arlo Camera experiment
 242 //        final String inputPcapFile = path + "/experimental_result/standalone/arlo-camera/wlan1/arlo-camera.wlan1.local.pcap";
 243 //        final String inputPcapFile = path + "/experimental_result/standalone/arlo-camera/eth0/arlo-camera.eth0.local.pcap";
 244 //        final String inputPcapFile = path + "/experimental_result/smarthome/arlo-camera/wlan1/arlo-camera.wlan1.detection.pcap";
 245         final String inputPcapFile = path + "/experimental_result/smarthome/arlo-camera/eth0/arlo-camera.eth0.detection.pcap";
 246 //        final String inputPcapFile = path + "/training/arlo-camera/eth0/arlo-camera.eth0.local.pcap";
 247         // Arlo Camera PHONE signatures
 248 //        final String onSignatureFile = path + "/experimental_result/standalone/arlo-camera/signatures/arlo-camera-onSignature-phone-side.sig";
 249 //        final String offSignatureFile = path + "/experimental_result/standalone/arlo-camera/signatures/arlo-camera-offSignature-phone-side.sig";
 250         final String onSignatureFile = path + "/experimental_result/standalone/arlo-camera/signatures/arlo-camera-onSignature-phone-side.sig.complete";
 251         final String offSignatureFile = path + "/experimental_result/standalone/arlo-camera/signatures/arlo-camera-offSignature-phone-side.sig.complete";
 252         final String onClusterAnalysisFile = path + "/experimental_result/standalone/arlo-camera/analysis/arlo-camera-onClusters-phone-side.cls";
 253         final String offClusterAnalysisFile = path + "/experimental_result/standalone/arlo-camera/analysis/arlo-camera-offClusters-phone-side.cls";
 254
 255         // TODO: NEST THERMOSTAT experiment
 256 //        final String inputPcapFile = path + "/training/nest-thermostat/wlan1/nest-thermostat.wlan1.local.pcap";
 257 //        // Nest Thermostat DEVICE signatures
 258 ////        final String onSignatureFile = path + "/training/nest-thermostat/signatures/nest-thermostat-onSignature-device-side.sig";
 259 ////        final String offSignatureFile = path + "/training/nest-thermostat/signatures/nest-thermostat-offSignature-device-side.sig";
 260 //        // Nest Thermostat PHONE signatures
 261 //        final String onSignatureFile = path + "/training/nest-thermostat/signatures/nest-thermostat-onSignature-phone-side.sig";
 262 //        final String offSignatureFile = path + "/training/nest-thermostat/signatures/nest-thermostat-offSignature-phone-side.sig";
 263 //        // TODO: EXPERIMENT - November 15, 2018
 264         // Nest Thermostat experiment
 265 //        final String inputPcapFile = path + "/experimental_result/standalone/nest-thermostat/wlan1/nest-thermostat.wlan1.local.pcap";
 266 //        final String inputPcapFile = path + "/experimental_result/standalone/nest-thermostat/eth0/nest-thermostat.eth0.local.pcap";
 267 //        final String inputPcapFile = path + "/experimental_result/smarthome/nest-thermostat/wlan1/nest-thermostat.wlan1.detection.pcap";
 268 //        final String inputPcapFile = path + "/experimental_result/smarthome/nest-thermostat/eth0/nest-thermostat.eth0.detection.pcap";
 269 ////        // Nest Thermostat PHONE signatures
 270 //        final String onSignatureFile = path + "/experimental_result/standalone/nest-thermostat/signatures/nest-thermostat-onSignature-phone-side.sig";
 271 //        final String offSignatureFile = path + "/experimental_result/standalone/nest-thermostat/signatures/nest-thermostat-offSignature-phone-side.sig";
 272 //        final String onClusterAnalysisFile = path + "/experimental_result/standalone/nest-thermostat/analysis/nest-thermostat-onClusters-phone-side.cls";
 273 //        final String offClusterAnalysisFile = path + "/experimental_result/standalone/nest-thermostat/analysis/nest-thermostat-offClusters-phone-side.cls";
 274
 275         // TODO: EXPERIMENT - January 9, 2018
 276         // TODO: BLOSSOM SPRINKLER experiment
 277         // Blossom Sprinkler experiment
 278 //        //final String inputPcapFile = path + "/training/blossom-sprinkler/wlan1/blossom-sprinkler.wlan1.local.pcap";
 279 //        final String inputPcapFile = path + "/2018-08/blossom/blossom.wlan1.local.pcap";
 280 //        //final String inputPcapFile = path + "/training/blossom-sprinkler/eth0/blossom-sprinkler.eth0.local.pcap";
 281 //        // Blossom Sprinkler DEVICE signatures
 282 //        final String onSignatureFile = path + "/training/blossom-sprinkler/signatures/blossom-sprinkler-onSignature-device-side.sig";
 283 //        final String offSignatureFile = path + "/training/blossom-sprinkler/signatures/blossom-sprinkler-offSignature-device-side.sig";
 284
 285 ////        final String inputPcapFile = path + "/experimental_result/standalone/blossom-sprinkler/wlan1/blossom-sprinkler.wlan1.local.pcap";
 286 //        final String inputPcapFile = path + "/experimental_result/smarthome/blossom-sprinkler/eth0/blossom-sprinkler.eth0.detection.pcap";
 287 ////        final String inputPcapFile = path + "/experimental_result/smarthome/blossom-sprinkler/wlan1/blossom-sprinkler.wlan1.detection.pcap";
 288 //        // Blossom Sprinkler DEVICE signatures
 289 ////        final String onSignatureFile = path + "/experimental_result/standalone/blossom-sprinkler/signatures/blossom-sprinkler-onSignature-device-side.sig";
 290 ////        final String offSignatureFile = path + "/experimental_result/standalone/blossom-sprinkler/signatures/blossom-sprinkler-offSignature-device-side.sig";
 291 ////        final String onClusterAnalysisFile = path + "/experimental_result/standalone/blossom-sprinkler/analysis/blossom-sprinkler-onClusters-device-side.cls";
 292 ////        final String offClusterAnalysisFile = path + "/experimental_result/standalone/blossom-sprinkler/analysis/blossom-sprinkler-offClusters-device-side.cls";
 293 //        // Blossom Sprinkler PHONE signatures
 294 //        final String onSignatureFile = path + "/experimental_result/standalone/blossom-sprinkler/signatures/blossom-sprinkler-onSignature-phone-side.sig";
 295 //        final String offSignatureFile = path + "/experimental_result/standalone/blossom-sprinkler/signatures/blossom-sprinkler-offSignature-phone-side.sig";
 296 //        final String onClusterAnalysisFile = path + "/experimental_result/standalone/blossom-sprinkler/analysis/blossom-sprinkler-onClusters-phone-side.cls";
 297 //        final String offClusterAnalysisFile = path + "/experimental_result/standalone/blossom-sprinkler/analysis/blossom-sprinkler-offClusters-phone-side.cls";
 298
 299         // LiFX Bulb experiment
 300 //        final String inputPcapFile = path + "/training/lifx-bulb/wlan1/lifx-bulb.wlan1.local.pcap";
 301 //        // LiFX Bulb DEVICE signatures
 302 //        final String onSignatureFile = path + "/training/lifx-bulb/signatures/lifx-bulb-onSignature-device-side.sig";
 303 //        final String offSignatureFile = path + "/training/lifx-bulb/signatures/lifx-bulb-offSignature-device-side.sig";
 304         // LiFX Bulb PHONE signatures
 305 //        final String onSignatureFile = path + "/training/lifx-bulb/signatures/lifx-bulb-onSignature-phone-side.sig";
 306 //        final String offSignatureFile = path + "/training/lifx-bulb/signatures/lifx-bulb-offSignature-phone-side.sig";
 307
 308         /*
 309         // Hue Bulb experiment
 310         final String inputPcapFile = path + "/training/hue-bulb/wlan1/hue-bulb.wlan1.local.pcap";
 311         // Hue Bulb PHONE signatures
 312         final String onSignatureFile = path + "/training/hue-bulb/signatures/hue-bulb-onSignature-phone-side.sig";
 313         final String offSignatureFile = path + "/training/hue-bulb/signatures/hue-bulb-offSignature-phone-side.sig";
 314         */
 315
 316         // TODO: TP-LINK BULB experiment
 317 //        final String inputPcapFile = path + "/training/tplink-bulb/wlan1/tplink-bulb.wlan1.local.pcap";
 318 //        // TP-Link Bulb PHONE signatures
 319 //        final String onSignatureFile = path + "/training/tplink-bulb/signatures/tplink-bulb-onSignature-phone-side.sig";
 320 //        final String offSignatureFile = path + "/training/tplink-bulb/signatures/tplink-bulb-offSignature-phone-side.sig";
 321         // TODO: EXPERIMENT - November 16, 2018
 322         // TP-Link Bulb experiment
 323 //        final String inputPcapFile = path + "/experimental_result/standalone/tplink-bulb/wlan1/tplink-bulb.wlan1.local.pcap";
 324 //        final String inputPcapFile = path + "/experimental_result/standalone/tplink-bulb/eth0/tplink-bulb.eth0.local.pcap";
 325 //        final String inputPcapFile = path + "/experimental_result/smarthome/tplink-bulb/wlan1/tplink-bulb.wlan1.detection.pcap";
 326 ////        final String inputPcapFile = path + "/experimental_result/smarthome/tplink-bulb/eth0/tplink-bulb.eth0.detection.pcap";
 327 //        // TP-Link Bulb PHONE signatures
 328 //        final String onSignatureFile = path + "/experimental_result/standalone/tplink-bulb/signatures/tplink-bulb-onSignature-phone-side.sig";
 329 //        final String offSignatureFile = path + "/experimental_result/standalone/tplink-bulb/signatures/tplink-bulb-offSignature-phone-side.sig";
 330 //        final String onClusterAnalysisFile = path + "/experimental_result/standalone/tplink-bulb/analysis/tplink-bulb-onClusters-phone-side.cls";
 331 //        final String offClusterAnalysisFile = path + "/experimental_result/standalone/tplink-bulb/analysis/tplink-bulb-offClusters-phone-side.cls";
 332
 333         // TODO: EXPERIMENT - November 20, 2018
 334         // TODO: WEMO PLUG experiment
 335 //        final String inputPcapFile = path + "/experimental_result/standalone/wemo-plug/wlan1/wemo-plug.wlan1.local.pcap";
 336 //        final String inputPcapFile = path + "/experimental_result/standalone/wemo-plug/eth0/wemo-plug.eth0.local.pcap";
 337         // TODO: WE HAVE 4 ADDITIONAL EVENTS (TRIGGERED MANUALLY), SO WE JUST IGNORE THEM BECAUSE THEY HAPPENED BEFORE
 338         // TODO: THE ACTUAL TRIGGERS
 339 //        final String inputPcapFile = path + "/experimental_result/smarthome/wemo-plug/wlan1/wemo-plug.wlan1.detection.pcap";
 340 ////        final String inputPcapFile = path + "/experimental_result/smarthome/wemo-plug/eth0/wemo-plug.eth0.detection.pcap";
 341 //        // WeMo Plug PHONE signatures
 342 //        final String onSignatureFile = path + "/experimental_result/standalone/wemo-plug/signatures/wemo-plug-onSignature-phone-side.sig";
 343 //        final String offSignatureFile = path + "/experimental_result/standalone/wemo-plug/signatures/wemo-plug-offSignature-phone-side.sig";
 344 //        final String onClusterAnalysisFile = path + "/experimental_result/standalone/wemo-plug/analysis/wemo-plug-onClusters-phone-side.cls";
 345 //        final String offClusterAnalysisFile = path + "/experimental_result/standalone/wemo-plug/analysis/wemo-plug-offClusters-phone-side.cls";
 346
 347         // TODO: EXPERIMENT - November 21, 2018
 348         // TODO: WEMO INSIGHT Plug experiment
 349 //        final String inputPcapFile = path + "/experimental_result/standalone/wemo-insight-plug/wlan1/wemo-insight-plug.wlan1.local.pcap";
 350 //        final String inputPcapFile = path + "/experimental_result/standalone/wemo-insight-plug/eth0/wemo-insight-plug.eth0.local.pcap";
 351         // TODO: WE HAVE 1 ADDITIONAL EVENT (FROM WEMO PLUG)
 352 //        final String inputPcapFile = path + "/experimental_result/smarthome/wemo-insight-plug/wlan1/wemo-insight-plug.wlan1.detection.pcap";
 353 //        final String inputPcapFile = path + "/experimental_result/smarthome/wemo-insight-plug/eth0/wemo-insight-plug.eth0.detection.pcap";
 354         // WeMo Insight Plug PHONE signatures
 355 //        final String onSignatureFile = path + "/experimental_result/standalone/wemo-insight-plug/signatures/wemo-insight-plug-onSignature-phone-side.sig";
 356 //        final String offSignatureFile = path + "/experimental_result/standalone/wemo-insight-plug/signatures/wemo-insight-plug-offSignature-phone-side.sig";
 357 //        final String onClusterAnalysisFile = path + "/experimental_result/standalone/wemo-insight-plug/analysis/wemo-insight-plug-onClusters-phone-side.cls";
 358 //        final String offClusterAnalysisFile = path + "/experimental_result/standalone/wemo-insight-plug/analysis/wemo-insight-plug-offClusters-phone-side.cls";
 359
 360
 361         /*
 362         // WeMo Plug experiment
 363         final String inputPcapFile = path + "/training/wemo-plug/wlan1/wemo-plug.wlan1.local.pcap";
 364         // WeMo Plug PHONE signatures
 365         final String onSignatureFile = path + "/training/wemo-plug/signatures/wemo-plug-onSignature-device-side.sig";
 366         final String offSignatureFile = path + "/training/wemo-plug/signatures/wemo-plug-offSignature-device-side.sig";
 367         // WeMo Insight Plug experiment
 368         final String inputPcapFile = path + "/training/wemo-insight-plug/wlan1/wemo-insight-plug.wlan1.local.pcap";
 369         // WeMo Insight Plug PHONE signatures
 370         final String onSignatureFile = path + "/training/wemo-insight-plug/signatures/wemo-insight-plug-onSignature-device-side.sig";
 371         final String offSignatureFile = path + "/training/wemo-insight-plug/signatures/wemo-insight-plug-offSignature-device-side.sig";
 372         */
 373
 374         // D-Link Siren experiment
 375 //        final String inputPcapFile = path + "/2018-08/dlink-siren/dlink-siren.wlan1.local.pcap";
 376         // D-Link Siren DEVICE signatures
 377         //final String onSignatureFile = path + "/2018-08/dlink-siren/onSignature-DLink-Siren-device.sig";
 378         //final String offSignatureFile = path + "/2018-08/dlink-siren/offSignature-DLink-Siren-device.sig";
 379         // D-Link Siren PHONE signatures
 380 //        final String onSignatureFile = path + "/2018-08/dlink-siren/onSignature-DLink-Siren-phone.sig";
 381 //        final String offSignatureFile = path + "/2018-08/dlink-siren/offSignature-DLink-Siren-phone.sig";
 382
 383
 384         // Output file names used (to make it easy to catch if one forgets to change them)
 385         System.out.println("ON signature file in use is " + onSignatureFile);
 386         System.out.println("OFF signature file in use is " + offSignatureFile);
 387         System.out.println("PCAP file that is the target of detection is " + inputPcapFile);
 388
 389         // Specify epsilon
 390         // TODO: This would be specified through command line option
 391         double eps = 10.0;
 392         // Load signatures
 393         List<List<List<PcapPacket>>> onSignature = PrintUtils.deserializeFromFile(onSignatureFile);
 394         List<List<List<PcapPacket>>> offSignature = PrintUtils.deserializeFromFile(offSignatureFile);
 395         // Load signature analyses
 396         List<List<List<PcapPacket>>> onClusterAnalysis = PrintUtils.deserializeFromFile(onClusterAnalysisFile);
 397         List<List<List<PcapPacket>>> offClusterAnalysis = PrintUtils.deserializeFromFile(offClusterAnalysisFile);
 398
 399         // TODO: FOR NOW WE DECIDE PER SIGNATURE AND THEN WE OR THE BOOLEANS
 400         // TODO: SINCE WE ONLY HAVE 2 SIGNATURES FOR NOW (ON AND OFF), THEN IT IS USUALLY EITHER RANGE-BASED OR
 401         // TODO: STRICT MATCHING
 402         // Check if we should use range-based matching
 403         boolean isRangeBasedForOn = PcapPacketUtils.isRangeBasedMatching(onSignature, eps, offSignature);
 404         boolean isRangeBasedForOff = PcapPacketUtils.isRangeBasedMatching(offSignature, eps, onSignature);
 405         // Update the signature with ranges if it is range-based
 406         if (isRangeBasedForOn && isRangeBasedForOff) {
 407             onSignature = PcapPacketUtils.useRangeBasedMatching(onSignature, onClusterAnalysis);
 408             offSignature = PcapPacketUtils.useRangeBasedMatching(offSignature, offClusterAnalysis);
 409         }
 410
 411         // LAN
 412 //        SignatureDetector onDetector = new SignatureDetector(onSignature, null);
 413 //        SignatureDetector offDetector = new SignatureDetector(offSignature, null);
 414         // WAN
 415         SignatureDetector onDetector = new SignatureDetector(onSignature, "128.195.205.105",
 416                 0, isRangeBasedForOn, eps);
 417         SignatureDetector offDetector = new SignatureDetector(offSignature, "128.195.205.105",
 418                 0, isRangeBasedForOff, eps);
 419
 420         final DateTimeFormatter dateTimeFormatter = DateTimeFormatter.ofLocalizedDateTime(FormatStyle.MEDIUM).
 421                 withLocale(Locale.US).withZone(ZoneId.of("America/Los_Angeles"));
 422
 423         // Outputs information about a detected event to std.out
 424         final Consumer<UserAction> outputter = ua -> {
 425             String eventDescription;
 426             switch (ua.getType()) {
 427                 case TOGGLE_ON:
 428                     eventDescription = "ON";
 429                     break;
 430                 case TOGGLE_OFF:
 431                     eventDescription = "OFF";
 432                     break;
 433                 default:
 434                     throw new AssertionError("unhandled event type");
 435             }
 436             //String output = String.format("[ !!! %s SIGNATURE DETECTED at %s !!! ]",
 437             //      eventDescription, dateTimeFormatter.format(ua.getTimestamp()));
 438             String output = String.format("%s",
 439                     dateTimeFormatter.format(ua.getTimestamp()));
 440             System.out.println(output);
 441         };
 442
 443         // Let's create observers that construct a UserAction representing the detected event.
 444         final List<UserAction> detectedEvents = new ArrayList<>();
 445         onDetector.addObserver((searched, match) -> {
 446             PcapPacket firstPkt = match.get(0).get(0);
 447             detectedEvents.add(new UserAction(UserAction.Type.TOGGLE_ON, firstPkt.getTimestamp()));
 448         });
 449         offDetector.addObserver((searched, match) -> {
 450             PcapPacket firstPkt = match.get(0).get(0);
 451             detectedEvents.add(new UserAction(UserAction.Type.TOGGLE_OFF, firstPkt.getTimestamp()));
 452         });
 453
 454         PcapHandle handle;
 455         try {
 456             handle = Pcaps.openOffline(inputPcapFile, PcapHandle.TimestampPrecision.NANO);
 457         } catch (PcapNativeException pne) {
 458             handle = Pcaps.openOffline(inputPcapFile);
 459         }
 460         PcapHandleReader reader = new PcapHandleReader(handle, p -> true, onDetector, offDetector);
 461         reader.readFromHandle();
 462
 463         // TODO: need a better way of triggering detection than this...
 464         if (isRangeBasedForOn && isRangeBasedForOff) {
 465             onDetector.mClusterMatchers.forEach(cm -> cm.performDetectionRangeBased());
 466             offDetector.mClusterMatchers.forEach(cm -> cm.performDetectionRangeBased());
 467         } else {
 468             onDetector.mClusterMatchers.forEach(cm -> cm.performDetectionConservative());
 469             offDetector.mClusterMatchers.forEach(cm -> cm.performDetectionConservative());
 470         }
 471
 472         // Sort the list of detected events by timestamp to make it easier to compare it line-by-line with the trigger
 473         // times file.
 474         Collections.sort(detectedEvents, Comparator.comparing(UserAction::getTimestamp));
 475
 476         // Output the detected events
 477         detectedEvents.forEach(outputter);
 478
 479         System.out.println("Number of detected events of type " + UserAction.Type.TOGGLE_ON + ": " +
 480                 detectedEvents.stream().filter(ua -> ua.getType() == UserAction.Type.TOGGLE_ON).count());
 481         System.out.println("Number of detected events of type " + UserAction.Type.TOGGLE_OFF + ": " +
 482                 detectedEvents.stream().filter(ua -> ua.getType() == UserAction.Type.TOGGLE_OFF).count());
 483
 484         // TODO: Temporary clean up until we clean the pipeline
 485 //      List<UserAction> cleanedDetectedEvents = SignatureDetector.removeDuplicates(detectedEvents);
 486 //      cleanedDetectedEvents.forEach(outputter);
 487     }
 488
 489     /**
 490      * The signature that this {@link SignatureDetector} is searching for.
 491      */
 492     private final List<List<List<PcapPacket>>> mSignature;
 493
 494     /**
 495      * The {@link Layer3ClusterMatcher}s in charge of detecting each individual sequence of packets that together make up the
 496      * the signature.
 497      */
 498     private final List<Layer3ClusterMatcher> mClusterMatchers;
 499
 500     /**
 501      * For each {@code i} ({@code i >= 0 && i < pendingMatches.length}), {@code pendingMatches[i]} holds the matches
 502      * found by the {@link Layer3ClusterMatcher} at {@code mClusterMatchers.get(i)} that have yet to be "consumed", i.e.,
 503      * have yet to be included in a signature detected by this {@link SignatureDetector} (a signature can be encompassed
 504      * of multiple packet sequences occurring shortly after one another on multiple connections).
 505      */
 506     private final List<List<PcapPacket>>[] pendingMatches;
 507
 508     /**
 509      * Maps a {@link Layer3ClusterMatcher} to its corresponding index in {@link #pendingMatches}.
 510      */
 511     private final Map<Layer3ClusterMatcher, Integer> mClusterMatcherIds;
 512
 513     private final List<SignatureDetectionObserver> mObservers = new ArrayList<>();
 514
 515     private int mInclusionTimeMillis;
 516
 517     /**
 518      * Remove duplicates in {@code List} of {@code UserAction} objects. We need to clean this up for user actions
 519      * that appear multiple times.
 520      * TODO: This static method is probably just for temporary and we could get rid of this after we clean up
 521      * TODO:    the pipeline
 522      *
 523      * @param listUserAction A {@link List} of {@code UserAction}.
 524      *
 525      */
 526     public static List<UserAction> removeDuplicates(List<UserAction> listUserAction) {
 527
 528         // Iterate and check for duplicates (check timestamps)
 529         Set<Long> epochSecondSet = new HashSet<>();
 530         // Create a target list for cleaned up list
 531         List<UserAction> listUserActionClean = new ArrayList<>();
 532         for(UserAction userAction : listUserAction) {
 533             // Don't insert if any duplicate is found
 534             if(!epochSecondSet.contains(userAction.getTimestamp().getEpochSecond())) {
 535                 listUserActionClean.add(userAction);
 536                 epochSecondSet.add(userAction.getTimestamp().getEpochSecond());
 537             }
 538         }
 539         return listUserActionClean;
 540     }
 541
 542     public SignatureDetector(List<List<List<PcapPacket>>> searchedSignature, String routerWanIp,
 543                              int inclusionTimeMillis, boolean isRangeBased, double eps) {
 544         // note: doesn't protect inner lists from changes :'(
 545         mSignature = Collections.unmodifiableList(searchedSignature);
 546         // Generate corresponding/appropriate ClusterMatchers based on the provided signature
 547         List<Layer3ClusterMatcher> clusterMatchers = new ArrayList<>();
 548         for (List<List<PcapPacket>> cluster : mSignature) {
 549             clusterMatchers.add(new Layer3ClusterMatcher(cluster, routerWanIp, isRangeBased, eps, this));
 550         }
 551         mClusterMatchers = Collections.unmodifiableList(clusterMatchers);
 552
 553         // < exploratory >
 554         pendingMatches = new List[mClusterMatchers.size()];
 555         for (int i = 0; i < pendingMatches.length; i++) {
 556             pendingMatches[i] = new ArrayList<>();
 557         }
 558         Map<Layer3ClusterMatcher, Integer> clusterMatcherIds = new HashMap<>();
 559         for (int i = 0; i < mClusterMatchers.size(); i++) {
 560             clusterMatcherIds.put(mClusterMatchers.get(i), i);
 561         }
 562         mClusterMatcherIds = Collections.unmodifiableMap(clusterMatcherIds);
 563         mInclusionTimeMillis =
 564                 inclusionTimeMillis == 0 ? TriggerTrafficExtractor.INCLUSION_WINDOW_MILLIS : inclusionTimeMillis;
 565     }
 566
 567     public void addObserver(SignatureDetectionObserver observer) {
 568         mObservers.add(observer);
 569     }
 570
 571     public boolean removeObserver(SignatureDetectionObserver observer) {
 572         return mObservers.remove(observer);
 573     }
 574
 575     @Override
 576     public void gotPacket(PcapPacket packet) {
 577         // simply delegate packet reception to all ClusterMatchers.
 578         mClusterMatchers.forEach(cm -> cm.gotPacket(packet));
 579     }
 580
 581     @Override
 582     public void onMatch(AbstractClusterMatcher clusterMatcher, List<PcapPacket> match) {
 583         // Add the match at the corresponding index
 584         pendingMatches[mClusterMatcherIds.get(clusterMatcher)].add(match);
 585         checkSignatureMatch();
 586     }
 587
 588     private void checkSignatureMatch() {
 589         // << Graph-based approach using Balint's idea. >>
 590         // This implementation assumes that the packets in the inner lists (the sequences) are ordered by asc timestamp.
 591
 592         // There cannot be a signature match until each Layer3ClusterMatcher has found a match of its respective sequence.
 593         if (Arrays.stream(pendingMatches).noneMatch(l -> l.isEmpty())) {
 594             // Construct the DAG
 595             final SimpleDirectedWeightedGraph<Vertex, DefaultWeightedEdge> graph =
 596                     new SimpleDirectedWeightedGraph<>(DefaultWeightedEdge.class);
 597             // Add a vertex for each match found by all ClusterMatchers
 598             // And maintain an array to keep track of what cluster matcher each vertex corresponds to
 599             final List<Vertex>[] vertices = new List[pendingMatches.length];
 600             for (int i = 0; i < pendingMatches.length; i++) {
 601                 vertices[i] = new ArrayList<>();
 602                 for (List<PcapPacket> sequence : pendingMatches[i]) {
 603                     Vertex v = new Vertex(sequence);
 604                     vertices[i].add(v); // retain reference for later when we are to add edges
 605                     graph.addVertex(v); // add to vertex to graph
 606                 }
 607             }
 608             // Add dummy source and sink vertices to facilitate search.
 609             final Vertex source = new Vertex(null);
 610             final Vertex sink = new Vertex(null);
 611             graph.addVertex(source);
 612             graph.addVertex(sink);
 613             // The source is connected to all vertices that wrap the sequences detected by Layer3ClusterMatcher at index 0.
 614             // Note: zero cost edges as this is just a dummy link to facilitate search from a common start node.
 615             for (Vertex v : vertices[0]) {
 616                 DefaultWeightedEdge edge = graph.addEdge(source, v);
 617                 graph.setEdgeWeight(edge, 0.0);
 618             }
 619             // Similarly, all vertices that wrap the sequences detected by the last Layer3ClusterMatcher of the signature
 620             // are connected to the sink node.
 621             for (Vertex v : vertices[vertices.length-1]) {
 622                 DefaultWeightedEdge edge = graph.addEdge(v, sink);
 623                 graph.setEdgeWeight(edge, 0.0);
 624             }
 625             // Now link sequences detected by Layer3ClusterMatcher at index i to sequences detected by Layer3ClusterMatcher at index
 626             // i+1 if they obey the timestamp constraint (i.e., that the latter is later in time than the former).
 627             for (int i = 0; i < vertices.length; i++) {
 628                 int j = i + 1;
 629                 if (j < vertices.length) {
 630                     for (Vertex iv : vertices[i]) {
 631                         PcapPacket ivLast = iv.sequence.get(iv.sequence.size()-1);
 632                         for (Vertex jv : vertices[j]) {
 633                             PcapPacket jvFirst = jv.sequence.get(jv.sequence.size()-1);
 634                             if (ivLast.getTimestamp().isBefore(jvFirst.getTimestamp())) {
 635                                 DefaultWeightedEdge edge = graph.addEdge(iv, jv);
 636                                 // The weight is the duration of the i'th sequence plus the duration between the i'th
 637                                 // and i+1'th sequence.
 638                                 Duration d = Duration.
 639                                         between(iv.sequence.get(0).getTimestamp(), jvFirst.getTimestamp());
 640                                 // Unfortunately weights are double values, so must convert from long to double.
 641                                 // TODO: need nano second precision? If so, use d.toNanos().
 642                                 // TODO: risk of overflow when converting from long to double..?
 643                                 graph.setEdgeWeight(edge, Long.valueOf(d.toMillis()).doubleValue());
 644                             }
 645                             // Alternative version if we cannot assume that sequences are ordered by timestamp:
 646 //                            if (iv.sequence.stream().max(Comparator.comparing(PcapPacket::getTimestamp)).get()
 647 //                                    .getTimestamp().isBefore(jv.sequence.stream().min(
 648 //                                            Comparator.comparing(PcapPacket::getTimestamp)).get().getTimestamp())) {
 649 //
 650 //                            }
 651                         }
 652                     }
 653                 }
 654             }
 655             // Graph construction complete, run shortest-path to find a (potential) signature match.
 656             DijkstraShortestPath<Vertex, DefaultWeightedEdge> dijkstra = new DijkstraShortestPath<>(graph);
 657             GraphPath<Vertex, DefaultWeightedEdge> shortestPath = dijkstra.getPath(source, sink);
 658             if (shortestPath != null) {
 659                 // The total weight is the duration between the first packet of the first sequence and the last packet
 660                 // of the last sequence, so we simply have to compare the weight against the timeframe that we allow
 661                 // the signature to span. For now we just use the inclusion window we defined for training purposes.
 662                 // Note however, that we must convert back from double to long as the weight is stored as a double in
 663                 // JGraphT's API.
 664                 if (((long)shortestPath.getWeight()) < mInclusionTimeMillis) {
 665                     // There's a signature match!
 666                     // Extract the match from the vertices
 667                     List<List<PcapPacket>> signatureMatch = new ArrayList<>();
 668                     for(Vertex v : shortestPath.getVertexList()) {
 669                         if (v == source || v == sink) {
 670                             // Skip the dummy source and sink nodes.
 671                             continue;
 672                         }
 673                         signatureMatch.add(v.sequence);
 674                         // As there is a one-to-one correspondence between vertices[] and pendingMatches[], we know that
 675                         // the sequence we've "consumed" for index i of the matched signature is also at index i in
 676                         // pendingMatches. We must remove it from pendingMatches so that we don't use it to construct
 677                         // another signature match in a later call.
 678                         pendingMatches[signatureMatch.size()-1].remove(v.sequence);
 679                     }
 680                     // Declare success: notify observers
 681                     mObservers.forEach(obs -> obs.onSignatureDetected(mSignature,
 682                             Collections.unmodifiableList(signatureMatch)));
 683                 }
 684             }
 685         }
 686     }
 687
 688     /**
 689      * Used for registering for notifications of signatures detected by a {@link SignatureDetector}.
 690      */
 691     interface SignatureDetectionObserver {
 692
 693         /**
 694          * Invoked when the {@link SignatureDetector} detects the presence of a signature in the traffic that it's
 695          * examining.
 696          * @param searchedSignature The signature that the {@link SignatureDetector} reporting the match is searching
 697          *                          for.
 698          * @param matchingTraffic The actual traffic trace that matches the searched signature.
 699          */
 700         void onSignatureDetected(List<List<List<PcapPacket>>> searchedSignature,
 701                                  List<List<PcapPacket>> matchingTraffic);
 702     }
 703
 704     /**
 705      * Encapsulates a {@code List<PcapPacket>} so as to allow the list to be used as a vertex in a graph while avoiding
 706      * the expensive {@link AbstractList#equals(Object)} calls when adding vertices to the graph.
 707      * Using this wrapper makes the incurred {@code equals(Object)} calls delegate to {@link Object#equals(Object)}
 708      * instead of {@link AbstractList#equals(Object)}. The net effect is a faster implementation, but the graph will not
 709      * recognize two lists that contain the same items--from a value and not reference point of view--as the same
 710      * vertex. However, this is fine for our purposes -- in fact restricting it to reference equality seems more
 711      * appropriate.
 712      */
 713     private static class Vertex {
 714         private final List<PcapPacket> sequence;
 715         private Vertex(List<PcapPacket> wrappedSequence) {
 716             sequence = wrappedSequence;
 717         }
 718     }
 719 }