Code/Projects/SmartPlugDetector/src/main/java/edu/uci/iotproject/Main.java

   1 package edu.uci.iotproject;
   2
   3 import edu.uci.iotproject.analysis.PcapPacketPair;
   4 import edu.uci.iotproject.analysis.PcapProcessingPipeline;
   5 import edu.uci.iotproject.analysis.TcpConversationUtils;
   6 import org.pcap4j.core.*;
   7
   8 import java.io.EOFException;
   9 import java.net.UnknownHostException;
  10 import java.util.ArrayList;
  11 import java.util.List;
  12 import java.util.concurrent.TimeoutException;
  13
  14 /**
  15  * This is a system that reads PCAP files to compare
  16  * patterns of DNS hostnames, packet sequences, and packet
  17  * lengths with training data to determine certain events
  18  * or actions for smart home devices.
  19  *
  20  * @author Janus Varmarken
  21  * @author Rahmadi Trimananda (rtrimana@uci.edu)
  22  * @version 0.1
  23  */
  24 public class Main {
  25
  26
  27     public static void main(String[] args) throws PcapNativeException, NotOpenException, EOFException, TimeoutException, UnknownHostException {
  28         // -------------------------------------------------------------------------------------------------------------
  29         // Example/debug code for searching for a pattern at the MAC layer.
  30 //        String fileName = "./pcap/mac-tplink.local.pcapng";
  31 //        PcapHandle handle;
  32 //        try {
  33 //            handle = Pcaps.openOffline(fileName, PcapHandle.TimestampPrecision.NANO);
  34 //        } catch (PcapNativeException pne) {
  35 //            handle = Pcaps.openOffline(fileName);
  36 //        }
  37 //        Arrays.asList(1590, 1590, 1590, 1001, 337, 197, 636, 1311, 177) // Full pattern (all non-zero payload packets).
  38 //        MacLayerFlowPattern pattern = new MacLayerFlowPattern("TP_LINK_LOCAL_OFF_MAC", "50:c7:bf:33:1f:09", Arrays.asList(637, 1312));
  39 //        MacLayerFlowPatternFinder finder = new MacLayerFlowPatternFinder(handle, pattern);
  40 //        finder.findFlowPattern();
  41         // -------------------------------------------------------------------------------------------------------------
  42 //
  43 //        //final String fileName = args.length > 0 ? args[0] : "/home/rtrimana/pcap_processing/smart_home_traffic/Code/Projects/SmartPlugDetector/pcap/wlan1.local.dns.pcap";
  44 //        final String fileName = args.length > 0 ? args[0] : "/scratch/June-2018/TPLink/wlan1/tplink.wlan1.local.pcap";
  45 //        //final String fileName = args.length > 0 ? args[0] : "/scratch/June-2018/DLink/wlan1/dlink.wlan1.local.pcap";
  46 //        final String trainingFileName = "./pcap/TP_LINK_LOCAL_ON_SUBSET.pcap";
  47 ////        final String trainingFileName = "./pcap/TP_LINK_LOCAL_ON.pcap";
  48 ////
  49 ////        // ====== Debug code ======
  50 //        PcapHandle handle;
  51 //        PcapHandle trainingPcap;
  52 //        try {
  53 //            handle = Pcaps.openOffline(fileName, PcapHandle.TimestampPrecision.NANO);
  54 //            trainingPcap = Pcaps.openOffline(trainingFileName, PcapHandle.TimestampPrecision.NANO);
  55 //        } catch (PcapNativeException pne) {
  56 //            handle = Pcaps.openOffline(fileName);
  57 //            trainingPcap = Pcaps.openOffline(trainingFileName);
  58 //        }
  59 ////
  60 ////        // TODO: The followings are the way to extract multiple hostnames and their associated packet lengths lists
  61 ////        //List<String> list = new ArrayList<>();
  62 ////        //list.add("events.tplinkra.com");
  63 ////        //FlowPattern fp = new FlowPattern("TP_LINK_LOCAL_ON", list, trainingPcap);
  64 ////        //List<String> list2 = new ArrayList<>();
  65 ////        //list2.add("devs.tplinkcloud.com");
  66 ////        //list2.add("events.tplinkra.com");
  67 ////        //FlowPattern fp3 = new FlowPattern("TP_LINK_REMOTE_ON", list2, trainingPcap);
  68 ////
  69 //        FlowPattern fp = new FlowPattern("TP_LINK_LOCAL_ON", "events.tplinkra.com", trainingPcap);
  70 //        //FlowPattern fp = new FlowPattern("DLINK_LOCAL_ON", "rfe-us-west-1.dch.dlink.com", trainingPcap);
  71 //        FlowPatternFinder fpf = new FlowPatternFinder(handle, fp);
  72 //        fpf.start();
  73 ////
  74 ////        // ========================
  75
  76         /*
  77         PcapReader pcapReader = new PcapReader(args[0]);
  78         PcapProcessingPipeline pipeline = new PcapProcessingPipeline(pcapReader);
  79         TcpReassembler tcpReassembler = new TcpReassembler();
  80         pipeline.addPcapPacketConsumer(tcpReassembler);
  81         pipeline.executePipeline();
  82         System.out.println("Pipeline terminated");
  83
  84         List<List<PcapPacketPair>> pairs = new ArrayList<>();
  85         for (Conversation c : tcpReassembler.getTcpConversations()) {
  86             pairs.add(TcpConversationUtils.extractPacketPairs(c));
  87         }
  88         */
  89
  90         // -------- 07-17-2018 --------
  91         // Only consider packets to/from the TP-Link plug.
  92         PcapReader pcapReader = new PcapReader(args[0], "ip host 192.168.1.159");
  93         TcpReassembler tcpReassembler = new TcpReassembler();
  94         PcapPacket packet;
  95         while((packet = pcapReader.readNextPacket()) != null) {
  96             tcpReassembler.consumePacket(packet);
  97         }
  98         // Now we have a set of reassembled TCP conversations.
  99         List<Conversation> conversations = tcpReassembler.getTcpConversations();
 100         for(Conversation c : conversations) {
 101             List<PcapPacketPair> pairs = TcpConversationUtils.extractPacketPairs(c);
 102             for (PcapPacketPair pair : pairs) {
 103                 // TODO ...
 104                 // 1. discard packets that are not within X seconds after trigger time
 105                 // 2. conversations may be (are) with different servers - so need to plot in different plots, one per hostname?
 106             }
 107         }
 108
 109         // ----------------------------
 110
 111
 112
 113
 114
 115     }
 116
 117 }
 118
 119
 120 // TP-Link MAC 50:c7:bf:33:1f:09 and usually IP 192.168.1.159 (remember to verify per file)