Code/Projects/SmartPlugDetector/src/main/java/edu/uci/iotproject/Main.java

   1 package edu.uci.iotproject;
   2
   3 import edu.uci.iotproject.analysis.PcapPacketPair;
   4 import edu.uci.iotproject.analysis.TcpConversationUtils;
   5 import edu.uci.iotproject.analysis.TriggerTrafficExtractor;
   6 import edu.uci.iotproject.io.TriggerTimesFileReader;
   7 import org.pcap4j.core.*;
   8 import org.pcap4j.packet.IpV4Packet;
   9 import org.pcap4j.packet.namednumber.DataLinkType;
  10
  11 import java.io.EOFException;
  12 import java.net.UnknownHostException;
  13 import java.time.Instant;
  14 import java.util.*;
  15 import java.util.concurrent.TimeoutException;
  16
  17 /**
  18  * This is a system that reads PCAP files to compare
  19  * patterns of DNS hostnames, packet sequences, and packet
  20  * lengths with training data to determine certain events
  21  * or actions for smart home devices.
  22  *
  23  * @author Janus Varmarken
  24  * @author Rahmadi Trimananda (rtrimana@uci.edu)
  25  * @version 0.1
  26  */
  27 public class Main {
  28
  29
  30     public static void main(String[] args) throws PcapNativeException, NotOpenException, EOFException, TimeoutException, UnknownHostException {
  31         // -------------------------------------------------------------------------------------------------------------
  32         // Example/debug code for searching for a pattern at the MAC layer.
  33 //        String fileName = "./pcap/mac-tplink.local.pcapng";
  34 //        PcapHandle handle;
  35 //        try {
  36 //            handle = Pcaps.openOffline(fileName, PcapHandle.TimestampPrecision.NANO);
  37 //        } catch (PcapNativeException pne) {
  38 //            handle = Pcaps.openOffline(fileName);
  39 //        }
  40 //        Arrays.asList(1590, 1590, 1590, 1001, 337, 197, 636, 1311, 177) // Full pattern (all non-zero payload packets).
  41 //        MacLayerFlowPattern pattern = new MacLayerFlowPattern("TP_LINK_LOCAL_OFF_MAC", "50:c7:bf:33:1f:09", Arrays.asList(637, 1312));
  42 //        MacLayerFlowPatternFinder finder = new MacLayerFlowPatternFinder(handle, pattern);
  43 //        finder.findFlowPattern();
  44         // -------------------------------------------------------------------------------------------------------------
  45 //
  46 //        //final String fileName = args.length > 0 ? args[0] : "/home/rtrimana/pcap_processing/smart_home_traffic/Code/Projects/SmartPlugDetector/pcap/wlan1.local.dns.pcap";
  47 //        final String fileName = args.length > 0 ? args[0] : "/scratch/June-2018/TPLink/wlan1/tplink.wlan1.local.pcap";
  48 //        //final String fileName = args.length > 0 ? args[0] : "/scratch/June-2018/DLink/wlan1/dlink.wlan1.local.pcap";
  49 //        final String trainingFileName = "./pcap/TP_LINK_LOCAL_ON_SUBSET.pcap";
  50 ////        final String trainingFileName = "./pcap/TP_LINK_LOCAL_ON.pcap";
  51 ////
  52 ////        // ====== Debug code ======
  53 //        PcapHandle handle;
  54 //        PcapHandle trainingPcap;
  55 //        try {
  56 //            handle = Pcaps.openOffline(fileName, PcapHandle.TimestampPrecision.NANO);
  57 //            trainingPcap = Pcaps.openOffline(trainingFileName, PcapHandle.TimestampPrecision.NANO);
  58 //        } catch (PcapNativeException pne) {
  59 //            handle = Pcaps.openOffline(fileName);
  60 //            trainingPcap = Pcaps.openOffline(trainingFileName);
  61 //        }
  62 ////
  63 ////        // TODO: The followings are the way to extract multiple hostnames and their associated packet lengths lists
  64 ////        //List<String> list = new ArrayList<>();
  65 ////        //list.add("events.tplinkra.com");
  66 ////        //FlowPattern fp = new FlowPattern("TP_LINK_LOCAL_ON", list, trainingPcap);
  67 ////        //List<String> list2 = new ArrayList<>();
  68 ////        //list2.add("devs.tplinkcloud.com");
  69 ////        //list2.add("events.tplinkra.com");
  70 ////        //FlowPattern fp3 = new FlowPattern("TP_LINK_REMOTE_ON", list2, trainingPcap);
  71 ////
  72 //        FlowPattern fp = new FlowPattern("TP_LINK_LOCAL_ON", "events.tplinkra.com", trainingPcap);
  73 //        //FlowPattern fp = new FlowPattern("DLINK_LOCAL_ON", "rfe-us-west-1.dch.dlink.com", trainingPcap);
  74 //        FlowPatternFinder fpf = new FlowPatternFinder(handle, fp);
  75 //        fpf.start();
  76 ////
  77 ////        // ========================
  78
  79         /*
  80         PcapReader pcapReader = new PcapReader(args[0]);
  81         PcapProcessingPipeline pipeline = new PcapProcessingPipeline(pcapReader);
  82         TcpReassembler tcpReassembler = new TcpReassembler();
  83         pipeline.addPcapPacketConsumer(tcpReassembler);
  84         pipeline.executePipeline();
  85         System.out.println("Pipeline terminated");
  86
  87         List<List<PcapPacketPair>> pairs = new ArrayList<>();
  88         for (Conversation c : tcpReassembler.getTcpConversations()) {
  89             pairs.add(TcpConversationUtils.extractPacketPairs(c));
  90         }
  91         */
  92
  93         /*
  94         // -------- 07-17-2018 --------
  95         // Only consider packets to/from the TP-Link plug.
  96         PcapReader pcapReader = new PcapReader(args[0], "ip host 192.168.1.159");
  97         TcpReassembler tcpReassembler = new TcpReassembler();
  98         PcapPacket packet;
  99         while((packet = pcapReader.readNextPacket()) != null) {
 100             tcpReassembler.consumePacket(packet);
 101         }
 102         // Now we have a set of reassembled TCP conversations.
 103         List<Conversation> conversations = tcpReassembler.getTcpConversations();
 104         for(Conversation c : conversations) {
 105             List<PcapPacketPair> pairs = TcpConversationUtils.extractPacketPairs(c);
 106             for (PcapPacketPair pair : pairs) {
 107                 // TODO ...
 108                 // 1. discard packets that are not within X seconds after trigger time
 109                 // 2. conversations may be (are) with different servers - so need to plot in different plots, one per hostname?
 110             }
 111         }
 112
 113         // ----------------------------
 114         */
 115
 116         // -------- 07-19-2018 --------
 117         TriggerTimesFileReader ttfr = new TriggerTimesFileReader();
 118 //        List<Instant> triggerTimes = ttfr.readTriggerTimes("/Users/varmarken/Downloads/tplink-feb-13-2018.timestamps", false);
 119         List<Instant> triggerTimes = ttfr.readTriggerTimes("/Users/varmarken/temp/UCI IoT Project/June2018 experiments/tplink/tplink-june-14-2018-timestamps.txt", false);
 120 //        String pcapFile = "/Users/varmarken/Development/Repositories/UCI/NetworkingGroup/smart_home_traffic/Code/Projects/SmartPlugDetector/pcap/wlan1.local.dns.pcap";
 121         String pcapFile = "/Users/varmarken/temp/UCI IoT Project/June2018 experiments/tplink/tplink.wlan1.local.pcap";
 122         String tpLinkPlugIp = "192.168.1.159";
 123         TriggerTrafficExtractor tte = new TriggerTrafficExtractor(pcapFile, triggerTimes, tpLinkPlugIp);
 124 //        final PcapDumper outputter = Pcaps.openDead(DataLinkType.EN10MB, 65536).dumpOpen("/Users/varmarken/temp/traces/output/tplink-filtered.pcap");
 125         final PcapDumper outputter = Pcaps.openDead(DataLinkType.EN10MB, 65536).dumpOpen("/Users/varmarken/temp/UCI IoT Project/June2018 experiments/tplink/tplink-filtered.pcap");
 126         DnsMap dnsMap = new DnsMap();
 127         TcpReassembler tcpReassembler = new TcpReassembler();
 128         tte.performExtraction(pkt -> {
 129             try {
 130                 outputter.dump(pkt);
 131             } catch (NotOpenException e) {
 132                 e.printStackTrace();
 133             }
 134         }, dnsMap, tcpReassembler);
 135         outputter.flush();
 136         outputter.close();
 137
 138         /*
 139         int packets = 0;
 140         for (Conversation c : tcpReassembler.getTcpConversations()) {
 141             packets += c.getPackets().size();
 142             packets += c.getSynPackets().size();
 143             // only count the FIN packets, not the ACKs; every FinAckPair holds a FIN packet
 144             packets += c.getFinAckPairs().size();
 145         }
 146         // Produces 271 packets for the Feb 13 experiment
 147         // Applying filter: "(tcp and not tcp.len == 0 and not tcp.analysis.retransmission and not tcp.analysis.fast_retransmission)  or (tcp.flags.syn == 1) or (tcp.flags.fin == 1)"
 148         // to the file gives 295 packets, but there are 24 TCP-Out-Of-Order SYN/SYNACKs which are filtered as retransmissions in Conversation, so the numbers seem to match.
 149         System.out.println("number of packets: " + packets);
 150         */
 151
 152         List<List<PcapPacketPair>> pairs = new ArrayList<>();
 153         for (Conversation c : tcpReassembler.getTcpConversations()) {
 154             pairs.add(TcpConversationUtils.extractPacketPairs(c));
 155         }
 156         /*
 157         // Sort pairs according to timestamp of first packet of conversation for (debugging) convenience.
 158         Collections.sort(pairs, (l1, l2) -> {
 159             if (l1.get(0).getFirst().getTimestamp().isBefore(l2.get(0).getFirst().getTimestamp())) return -1;
 160             else if (l2.get(0).getFirst().getTimestamp().isBefore(l1.get(0).getFirst().getTimestamp())) return 1;
 161             else return 0;
 162         });
 163         */
 164         System.out.println("list of pairs produced");
 165         List<PcapPacketPair> eventstplinkraPairs = new ArrayList<>();
 166         List<List<PcapPacketPair>> otherPairs = new ArrayList<>();
 167         String hostname = "events.tplinkra.com";
 168         int emptyLists = 0;
 169         for (List<PcapPacketPair> lppp : pairs) {
 170             if (lppp.size() < 1) {
 171                 emptyLists++;
 172                 continue;
 173             }
 174             IpV4Packet ipPacket = lppp.get(0).getFirst().get(IpV4Packet.class);
 175             // If packets are associated with the hostname
 176             if (dnsMap.isRelatedToCloudServer(ipPacket.getHeader().getSrcAddr().getHostAddress(), hostname) ||
 177                     dnsMap.isRelatedToCloudServer(ipPacket.getHeader().getDstAddr().getHostAddress(), hostname)) {
 178                 eventstplinkraPairs.addAll(lppp);
 179             } else {
 180                 // Pairs associated with different server
 181                 otherPairs.add(lppp);
 182             }
 183         }
 184         System.out.println("number of empty list of packet pairs: " + emptyLists);
 185         HashMap<String, Integer> pairCount = new HashMap<>();
 186         for (PcapPacketPair ppp : eventstplinkraPairs) {
 187             if (pairCount.containsKey(ppp.toString())) {
 188                 pairCount.put(ppp.toString(), pairCount.get(ppp.toString()) + 1);
 189             } else {
 190                 pairCount.put(ppp.toString(), 1);
 191             }
 192         }
 193         System.out.println("pairCount map built");
 194
 195         // Build map containing frequencies of packet lengths exchanged with events.tplinkra.com as well as a map with
 196         // the frequencies of specific sequences of packet lengths for the same hostname
 197         HashMap<Integer, Integer> eventstplinkraPacketLengthFreqMap = new HashMap<>();
 198         HashMap<String, Integer> eventstplinkraPacketSequenceFreqMap = new HashMap<>();
 199         for (Conversation c : tcpReassembler.getTcpConversations()) {
 200             if (c.getPackets().size() == 0) {
 201                 continue;
 202             }
 203             PcapPacket firstPacket = c.getPackets().get(0);
 204             IpV4Packet firstPacketIp = firstPacket.get(IpV4Packet.class);
 205             if (!dnsMap.isRelatedToCloudServer(firstPacketIp.getHeader().getSrcAddr().getHostAddress(), hostname) &&
 206                     !dnsMap.isRelatedToCloudServer(firstPacketIp.getHeader().getDstAddr().getHostAddress(), hostname)) {
 207                 continue;
 208             }
 209             // Update the packet length freq map
 210             for (PcapPacket pp : c.getPackets()) {
 211                 eventstplinkraPacketLengthFreqMap.merge(pp.length(), 1, (i1, i2) -> i1 + i2);
 212             }
 213             // Update the packet sequence freq map
 214             StringBuilder sb = new StringBuilder();
 215             for (PcapPacket pp : c.getPackets()) {
 216                 sb.append(pp.length() + " ");
 217             }
 218             eventstplinkraPacketSequenceFreqMap.merge(sb.toString(), 1, (i1, i2) -> i1+i2);
 219         }
 220         System.out.println("packet length frequency map created");
 221
 222         Map<String, List<Conversation>> hostnameConversationMap =
 223                 TcpConversationUtils.groupConversationsByHostname(tcpReassembler.getTcpConversations(), dnsMap);
 224         System.out.println("hostnameConversationMap created");
 225         // ----------------------------
 226     }
 227
 228 }
 229
 230
 231 // TP-Link MAC 50:c7:bf:33:1f:09 and usually IP 192.168.1.159 (remember to verify per file)