*/
private static boolean DUPLICATE_OUTPUT_TO_STD_OUT = true;
+ /**
+ * Router's MAC.
+ * This is only useful for the filter for direction when it is a WAN signature (Phone-Cloud or Device-Cloud).
+ * Phone-Device signatures do not have router MAC address in it.
+ */
+ // TODO: We can remove the following constants if we do remove router's MAC filtering for directions
+ private static String TRAINING_ROUTER_WLAN_MAC = null;
+ private static String ROUTER_WLAN_MAC = null;
+ //private static String TRAINING_ROUTER_WLAN_MAC = "b0:b9:8a:73:69:8e";
+ //private static String ROUTER_WLAN_MAC = "00:c1:b1:14:eb:31";
+
private static List<Function<Layer2Flow, Boolean>> parseSignatureMacFilters(String filtersString) {
List<Function<Layer2Flow, Boolean>> filters = new ArrayList<>();
String[] filterRegexes = filtersString.split(";");
public static void main(String[] args) throws PcapNativeException, NotOpenException, IOException {
// Parse required parameters.
- if (args.length < 10) {
+ if (args.length < 8) {
String errMsg = String.format("SPECTO version 1.0\n" +
"Copyright (C) 2018-2019 Janus Varmarken and Rahmadi Trimananda.\n" +
"University of California, Irvine.\n" +
"\n offSignatureFile: the file that contains the OFF signature to search for" +
"\n resultsFile: where to write the results of the detection" +
"\n signatureDuration: the maximum duration of signature detection" +
- "\n eps: the epsilon value for the DBSCAN algorithm" +
- "\n onMaxSkippedPackets: the maximum duration of ON signature detection (put -1 if not used)" +
- "\n offMaxSkippedPackets: the maximum duration of OFF signature detection (put -1 if not used)",
+ "\n eps: the epsilon value for the DBSCAN algorithm",
Layer2SignatureDetector.class.getSimpleName());
System.out.println(errMsg);
String optParamsExplained = "Above are the required, positional arguments. In addition to these, the " +
"that matches the vendor's prefix).\n" +
" '-offmacfilters <regex>;<regex>;...;<regex>' works exactly the same as onmacfilters, but " +
"applies to the OFF signature instead of the ON signature.\n" +
- " '-sout <boolean literal>' true/false literal indicating if output should also be printed to std out; default is true.";
+ " '-sout <boolean literal>' true/false literal indicating if output should also be printed to std out; default is true.\n" +
+ " '-vpn <router mac>' router's MAC address; this is to simulate a VPN that combines all flows even when the traffic is not a VPN traffic.\n" +
+ " '-onskipped <max duration of on-signature>' the maximum duration of ON signature detection.\n" +
+ " '-offskipped <max duration of off-signature>' the maximum duration of OFF signature detection.\n";
System.out.println(optParamsExplained);
return;
}
final String resultsFile = args[5];
final int signatureDuration = Integer.parseInt(args[6]);
final double eps = Double.parseDouble(args[7]);
- final int onMaxSkippedPackets = Integer.parseInt(args[8]);
- final int offMaxSkippedPackets = Integer.parseInt(args[9]);
// Parse optional parameters.
List<Function<Layer2Flow, Boolean>> onSignatureMacFilters = null, offSignatureMacFilters = null;
- final int optParamsStartIdx = 7;
+ String vpnClientMacAddress = null;
+ int onMaxSkippedPackets = -1;
+ int offMaxSkippedPackets = -1;
+ final int optParamsStartIdx = 8;
if (args.length > optParamsStartIdx) {
for (int i = optParamsStartIdx; i < args.length; i++) {
if (args[i].equalsIgnoreCase("-onMacFilters")) {
} else if (args[i].equalsIgnoreCase("-sout")) {
// Next argument is a boolean true/false literal.
DUPLICATE_OUTPUT_TO_STD_OUT = Boolean.parseBoolean(args[i+1]);
+ } else if (args[i].equalsIgnoreCase("-vpn")) {
+ vpnClientMacAddress = args[i+1];
+ } else if (args[i].equalsIgnoreCase("-onskipped")) {
+ if (i+2 > args.length - 1 || !args[i+2].equalsIgnoreCase("-offskipped")) {
+ throw new Error("Please make sure that the -onskipped and -offskipped options are both used at the same time...");
+ }
+ if (args[i+2].equalsIgnoreCase("-offskipped")) {
+ onMaxSkippedPackets = Integer.parseInt(args[i+1]);
+ offMaxSkippedPackets = Integer.parseInt(args[i+3]);
+ }
}
}
}
offSignature = PcapPacketUtils.useRangeBasedMatching(offSignature, offClusterAnalysis);
}
Layer2SignatureDetector onDetector = onSignatureMacFilters == null ?
- new Layer2SignatureDetector(onSignature, signatureDuration, isRangeBasedForOn, eps, onMaxSkippedPackets) :
- new Layer2SignatureDetector(onSignature, onSignatureMacFilters, signatureDuration,
- isRangeBasedForOn, eps, onMaxSkippedPackets);
+ new Layer2SignatureDetector(onSignature, TRAINING_ROUTER_WLAN_MAC, ROUTER_WLAN_MAC, signatureDuration,
+ isRangeBasedForOn, eps, onMaxSkippedPackets, vpnClientMacAddress) :
+ new Layer2SignatureDetector(onSignature, TRAINING_ROUTER_WLAN_MAC, ROUTER_WLAN_MAC,
+ onSignatureMacFilters, signatureDuration, isRangeBasedForOn, eps, onMaxSkippedPackets,
+ vpnClientMacAddress);
Layer2SignatureDetector offDetector = offSignatureMacFilters == null ?
- new Layer2SignatureDetector(offSignature, signatureDuration, isRangeBasedForOff, eps, offMaxSkippedPackets) :
- new Layer2SignatureDetector(offSignature, offSignatureMacFilters, signatureDuration,
- isRangeBasedForOff, eps, offMaxSkippedPackets);
+ new Layer2SignatureDetector(offSignature, TRAINING_ROUTER_WLAN_MAC, ROUTER_WLAN_MAC, signatureDuration,
+ isRangeBasedForOff, eps, offMaxSkippedPackets, vpnClientMacAddress) :
+ new Layer2SignatureDetector(offSignature, TRAINING_ROUTER_WLAN_MAC, ROUTER_WLAN_MAC, offSignatureMacFilters,
+ signatureDuration, isRangeBasedForOff, eps, offMaxSkippedPackets, vpnClientMacAddress);
final List<UserAction> detectedEvents = new ArrayList<>();
onDetector.addObserver((signature, match) -> {
UserAction event = new UserAction(UserAction.Type.TOGGLE_ON, match.get(0).get(0).getTimestamp());
Integer.toString(offDetector.getMaxSkippedPackets());
PrintWriterUtils.println(resultOn, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT);
PrintWriterUtils.println(resultOff, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT);
- PrintWriterUtils.println(onMaximumSkippedPackets, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT);
- // TODO: We do not use the feature for now because it is essentially the same as signature duration.
- //for(Integer skippedPackets : onDetector.getSkippedPackets()) {
- // PrintWriterUtils.println(skippedPackets, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT);
- //}
- PrintWriterUtils.println(offMaximumSkippedPackets, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT);
- //for(Integer skippedPackets : offDetector.getSkippedPackets()) {
- // PrintWriterUtils.println(skippedPackets, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT);
- //}
+ // Perform the skipped packet analysis if needed
+ if (onMaxSkippedPackets != -1 && offMaxSkippedPackets != -1) {
+ PrintWriterUtils.println(onMaximumSkippedPackets, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT);
+ for (Integer skippedPackets : onDetector.getSkippedPackets()) {
+ PrintWriterUtils.println(skippedPackets, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT);
+ }
+ PrintWriterUtils.println(offMaximumSkippedPackets, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT);
+ for (Integer skippedPackets : offDetector.getSkippedPackets()) {
+ PrintWriterUtils.println(skippedPackets, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT);
+ }
+ }
// Flush output to results file and close it.
resultsWriter.flush();
resultsWriter.close();
/**
* In charge of reassembling layer 2 packet flows.
*/
- private final Layer2FlowReassembler mFlowReassembler = new Layer2FlowReassembler();
+ private Layer2FlowReassembler mFlowReassembler;
private final List<SignatureDetectorObserver> mObservers = new ArrayList<>();
private int mMaxSkippedPackets;
private List<Integer> mSkippedPackets;
- public Layer2SignatureDetector(List<List<List<PcapPacket>>> searchedSignature, int signatureDuration,
- boolean isRangeBased, double eps, int limitSkippedPackets) {
- this(searchedSignature, null, signatureDuration, isRangeBased, eps, limitSkippedPackets);
+
+
+ public Layer2SignatureDetector(List<List<List<PcapPacket>>> searchedSignature, String trainingRouterWlanMac,
+ String routerWlanMac, int signatureDuration, boolean isRangeBased, double eps,
+ int limitSkippedPackets, String vpnClientMacAddress) {
+ this(searchedSignature, trainingRouterWlanMac, routerWlanMac, null, signatureDuration, isRangeBased,
+ eps, limitSkippedPackets, vpnClientMacAddress);
}
- public Layer2SignatureDetector(List<List<List<PcapPacket>>> searchedSignature, List<Function<Layer2Flow,
- Boolean>> flowFilters, int inclusionTimeMillis, boolean isRangeBased, double eps, int limitSkippedPackets) {
+ public Layer2SignatureDetector(List<List<List<PcapPacket>>> searchedSignature, String trainingRouterWlanMac,
+ String routerWlanMac, List<Function<Layer2Flow, Boolean>> flowFilters,
+ int inclusionTimeMillis, boolean isRangeBased, double eps, int limitSkippedPackets,
+ String vpnClientMacAddress) {
if (flowFilters != null && flowFilters.size() != searchedSignature.size()) {
throw new IllegalArgumentException("If flow filters are used, there must be a flow filter for each cluster " +
"of the signature.");
for (int i = 0; i < mSignature.size(); i++) {
List<List<PcapPacket>> cluster = mSignature.get(i);
Layer2ClusterMatcher clusterMatcher = flowFilters == null ?
- new Layer2ClusterMatcher(cluster, inclusionTimeMillis, isRangeBased, eps, limitSkippedPackets) :
- new Layer2ClusterMatcher(cluster, flowFilters.get(i), inclusionTimeMillis, isRangeBased,
- eps, limitSkippedPackets);
+ new Layer2ClusterMatcher(cluster, trainingRouterWlanMac, routerWlanMac, inclusionTimeMillis,
+ isRangeBased, eps, limitSkippedPackets) :
+ new Layer2ClusterMatcher(cluster, trainingRouterWlanMac, routerWlanMac, flowFilters.get(i),
+ inclusionTimeMillis, isRangeBased, eps, limitSkippedPackets);
clusterMatcher.addObserver(this);
clusterMatchers.add(clusterMatcher);
}
}
mClusterMatcherIds = Collections.unmodifiableMap(clusterMatcherIds);
// Register all cluster matchers to receive a notification whenever a new flow is encountered.
+ if (vpnClientMacAddress != null) {
+ mFlowReassembler = new Layer2FlowReassembler(vpnClientMacAddress);
+ } else {
+ mFlowReassembler = new Layer2FlowReassembler();
+ }
mClusterMatchers.forEach(cm -> mFlowReassembler.addObserver(cm));
mInclusionTimeMillis =
inclusionTimeMillis == 0 ? TriggerTrafficExtractor.INCLUSION_WINDOW_MILLIS : inclusionTimeMillis;
projects / pingpong.git / blobdiff