Adding skipped packets analysis.
[pingpong.git] / Code / Projects / PacketLevelSignatureExtractor / src / main / java / edu / uci / iotproject / detection / layer3 / Layer3SignatureDetector.java
index 92d2bd9..dbd9046 100644 (file)
@@ -46,15 +46,20 @@ public class Layer3SignatureDetector implements PacketListener, ClusterMatcherOb
     private static String ROUTER_WAN_IP = "128.195.205.105";
 
     public static void main(String[] args) throws PcapNativeException, NotOpenException, IOException {
-        if (args.length < 7) {
-            String errMsg = String.format("Usage: %s inputPcapFile onAnalysisFile offAnalysisFile onSignatureFile offSignatureFile resultsFile" +
+        if (args.length < 8) {
+            String errMsg = String.format("SPECTO version 1.0\n" +
+                            "Copyright (C) 2018-2019 Janus Varmarken and Rahmadi Trimananda.\n" +
+                            "University of California, Irvine.\n" +
+                            "All rights reserved.\n\n" +
+                            "Usage: %s inputPcapFile onAnalysisFile offAnalysisFile onSignatureFile offSignatureFile resultsFile" +
                             "\n  inputPcapFile: the target of the detection" +
                             "\n  onAnalysisFile: the file that contains the ON clusters analysis" +
                             "\n  offAnalysisFile: the file that contains the OFF clusters analysis" +
                             "\n  onSignatureFile: the file that contains the ON signature to search for" +
                             "\n  offSignatureFile: the file that contains the OFF signature to search for" +
                             "\n  resultsFile: where to write the results of the detection" +
-                            "\n  signatureDuration: the maximum duration of signature detection",
+                            "\n  signatureDuration: the maximum duration of signature detection" +
+                            "\n  epsilon: the epsilon value for the DBSCAN algorithm",
                     Layer3SignatureDetector.class.getSimpleName());
             System.out.println(errMsg);
             return;
@@ -65,7 +70,12 @@ public class Layer3SignatureDetector implements PacketListener, ClusterMatcherOb
         final String onSignatureFile = args[3];
         final String offSignatureFile = args[4];
         final String resultsFile = args[5];
-        final int signatureDuration = Integer.parseInt(args[6]);
+        // TODO: THIS IS TEMPORARILY SET TO DEFAULT SIGNATURE DURATION
+        // TODO: WE DO NOT WANT TO BE TOO STRICT AT THIS POINT SINCE LAYER 3 ALREADY APPLIES BACK-TO-BACK REQUIREMENT
+        // TODO: FOR PACKETS IN A SIGNATURE
+//        final int signatureDuration = Integer.parseInt(args[6]);
+        final int signatureDuration = TriggerTrafficExtractor.INCLUSION_WINDOW_MILLIS;
+        final double eps = Double.parseDouble(args[7]);
 
         // Prepare file outputter.
         File outputFile = new File(resultsFile);
@@ -80,9 +90,6 @@ public class Layer3SignatureDetector implements PacketListener, ClusterMatcherOb
         PrintWriterUtils.println("# - offSignatureFile: " + offSignatureFile, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT);
         resultsWriter.flush();
 
-        // Specify epsilon
-        // TODO: This would be specified through command line option
-        double eps = 10.0;
         // Load signatures
         List<List<List<PcapPacket>>> onSignature = PrintUtils.deserializeFromFile(onSignatureFile);
         List<List<List<PcapPacket>>> offSignature = PrintUtils.deserializeFromFile(offSignatureFile);
@@ -97,11 +104,12 @@ public class Layer3SignatureDetector implements PacketListener, ClusterMatcherOb
         boolean isRangeBasedForOn = PcapPacketUtils.isRangeBasedMatching(onSignature, eps, offSignature);
         boolean isRangeBasedForOff = PcapPacketUtils.isRangeBasedMatching(offSignature, eps, onSignature);
         // Update the signature with ranges if it is range-based
-        if (isRangeBasedForOn && isRangeBasedForOff) {
+        if (isRangeBasedForOn) {
             onSignature = PcapPacketUtils.useRangeBasedMatching(onSignature, onClusterAnalysis);
+        }
+        if (isRangeBasedForOff) {
             offSignature = PcapPacketUtils.useRangeBasedMatching(offSignature, offClusterAnalysis);
         }
-
         // WAN
         Layer3SignatureDetector onDetector = new Layer3SignatureDetector(onSignature, ROUTER_WAN_IP,
                 signatureDuration, isRangeBasedForOn, eps);
@@ -128,6 +136,7 @@ public class Layer3SignatureDetector implements PacketListener, ClusterMatcherOb
             // String output = String.format("%s",
             // dateTimeFormatter.format(ua.getTimestamp()));
             // System.out.println(output);
+            PrintWriterUtils.println(ua, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT);
         };
 
         // Let's create observers that construct a UserAction representing the detected event.
@@ -135,13 +144,12 @@ public class Layer3SignatureDetector implements PacketListener, ClusterMatcherOb
         onDetector.addObserver((searched, match) -> {
             PcapPacket firstPkt = match.get(0).get(0);
             UserAction event = new UserAction(UserAction.Type.TOGGLE_ON, firstPkt.getTimestamp());
-            PrintWriterUtils.println(event, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT);
             detectedEvents.add(event);
         });
         offDetector.addObserver((searched, match) -> {
             PcapPacket firstPkt = match.get(0).get(0);
             UserAction event = new UserAction(UserAction.Type.TOGGLE_OFF, firstPkt.getTimestamp());
-            PrintWriterUtils.println(event, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT);
+            //PrintWriterUtils.println(event, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT);
             detectedEvents.add(event);
         });
 
@@ -155,11 +163,14 @@ public class Layer3SignatureDetector implements PacketListener, ClusterMatcherOb
         reader.readFromHandle();
 
         // TODO: need a better way of triggering detection than this...
-        if (isRangeBasedForOn && isRangeBasedForOff) {
+        if (isRangeBasedForOn) {
             onDetector.mClusterMatchers.forEach(cm -> cm.performDetectionRangeBased());
-            offDetector.mClusterMatchers.forEach(cm -> cm.performDetectionRangeBased());
         } else {
             onDetector.mClusterMatchers.forEach(cm -> cm.performDetectionConservative());
+        }
+        if (isRangeBasedForOff) {
+            offDetector.mClusterMatchers.forEach(cm -> cm.performDetectionRangeBased());
+        } else {
             offDetector.mClusterMatchers.forEach(cm -> cm.performDetectionConservative());
         }
 
@@ -170,15 +181,12 @@ public class Layer3SignatureDetector implements PacketListener, ClusterMatcherOb
         // Output the detected events
         detectedEvents.forEach(outputter);
 
-        String resultOn = "Number of detected events of type " + UserAction.Type.TOGGLE_ON + ": " +
+        String resultOn = "Number of detected events of type " + UserAction.Type.TOGGLE_ON + ": " +
                 detectedEvents.stream().filter(ua -> ua.getType() == UserAction.Type.TOGGLE_ON).count();
-        String resultOff = "Number of detected events of type " + UserAction.Type.TOGGLE_OFF + ": " +
+        String resultOff = "Number of detected events of type " + UserAction.Type.TOGGLE_OFF + ": " +
                 detectedEvents.stream().filter(ua -> ua.getType() == UserAction.Type.TOGGLE_OFF).count();
         PrintWriterUtils.println(resultOn, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT);
         PrintWriterUtils.println(resultOff, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT);
-        System.out.println(resultOn);
-        System.out.println(resultOff);
-
 
         // Flush output to results file and close it.
         resultsWriter.flush();
@@ -248,7 +256,8 @@ public class Layer3SignatureDetector implements PacketListener, ClusterMatcherOb
         // Generate corresponding/appropriate ClusterMatchers based on the provided signature
         List<Layer3ClusterMatcher> clusterMatchers = new ArrayList<>();
         for (List<List<PcapPacket>> cluster : mSignature) {
-            clusterMatchers.add(new Layer3ClusterMatcher(cluster, routerWanIp, isRangeBased, eps, this));
+            clusterMatchers.add(new Layer3ClusterMatcher(cluster, routerWanIp, inclusionTimeMillis,
+                    isRangeBased, eps, this));
         }
         mClusterMatchers = Collections.unmodifiableList(clusterMatchers);
 
@@ -281,7 +290,7 @@ public class Layer3SignatureDetector implements PacketListener, ClusterMatcherOb
     }
 
     @Override
-    public void onMatch(AbstractClusterMatcher clusterMatcher, List<PcapPacket> match) {
+    public void onMatch(AbstractClusterMatcher clusterMatcher, List<PcapPacket> match, int maxSkippedPackets) {
         // Add the match at the corresponding index
         pendingMatches[mClusterMatcherIds.get(clusterMatcher)].add(match);
         checkSignatureMatch();