--- /dev/null
+#!/usr/bin/python
+
+"""
+Script that constructs a graph in which hosts are nodes.
+An edge between two hosts indicate that the hosts communicate.
+Hosts are labeled and identified by their IPs.
+The graph is written to a file in Graph Exchange XML format for later import and visual inspection in Gephi.
+
+The input to this script is the JSON output by extract_from_tshark.py by Anastasia Shuba.
+
+This script is a simplification of Milad Asgari's parser_data_to_gephi.py script.
+It serves as a baseline for future scripts that want to include more information in the graph.
+"""
+
+import socket
+import json
+import tldextract
+import networkx as nx
+import sys
+from decimal import *
+
+import parse_dns
+
+JSON_KEY_ETH_SRC = "eth.src"
+JSON_KEY_ETH_DST = "eth.dst"
+
+def parse_json(file_path):
+
+ device_dns_mappings = parse_dns.parse_json_dns("./dns.json")
+
+ # Init empty graph
+ G = nx.DiGraph()
+ with open(file_path) as jf:
+ # Read JSON.
+ # data becomes reference to root JSON object (or in our case json array)
+ data = json.load(jf)
+ # Loop through json objects in data
+ for k in data:
+ # Fetch timestamp of packet
+ packet_timestamp = Decimal(data[k]["ts"])
+ # Fetch eth source and destination info
+ eth_src = data[k][JSON_KEY_ETH_SRC]
+ eth_dst = data[k][JSON_KEY_ETH_DST]
+ # Traffic can be both outbound and inbound.
+ # Determine which one of the two by looking up device MAC in DNS map.
+ iot_device = None
+ if eth_src in device_dns_mappings:
+ iot_device = eth_src
+ elif eth_dst in device_dns_mappings:
+ iot_device = eth_dst
+ else:
+ print "[ WARNING: DNS mapping not found for device with MAC", eth_src, "OR", eth_dst, "]"
+ # This must be local communication between two IoT devices OR an IoT device talking to a hardcoded IP.
+ # For now let's assume local communication.
+ # Add a node for each device and an edge between them.
+ G.add_node(eth_src)
+ G.add_node(eth_dst)
+ G.add_edge(eth_src, eth_dst)
+ # TODO add regex check on src+dst IP to figure out if hardcoded server IP (e.g. check if one of the two are NOT a 192.168.x.y IP)
+ continue
+ # It is outbound traffic if iot_device matches src, otherwise it must be inbound traffic.
+ outbound_traffic = iot_device == eth_src
+
+ ''' Graph construction '''
+ # No need to check if the Nodes and/or Edges we add already exist:
+ # NetworkX won't add already existing nodes/edges (except in the case of a MultiGraph or MultiDiGraph (see NetworkX doc)).
+
+ # Add a node for each host.
+ # First add node for IoT device.
+ G.add_node(iot_device)
+ # Then add node for the server.
+ # For this we need to distinguish between outbound and inbound traffic so that we look up the proper IP in our DNS map.
+ # For outbound traffic, the server's IP is the destination IP.
+ # For inbound traffic, the server's IP is the source IP.
+ server_ip = data[k]["dst_ip"] if outbound_traffic else data[k]["src_ip"]
+ hostname = device_dns_mappings[iot_device].hostname_for_ip_at_time(server_ip, packet_timestamp)
+ if hostname is None:
+ # TODO this can occur when two local devices communicate OR if IoT device has hardcoded server IP.
+ # However, we only get here for the DNS that have not performed any DNS lookups
+ # We should use a regex check early in the loop to see if it is two local devices communicating.
+ # This way we would not have to consider these corner cases later on.
+ print "[ WARNING: no ip-hostname mapping found for ip", server_ip, " -- adding eth.src->eth.dst edge, but note that this may be incorrect if IoT device has hardcoded server IP ]"
+ G.add_node(eth_src)
+ G.add_node(eth_dst)
+ G.add_edge(eth_src, eth_dst)
+ continue
+ G.add_node(hostname)
+ # Connect the two nodes we just added.
+ if outbound_traffic:
+ G.add_edge(iot_device, hostname)
+ else:
+ G.add_edge(hostname, iot_device)
+ return G
+
+# ------------------------------------------------------
+# Not currently used.
+# Might be useful later on if we wish to resolve IPs.
+def get_domain(host):
+ ext_result = tldextract.extract(str(host))
+ # Be consistent with ReCon and keep suffix
+ domain = ext_result.domain + "." + ext_result.suffix
+ return domain
+
+def is_IP(addr):
+ try:
+ socket.inet_aton(addr)
+ return True
+ except socket.error:
+ return False
+# ------------------------------------------------------
+
+if __name__ == '__main__':
+ if len(sys.argv) < 3:
+ print "Usage:", sys.argv[0], "input_file output_file"
+ print "outfile_file should end in .gexf"
+ sys.exit(0)
+ # Input file: Path to JSON file generated from tshark JSON output using Anastasia's script (extract_from_tshark.py).
+ input_file = sys.argv[1]
+ print "[ input_file =", input_file, "]"
+ # Output file: Path to file where the Gephi XML should be written.
+ output_file = sys.argv[2]
+ print "[ output_file =", output_file, "]"
+ # Construct graph from JSON
+ G = parse_json(input_file)
+ # Write Graph in Graph Exchange XML format
+ nx.write_gexf(G, output_file)
projects / pingpong.git / blobdiff