X-Git-Url: http://plrg.eecs.uci.edu/git/?p=pingpong.git;a=blobdiff_plain;f=Code%2FProjects%2FPacketLevelSignatureExtractor%2Fsrc%2Fmain%2Fjava%2Fedu%2Fuci%2Fiotproject%2Fdetection%2Flayer2%2FLayer2SignatureDetector.java;h=56a26adf772a99471358ef1d7095ca41901dcf96;hp=5e9d8a053a2f2c07016cd9d27a43b47fc9f59e00;hb=33767921e02b61ea33d70f747ec5753bf63f4539;hpb=321d6c31113ec547c99d782a06635969d773232c diff --git a/Code/Projects/PacketLevelSignatureExtractor/src/main/java/edu/uci/iotproject/detection/layer2/Layer2SignatureDetector.java b/Code/Projects/PacketLevelSignatureExtractor/src/main/java/edu/uci/iotproject/detection/layer2/Layer2SignatureDetector.java index 5e9d8a0..56a26ad 100644 --- a/Code/Projects/PacketLevelSignatureExtractor/src/main/java/edu/uci/iotproject/detection/layer2/Layer2SignatureDetector.java +++ b/Code/Projects/PacketLevelSignatureExtractor/src/main/java/edu/uci/iotproject/detection/layer2/Layer2SignatureDetector.java @@ -62,38 +62,43 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb } public static void main(String[] args) throws PcapNativeException, NotOpenException, IOException { + String errMsg = String.format("SPECTO version 1.0\n" + + "Copyright (C) 2018-2019 Janus Varmarken and Rahmadi Trimananda.\n" + + "University of California, Irvine.\n" + + "All rights reserved.\n\n" + + "Usage: %s inputPcapFile onAnalysisFile offAnalysisFile onSignatureFile offSignatureFile " + + "resultsFile signatureDuration eps onMaxSkippedPackets offMaxSkippedPackets" + + "\n inputPcapFile: the target of the detection" + + "\n onAnalysisFile: the file that contains the ON clusters analysis" + + "\n offAnalysisFile: the file that contains the OFF clusters analysis" + + "\n onSignatureFile: the file that contains the ON signature to search for" + + "\n offSignatureFile: the file that contains the OFF signature to search for" + + "\n resultsFile: where to write the results of the detection" + + "\n signatureDuration: the maximum duration of signature detection" + + "\n epsilon: the epsilon value for the DBSCAN algorithm\n" + + "\n Additional options (add '-r' before the following two parameters):" + + "\n delta: delta for relaxed matching" + + "\n packetId: packet number in the sequence" + + "\n (could be more than one packet whose matching is relaxed, " + + "\n e.g., 0,1 for packets 0 and 1)", + Layer2SignatureDetector.class.getSimpleName()); + String optParamsExplained = "Above are the required, positional arguments. In addition to these, the " + + "following options and associated positional arguments may be used:\n" + + " '-onmacfilters ;;...;' which specifies that sequence matching should ONLY" + + " be performed on flows where the MAC of one of the two endpoints matches the given regex. Note " + + "that you MUST specify a regex for each cluster of the signature. This is to facilitate more " + + "aggressive filtering on parts of the signature (e.g., the communication that involves the " + + "smart home device itself as one can drop all flows that do not include an endpoint with a MAC " + + "that matches the vendor's prefix).\n" + + " '-offmacfilters ;;...;' works exactly the same as onmacfilters, but " + + "applies to the OFF signature instead of the ON signature.\n" + + " '-sout ' true/false literal indicating if output should also be printed to std out; default is true.\n" + + " '-vpn ' router's MAC address; this is to simulate a VPN that combines all flows even when the traffic is not a VPN traffic.\n" + + " '-onskipped ' the maximum duration of ON signature detection.\n" + + " '-offskipped ' the maximum duration of OFF signature detection.\n"; // Parse required parameters. if (args.length < 8) { - String errMsg = String.format("SPECTO version 1.0\n" + - "Copyright (C) 2018-2019 Janus Varmarken and Rahmadi Trimananda.\n" + - "University of California, Irvine.\n" + - "All rights reserved.\n\n" + - "Usage: %s inputPcapFile onAnalysisFile offAnalysisFile onSignatureFile offSignatureFile " + - "resultsFile signatureDuration eps onMaxSkippedPackets offMaxSkippedPackets" + - "\n inputPcapFile: the target of the detection" + - "\n onAnalysisFile: the file that contains the ON clusters analysis" + - "\n offAnalysisFile: the file that contains the OFF clusters analysis" + - "\n onSignatureFile: the file that contains the ON signature to search for" + - "\n offSignatureFile: the file that contains the OFF signature to search for" + - "\n resultsFile: where to write the results of the detection" + - "\n signatureDuration: the maximum duration of signature detection" + - "\n eps: the epsilon value for the DBSCAN algorithm", - Layer2SignatureDetector.class.getSimpleName()); System.out.println(errMsg); - String optParamsExplained = "Above are the required, positional arguments. In addition to these, the " + - "following options and associated positional arguments may be used:\n" + - " '-onmacfilters ;;...;' which specifies that sequence matching should ONLY" + - " be performed on flows where the MAC of one of the two endpoints matches the given regex. Note " + - "that you MUST specify a regex for each cluster of the signature. This is to facilitate more " + - "aggressive filtering on parts of the signature (e.g., the communication that involves the " + - "smart home device itself as one can drop all flows that do not include an endpoint with a MAC " + - "that matches the vendor's prefix).\n" + - " '-offmacfilters ;;...;' works exactly the same as onmacfilters, but " + - "applies to the OFF signature instead of the ON signature.\n" + - " '-sout ' true/false literal indicating if output should also be printed to std out; default is true.\n" + - " '-vpn ' router's MAC address; this is to simulate a VPN that combines all flows even when the traffic is not a VPN traffic.\n" + - " '-onskipped ' the maximum duration of ON signature detection.\n" + - " '-offskipped ' the maximum duration of OFF signature detection.\n"; System.out.println(optParamsExplained); return; } @@ -105,7 +110,18 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb final String resultsFile = args[5]; final int signatureDuration = Integer.parseInt(args[6]); final double eps = Double.parseDouble(args[7]); - + // Additional feature---relaxed matching + int delta = 0; + final Set packetSet = new HashSet<>(); + if (args.length > 8 && args[8].equals("-r")) { + delta = Integer.parseInt(args[9]); + StringTokenizer stringTokenizerOff = new StringTokenizer(args[10], ","); + // Add the list of packet IDs + while(stringTokenizerOff.hasMoreTokens()) { + int id = Integer.parseInt(stringTokenizerOff.nextToken()); + packetSet.add(id); + } + } // Parse optional parameters. List> onSignatureMacFilters = null, offSignatureMacFilters = null; String vpnClientMacAddress = null; @@ -175,15 +191,15 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb } Layer2SignatureDetector onDetector = onSignatureMacFilters == null ? new Layer2SignatureDetector(onSignature, TRAINING_ROUTER_WLAN_MAC, ROUTER_WLAN_MAC, signatureDuration, - isRangeBasedForOn, eps, onMaxSkippedPackets, vpnClientMacAddress) : + isRangeBasedForOn, eps, onMaxSkippedPackets, vpnClientMacAddress, delta, packetSet) : new Layer2SignatureDetector(onSignature, TRAINING_ROUTER_WLAN_MAC, ROUTER_WLAN_MAC, onSignatureMacFilters, signatureDuration, isRangeBasedForOn, eps, onMaxSkippedPackets, - vpnClientMacAddress); + vpnClientMacAddress, delta, packetSet); Layer2SignatureDetector offDetector = offSignatureMacFilters == null ? new Layer2SignatureDetector(offSignature, TRAINING_ROUTER_WLAN_MAC, ROUTER_WLAN_MAC, signatureDuration, - isRangeBasedForOff, eps, offMaxSkippedPackets, vpnClientMacAddress) : + isRangeBasedForOff, eps, offMaxSkippedPackets, vpnClientMacAddress, delta, packetSet) : new Layer2SignatureDetector(offSignature, TRAINING_ROUTER_WLAN_MAC, ROUTER_WLAN_MAC, offSignatureMacFilters, - signatureDuration, isRangeBasedForOff, eps, offMaxSkippedPackets, vpnClientMacAddress); + signatureDuration, isRangeBasedForOff, eps, offMaxSkippedPackets, vpnClientMacAddress, delta, packetSet); final List detectedEvents = new ArrayList<>(); onDetector.addObserver((signature, match) -> { UserAction event = new UserAction(UserAction.Type.TOGGLE_ON, match.get(0).get(0).getTimestamp()); @@ -276,15 +292,15 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb public Layer2SignatureDetector(List>> searchedSignature, String trainingRouterWlanMac, String routerWlanMac, int signatureDuration, boolean isRangeBased, double eps, - int limitSkippedPackets, String vpnClientMacAddress) { + int limitSkippedPackets, String vpnClientMacAddress, int delta, Set packetSet) { this(searchedSignature, trainingRouterWlanMac, routerWlanMac, null, signatureDuration, isRangeBased, - eps, limitSkippedPackets, vpnClientMacAddress); + eps, limitSkippedPackets, vpnClientMacAddress, delta, packetSet); } public Layer2SignatureDetector(List>> searchedSignature, String trainingRouterWlanMac, String routerWlanMac, List> flowFilters, int inclusionTimeMillis, boolean isRangeBased, double eps, int limitSkippedPackets, - String vpnClientMacAddress) { + String vpnClientMacAddress, int delta, Set packetSet) { if (flowFilters != null && flowFilters.size() != searchedSignature.size()) { throw new IllegalArgumentException("If flow filters are used, there must be a flow filter for each cluster " + "of the signature."); @@ -295,9 +311,9 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb List> cluster = mSignature.get(i); Layer2ClusterMatcher clusterMatcher = flowFilters == null ? new Layer2ClusterMatcher(cluster, trainingRouterWlanMac, routerWlanMac, inclusionTimeMillis, - isRangeBased, eps, limitSkippedPackets) : + isRangeBased, eps, limitSkippedPackets, delta, packetSet) : new Layer2ClusterMatcher(cluster, trainingRouterWlanMac, routerWlanMac, flowFilters.get(i), - inclusionTimeMillis, isRangeBased, eps, limitSkippedPackets); + inclusionTimeMillis, isRangeBased, eps, limitSkippedPackets, delta, packetSet); clusterMatcher.addObserver(this); clusterMatchers.add(clusterMatcher); }