X-Git-Url: http://plrg.eecs.uci.edu/git/?p=pingpong.git;a=blobdiff_plain;f=Code%2FProjects%2FPacketLevelSignatureExtractor%2Fsrc%2Fmain%2Fjava%2Fedu%2Fuci%2Fiotproject%2Fdetection%2Flayer2%2FLayer2SignatureDetector.java;h=90c47c2a429afd9ec774ff3b6e7d0ee174b172bf;hp=995eb497b3ddeeb8ccbdb4fb6ba44c9456bae69c;hb=d3026c4b1681bea17b79f88f49162c6b78e781a1;hpb=0b1e09c809b5c5336db8ab354750081187774382 diff --git a/Code/Projects/PacketLevelSignatureExtractor/src/main/java/edu/uci/iotproject/detection/layer2/Layer2SignatureDetector.java b/Code/Projects/PacketLevelSignatureExtractor/src/main/java/edu/uci/iotproject/detection/layer2/Layer2SignatureDetector.java index 995eb49..90c47c2 100644 --- a/Code/Projects/PacketLevelSignatureExtractor/src/main/java/edu/uci/iotproject/detection/layer2/Layer2SignatureDetector.java +++ b/Code/Projects/PacketLevelSignatureExtractor/src/main/java/edu/uci/iotproject/detection/layer2/Layer2SignatureDetector.java @@ -52,15 +52,23 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb public static void main(String[] args) throws PcapNativeException, NotOpenException, IOException { // Parse required parameters. - if (args.length < 8) { - String errMsg = String.format("Usage: %s inputPcapFile onAnalysisFile offAnalysisFile onSignatureFile offSignatureFile resultsFile" + + if (args.length < 10) { + String errMsg = String.format("SPECTO version 1.0\n" + + "Copyright (C) 2018-2019 Janus Varmarken and Rahmadi Trimananda.\n" + + "University of California, Irvine.\n" + + "All rights reserved.\n\n" + + "Usage: %s inputPcapFile onAnalysisFile offAnalysisFile onSignatureFile offSignatureFile " + + "resultsFile signatureDuration eps onMaxSkippedPackets offMaxSkippedPackets" + "\n inputPcapFile: the target of the detection" + "\n onAnalysisFile: the file that contains the ON clusters analysis" + "\n offAnalysisFile: the file that contains the OFF clusters analysis" + "\n onSignatureFile: the file that contains the ON signature to search for" + "\n offSignatureFile: the file that contains the OFF signature to search for" + "\n resultsFile: where to write the results of the detection" + - "\n signatureDuration: the maximum duration of signature detection", + "\n signatureDuration: the maximum duration of signature detection" + + "\n eps: the epsilon value for the DBSCAN algorithm" + + "\n onMaxSkippedPackets: the maximum duration of ON signature detection (put -1 if not used)" + + "\n offMaxSkippedPackets: the maximum duration of OFF signature detection (put -1 if not used)", Layer2SignatureDetector.class.getSimpleName()); System.out.println(errMsg); String optParamsExplained = "Above are the required, positional arguments. In addition to these, the " + @@ -77,7 +85,6 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb System.out.println(optParamsExplained); return; } - // TODO: We could take 7 inputs if we decided to use the cluster analyses. final String pcapFile = args[0]; final String onClusterAnalysisFile = args[1]; final String offClusterAnalysisFile = args[2]; @@ -86,12 +93,8 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb final String resultsFile = args[5]; final int signatureDuration = Integer.parseInt(args[6]); final double eps = Double.parseDouble(args[7]); - -// final String pcapFile = args[0]; -// final String onSignatureFile = args[1]; -// final String offSignatureFile = args[2]; -// final String resultsFile = args[3]; -// final int signatureDuration = Integer.parseInt(args[4]); + final int onMaxSkippedPackets = Integer.parseInt(args[8]); + final int offMaxSkippedPackets = Integer.parseInt(args[8]); // Parse optional parameters. List> onSignatureMacFilters = null, offSignatureMacFilters = null; @@ -134,12 +137,12 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb // TODO: SINCE WE ONLY HAVE 2 SIGNATURES FOR NOW (ON AND OFF), THEN IT IS USUALLY EITHER RANGE-BASED OR // TODO: STRICT MATCHING // Check if we should use range-based matching -// boolean isRangeBasedForOn = PcapPacketUtils.isRangeBasedMatching(onSignature, eps, offSignature); -// boolean isRangeBasedForOff = PcapPacketUtils.isRangeBasedMatching(offSignature, eps, onSignature); + boolean isRangeBasedForOn = PcapPacketUtils.isRangeBasedMatching(onSignature, eps, offSignature); + boolean isRangeBasedForOff = PcapPacketUtils.isRangeBasedMatching(offSignature, eps, onSignature); // TODO: WE DON'T DO RANGE-BASED FOR NOW BECAUSE THE RESULTS ARE TERRIBLE FOR LAYER 2 MATCHING // TODO: THIS WOULD ONLY WORK FOR SIGNATURES LONGER THAN 2 PACKETS - boolean isRangeBasedForOn = false; - boolean isRangeBasedForOff = false; +// boolean isRangeBasedForOn = false; +// boolean isRangeBasedForOff = false; // Update the signature with ranges if it is range-based if (isRangeBasedForOn) { onSignature = PcapPacketUtils.useRangeBasedMatching(onSignature, onClusterAnalysis); @@ -148,11 +151,13 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb offSignature = PcapPacketUtils.useRangeBasedMatching(offSignature, offClusterAnalysis); } Layer2SignatureDetector onDetector = onSignatureMacFilters == null ? - new Layer2SignatureDetector(onSignature, signatureDuration, isRangeBasedForOn, eps) : - new Layer2SignatureDetector(onSignature, onSignatureMacFilters, signatureDuration, isRangeBasedForOn, eps); + new Layer2SignatureDetector(onSignature, signatureDuration, isRangeBasedForOn, eps, onMaxSkippedPackets) : + new Layer2SignatureDetector(onSignature, onSignatureMacFilters, signatureDuration, + isRangeBasedForOn, eps, onMaxSkippedPackets); Layer2SignatureDetector offDetector = offSignatureMacFilters == null ? - new Layer2SignatureDetector(offSignature, signatureDuration, isRangeBasedForOff, eps) : - new Layer2SignatureDetector(offSignature, offSignatureMacFilters, signatureDuration, isRangeBasedForOff, eps); + new Layer2SignatureDetector(offSignature, signatureDuration, isRangeBasedForOff, eps, offMaxSkippedPackets) : + new Layer2SignatureDetector(offSignature, offSignatureMacFilters, signatureDuration, + isRangeBasedForOff, eps, offMaxSkippedPackets); final List detectedEvents = new ArrayList<>(); onDetector.addObserver((signature, match) -> { UserAction event = new UserAction(UserAction.Type.TOGGLE_ON, match.get(0).get(0).getTimestamp()); @@ -162,9 +167,6 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb offDetector.addObserver((signature, match) -> { UserAction event = new UserAction(UserAction.Type.TOGGLE_OFF, match.get(0).get(0).getTimestamp()); PrintWriterUtils.println(event, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); - for (PcapPacket pcap : match.get(0)) { - System.out.println(pcap.length() + " -> " + pcap.getTimestamp()); - } detectedEvents.add(event); }); @@ -179,12 +181,26 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb // Parse the file reader.readFromHandle(); - String resultOn = "Number of detected events of type " + UserAction.Type.TOGGLE_ON + ": " + + String resultOn = "# Number of detected events of type " + UserAction.Type.TOGGLE_ON + ": " + detectedEvents.stream().filter(ua -> ua.getType() == UserAction.Type.TOGGLE_ON).count(); - String resultOff = "Number of detected events of type " + UserAction.Type.TOGGLE_OFF + ": " + + String resultOff = "# Number of detected events of type " + UserAction.Type.TOGGLE_OFF + ": " + detectedEvents.stream().filter(ua -> ua.getType() == UserAction.Type.TOGGLE_OFF).count(); + String onMaximumSkippedPackets = "# Maximum number of skipped packets in ON signature " + + Integer.toString(onDetector.getMaxSkippedPackets()); +// String onMaxSkippedPackets = "# Number of skipped packets in ON signature: "; +// for(Integer skippedPackets : onDetector.getMaxSkippedPackets()) { +// System.out.println(skippedPackets); +// } + String offMaximumSkippedPackets = "# Maximum number of skipped packets in OFF signature " + + Integer.toString(offDetector.getMaxSkippedPackets()); +// String offMaxSkippedPackets = "# Number of skipped packets in OFF signature: "; +// for(Integer skippedPackets : offDetector.getMaxSkippedPackets()) { +// System.out.println(skippedPackets); +// } PrintWriterUtils.println(resultOn, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); PrintWriterUtils.println(resultOff, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); + PrintWriterUtils.println(onMaximumSkippedPackets, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); + PrintWriterUtils.println(offMaximumSkippedPackets, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); // Flush output to results file and close it. resultsWriter.flush(); @@ -224,12 +240,16 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb private int mInclusionTimeMillis; - public Layer2SignatureDetector(List>> searchedSignature, int signatureDuration, boolean isRangeBased, double eps) { - this(searchedSignature, null, signatureDuration, isRangeBased, eps); + private int mMaxSkippedPackets; +// private List mMaxSkippedPackets; + + public Layer2SignatureDetector(List>> searchedSignature, int signatureDuration, + boolean isRangeBased, double eps, int limitSkippedPackets) { + this(searchedSignature, null, signatureDuration, isRangeBased, eps, limitSkippedPackets); } public Layer2SignatureDetector(List>> searchedSignature, List> flowFilters, int inclusionTimeMillis, boolean isRangeBased, double eps) { + Boolean>> flowFilters, int inclusionTimeMillis, boolean isRangeBased, double eps, int limitSkippedPackets) { if (flowFilters != null && flowFilters.size() != searchedSignature.size()) { throw new IllegalArgumentException("If flow filters are used, there must be a flow filter for each cluster " + "of the signature."); @@ -239,8 +259,9 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb for (int i = 0; i < mSignature.size(); i++) { List> cluster = mSignature.get(i); Layer2ClusterMatcher clusterMatcher = flowFilters == null ? - new Layer2ClusterMatcher(cluster, isRangeBased, eps) : - new Layer2ClusterMatcher(cluster, flowFilters.get(i), isRangeBased, eps); + new Layer2ClusterMatcher(cluster, inclusionTimeMillis, isRangeBased, eps, limitSkippedPackets) : + new Layer2ClusterMatcher(cluster, flowFilters.get(i), inclusionTimeMillis, isRangeBased, + eps, limitSkippedPackets); clusterMatcher.addObserver(this); clusterMatchers.add(clusterMatcher); } @@ -258,8 +279,17 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb mClusterMatchers.forEach(cm -> mFlowReassembler.addObserver(cm)); mInclusionTimeMillis = inclusionTimeMillis == 0 ? TriggerTrafficExtractor.INCLUSION_WINDOW_MILLIS : inclusionTimeMillis; + mMaxSkippedPackets = 0; +// mMaxSkippedPackets = new ArrayList<>(); } + public int getMaxSkippedPackets() { + return mMaxSkippedPackets; + } +// public List getMaxSkippedPackets() { +// return mMaxSkippedPackets; +// } + @Override public void gotPacket(PcapPacket packet) { // Forward packet processing to the flow reassembler that in turn notifies the cluster matchers as appropriate @@ -273,6 +303,11 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb // Add the match at the corresponding index mPendingMatches[mClusterMatcherIds.get(clusterMatcher)].add(match); checkSignatureMatch(); + // Update maximum number of skipped packets + if (mMaxSkippedPackets < ((Layer2ClusterMatcher) clusterMatcher).getMaxSkippedPackets()) { + mMaxSkippedPackets = ((Layer2ClusterMatcher) clusterMatcher).getMaxSkippedPackets(); + } +// mMaxSkippedPackets = ((Layer2ClusterMatcher) clusterMatcher).getMaxSkippedPackets(); } }