X-Git-Url: http://plrg.eecs.uci.edu/git/?p=pingpong.git;a=blobdiff_plain;f=Code%2FProjects%2FPacketLevelSignatureExtractor%2Fsrc%2Fmain%2Fjava%2Fedu%2Fuci%2Fiotproject%2Fdetection%2Flayer2%2FLayer2SignatureDetector.java;h=e083a2cc395d6f72da7c9b4e7800da1edbb543b1;hp=c133b8eec61ec8292710739d0190c321ce40f936;hb=75e5953e085f30ee7c108d2a55d3d7dd181f828b;hpb=e858f6e0e1b043e17b7a31138f3dc6b093553b1d diff --git a/Code/Projects/PacketLevelSignatureExtractor/src/main/java/edu/uci/iotproject/detection/layer2/Layer2SignatureDetector.java b/Code/Projects/PacketLevelSignatureExtractor/src/main/java/edu/uci/iotproject/detection/layer2/Layer2SignatureDetector.java index c133b8e..e083a2c 100644 --- a/Code/Projects/PacketLevelSignatureExtractor/src/main/java/edu/uci/iotproject/detection/layer2/Layer2SignatureDetector.java +++ b/Code/Projects/PacketLevelSignatureExtractor/src/main/java/edu/uci/iotproject/detection/layer2/Layer2SignatureDetector.java @@ -52,12 +52,11 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb public static void main(String[] args) throws PcapNativeException, NotOpenException, IOException { // Parse required parameters. -// if (args.length < 7) { - if (args.length < 5) { + if (args.length < 8) { String errMsg = String.format("Usage: %s inputPcapFile onAnalysisFile offAnalysisFile onSignatureFile offSignatureFile resultsFile" + "\n inputPcapFile: the target of the detection" + -// "\n onAnalysisFile: the file that contains the ON clusters analysis" + -// "\n offAnalysisFile: the file that contains the OFF clusters analysis" + + "\n onAnalysisFile: the file that contains the ON clusters analysis" + + "\n offAnalysisFile: the file that contains the OFF clusters analysis" + "\n onSignatureFile: the file that contains the ON signature to search for" + "\n offSignatureFile: the file that contains the OFF signature to search for" + "\n resultsFile: where to write the results of the detection" + @@ -79,19 +78,20 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb return; } // TODO: We could take 7 inputs if we decided to use the cluster analyses. -// final String pcapFile = args[0]; -// final String onClusterAnalysisFile = args[1]; -// final String offClusterAnalysisFile = args[2]; -// final String onSignatureFile = args[3]; -// final String offSignatureFile = args[4]; -// final String resultsFile = args[5]; -// final int signatureDuration = Integer.parseInt(args[6]); - final String pcapFile = args[0]; - final String onSignatureFile = args[1]; - final String offSignatureFile = args[2]; - final String resultsFile = args[3]; - final int signatureDuration = Integer.parseInt(args[4]); + final String onClusterAnalysisFile = args[1]; + final String offClusterAnalysisFile = args[2]; + final String onSignatureFile = args[3]; + final String offSignatureFile = args[4]; + final String resultsFile = args[5]; + final int signatureDuration = Integer.parseInt(args[6]); + final double eps = Double.parseDouble(args[7]); + +// final String pcapFile = args[0]; +// final String onSignatureFile = args[1]; +// final String offSignatureFile = args[2]; +// final String resultsFile = args[3]; +// final int signatureDuration = Integer.parseInt(args[4]); // Parse optional parameters. List> onSignatureMacFilters = null, offSignatureMacFilters = null; @@ -118,47 +118,54 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb // Include metadata as comments at the top PrintWriterUtils.println("# Detection results for:", resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); PrintWriterUtils.println("# - inputPcapFile: " + pcapFile, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); -// PrintWriterUtils.println("# - onAnalysisFile: " + onClusterAnalysisFile, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); -// PrintWriterUtils.println("# - offAnalysisFile: " + offClusterAnalysisFile, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); + PrintWriterUtils.println("# - onAnalysisFile: " + onClusterAnalysisFile, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); + PrintWriterUtils.println("# - offAnalysisFile: " + offClusterAnalysisFile, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); PrintWriterUtils.println("# - onSignatureFile: " + onSignatureFile, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); PrintWriterUtils.println("# - offSignatureFile: " + offSignatureFile, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); resultsWriter.flush(); - double eps = 10.0; // Create signature detectors and add observers that output their detected events. List>> onSignature = PrintUtils.deserializeFromFile(onSignatureFile); List>> offSignature = PrintUtils.deserializeFromFile(offSignatureFile); // Load signature analyses -// List>> onClusterAnalysis = PrintUtils.deserializeFromFile(onClusterAnalysisFile); -// List>> offClusterAnalysis = PrintUtils.deserializeFromFile(offClusterAnalysisFile); + List>> onClusterAnalysis = PrintUtils.deserializeFromFile(onClusterAnalysisFile); + List>> offClusterAnalysis = PrintUtils.deserializeFromFile(offClusterAnalysisFile); // TODO: FOR NOW WE DECIDE PER SIGNATURE AND THEN WE OR THE BOOLEANS // TODO: SINCE WE ONLY HAVE 2 SIGNATURES FOR NOW (ON AND OFF), THEN IT IS USUALLY EITHER RANGE-BASED OR // TODO: STRICT MATCHING // Check if we should use range-based matching // boolean isRangeBasedForOn = PcapPacketUtils.isRangeBasedMatching(onSignature, eps, offSignature); // boolean isRangeBasedForOff = PcapPacketUtils.isRangeBasedMatching(offSignature, eps, onSignature); -// // Update the signature with ranges if it is range-based -// if (isRangeBasedForOn && isRangeBasedForOff) { -// onSignature = PcapPacketUtils.useRangeBasedMatching(onSignature, onClusterAnalysis); -// offSignature = PcapPacketUtils.useRangeBasedMatching(offSignature, offClusterAnalysis); -// } // TODO: WE DON'T DO RANGE-BASED FOR NOW BECAUSE THE RESULTS ARE TERRIBLE FOR LAYER 2 MATCHING // TODO: THIS WOULD ONLY WORK FOR SIGNATURES LONGER THAN 2 PACKETS boolean isRangeBasedForOn = false; boolean isRangeBasedForOff = false; + // Update the signature with ranges if it is range-based + if (isRangeBasedForOn) { + onSignature = PcapPacketUtils.useRangeBasedMatching(onSignature, onClusterAnalysis); + } + if (isRangeBasedForOff) { + offSignature = PcapPacketUtils.useRangeBasedMatching(offSignature, offClusterAnalysis); + } Layer2SignatureDetector onDetector = onSignatureMacFilters == null ? - new Layer2SignatureDetector(onSignature, isRangeBasedForOn, eps) : + new Layer2SignatureDetector(onSignature, signatureDuration, isRangeBasedForOn, eps) : new Layer2SignatureDetector(onSignature, onSignatureMacFilters, signatureDuration, isRangeBasedForOn, eps); Layer2SignatureDetector offDetector = offSignatureMacFilters == null ? - new Layer2SignatureDetector(offSignature, isRangeBasedForOff, eps) : + new Layer2SignatureDetector(offSignature, signatureDuration, isRangeBasedForOff, eps) : new Layer2SignatureDetector(offSignature, offSignatureMacFilters, signatureDuration, isRangeBasedForOff, eps); + final List detectedEvents = new ArrayList<>(); onDetector.addObserver((signature, match) -> { UserAction event = new UserAction(UserAction.Type.TOGGLE_ON, match.get(0).get(0).getTimestamp()); PrintWriterUtils.println(event, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); + detectedEvents.add(event); }); offDetector.addObserver((signature, match) -> { UserAction event = new UserAction(UserAction.Type.TOGGLE_OFF, match.get(0).get(0).getTimestamp()); PrintWriterUtils.println(event, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); + for (PcapPacket pcap : match.get(0)) { + System.out.println(pcap.length() + " -> " + pcap.getTimestamp()); + } + detectedEvents.add(event); }); // Load the PCAP file @@ -172,6 +179,13 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb // Parse the file reader.readFromHandle(); + String resultOn = "Number of detected events of type " + UserAction.Type.TOGGLE_ON + ": " + + detectedEvents.stream().filter(ua -> ua.getType() == UserAction.Type.TOGGLE_ON).count(); + String resultOff = "Number of detected events of type " + UserAction.Type.TOGGLE_OFF + ": " + + detectedEvents.stream().filter(ua -> ua.getType() == UserAction.Type.TOGGLE_OFF).count(); + PrintWriterUtils.println(resultOn, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); + PrintWriterUtils.println(resultOff, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); + // Flush output to results file and close it. resultsWriter.flush(); resultsWriter.close(); @@ -210,8 +224,8 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb private int mInclusionTimeMillis; - public Layer2SignatureDetector(List>> searchedSignature, boolean isRangeBased, double eps) { - this(searchedSignature, null, 0, isRangeBased, eps); + public Layer2SignatureDetector(List>> searchedSignature, int signatureDuration, boolean isRangeBased, double eps) { + this(searchedSignature, null, signatureDuration, isRangeBased, eps); } public Layer2SignatureDetector(List>> searchedSignature, List> cluster = mSignature.get(i); Layer2ClusterMatcher clusterMatcher = flowFilters == null ? - new Layer2ClusterMatcher(cluster, isRangeBased, eps) : - new Layer2ClusterMatcher(cluster, flowFilters.get(i), isRangeBased, eps); + new Layer2ClusterMatcher(cluster, inclusionTimeMillis, isRangeBased, eps) : + new Layer2ClusterMatcher(cluster, flowFilters.get(i), inclusionTimeMillis, isRangeBased, eps); clusterMatcher.addObserver(this); clusterMatchers.add(clusterMatcher); }