X-Git-Url: http://plrg.eecs.uci.edu/git/?p=pingpong.git;a=blobdiff_plain;f=Code%2FProjects%2FPacketLevelSignatureExtractor%2Fsrc%2Fmain%2Fjava%2Fedu%2Fuci%2Fiotproject%2Fdetection%2Flayer2%2FLayer2SignatureDetector.java;h=e083a2cc395d6f72da7c9b4e7800da1edbb543b1;hp=f5a314fb23861e828522f683e7568671f1ed0ca6;hb=75e5953e085f30ee7c108d2a55d3d7dd181f828b;hpb=49dd7a06d29cc71b962d5e0a322fc935a7565438 diff --git a/Code/Projects/PacketLevelSignatureExtractor/src/main/java/edu/uci/iotproject/detection/layer2/Layer2SignatureDetector.java b/Code/Projects/PacketLevelSignatureExtractor/src/main/java/edu/uci/iotproject/detection/layer2/Layer2SignatureDetector.java index f5a314f..e083a2c 100644 --- a/Code/Projects/PacketLevelSignatureExtractor/src/main/java/edu/uci/iotproject/detection/layer2/Layer2SignatureDetector.java +++ b/Code/Projects/PacketLevelSignatureExtractor/src/main/java/edu/uci/iotproject/detection/layer2/Layer2SignatureDetector.java @@ -9,6 +9,7 @@ import edu.uci.iotproject.io.PcapHandleReader; import edu.uci.iotproject.io.PrintWriterUtils; import edu.uci.iotproject.trafficreassembly.layer2.Layer2Flow; import edu.uci.iotproject.trafficreassembly.layer2.Layer2FlowReassembler; +import edu.uci.iotproject.util.PcapPacketUtils; import edu.uci.iotproject.util.PrintUtils; import org.jgrapht.GraphPath; import org.jgrapht.alg.shortestpath.DijkstraShortestPath; @@ -51,9 +52,11 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb public static void main(String[] args) throws PcapNativeException, NotOpenException, IOException { // Parse required parameters. - if (args.length < 5) { - String errMsg = String.format("Usage: %s inputPcapFile onSignatureFile offSignatureFile resultsFile" + + if (args.length < 8) { + String errMsg = String.format("Usage: %s inputPcapFile onAnalysisFile offAnalysisFile onSignatureFile offSignatureFile resultsFile" + "\n inputPcapFile: the target of the detection" + + "\n onAnalysisFile: the file that contains the ON clusters analysis" + + "\n offAnalysisFile: the file that contains the OFF clusters analysis" + "\n onSignatureFile: the file that contains the ON signature to search for" + "\n offSignatureFile: the file that contains the OFF signature to search for" + "\n resultsFile: where to write the results of the detection" + @@ -74,15 +77,25 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb System.out.println(optParamsExplained); return; } + // TODO: We could take 7 inputs if we decided to use the cluster analyses. final String pcapFile = args[0]; - final String onSignatureFile = args[1]; - final String offSignatureFile = args[2]; - final String resultsFile = args[3]; - final int signatureDuration = Integer.parseInt(args[4]); + final String onClusterAnalysisFile = args[1]; + final String offClusterAnalysisFile = args[2]; + final String onSignatureFile = args[3]; + final String offSignatureFile = args[4]; + final String resultsFile = args[5]; + final int signatureDuration = Integer.parseInt(args[6]); + final double eps = Double.parseDouble(args[7]); + +// final String pcapFile = args[0]; +// final String onSignatureFile = args[1]; +// final String offSignatureFile = args[2]; +// final String resultsFile = args[3]; +// final int signatureDuration = Integer.parseInt(args[4]); // Parse optional parameters. List> onSignatureMacFilters = null, offSignatureMacFilters = null; - final int optParamsStartIdx = 5; + final int optParamsStartIdx = 7; if (args.length > optParamsStartIdx) { for (int i = optParamsStartIdx; i < args.length; i++) { if (args[i].equalsIgnoreCase("-onMacFilters")) { @@ -105,29 +118,54 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb // Include metadata as comments at the top PrintWriterUtils.println("# Detection results for:", resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); PrintWriterUtils.println("# - inputPcapFile: " + pcapFile, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); + PrintWriterUtils.println("# - onAnalysisFile: " + onClusterAnalysisFile, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); + PrintWriterUtils.println("# - offAnalysisFile: " + offClusterAnalysisFile, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); PrintWriterUtils.println("# - onSignatureFile: " + onSignatureFile, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); PrintWriterUtils.println("# - offSignatureFile: " + offSignatureFile, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); resultsWriter.flush(); - // TODO: IMPLEMENT THE RANGE-BASED DETECTION HERE - boolean isRangeBased = true; - // Create signature detectors and add observers that output their detected events. List>> onSignature = PrintUtils.deserializeFromFile(onSignatureFile); List>> offSignature = PrintUtils.deserializeFromFile(offSignatureFile); + // Load signature analyses + List>> onClusterAnalysis = PrintUtils.deserializeFromFile(onClusterAnalysisFile); + List>> offClusterAnalysis = PrintUtils.deserializeFromFile(offClusterAnalysisFile); + // TODO: FOR NOW WE DECIDE PER SIGNATURE AND THEN WE OR THE BOOLEANS + // TODO: SINCE WE ONLY HAVE 2 SIGNATURES FOR NOW (ON AND OFF), THEN IT IS USUALLY EITHER RANGE-BASED OR + // TODO: STRICT MATCHING + // Check if we should use range-based matching +// boolean isRangeBasedForOn = PcapPacketUtils.isRangeBasedMatching(onSignature, eps, offSignature); +// boolean isRangeBasedForOff = PcapPacketUtils.isRangeBasedMatching(offSignature, eps, onSignature); + // TODO: WE DON'T DO RANGE-BASED FOR NOW BECAUSE THE RESULTS ARE TERRIBLE FOR LAYER 2 MATCHING + // TODO: THIS WOULD ONLY WORK FOR SIGNATURES LONGER THAN 2 PACKETS + boolean isRangeBasedForOn = false; + boolean isRangeBasedForOff = false; + // Update the signature with ranges if it is range-based + if (isRangeBasedForOn) { + onSignature = PcapPacketUtils.useRangeBasedMatching(onSignature, onClusterAnalysis); + } + if (isRangeBasedForOff) { + offSignature = PcapPacketUtils.useRangeBasedMatching(offSignature, offClusterAnalysis); + } Layer2SignatureDetector onDetector = onSignatureMacFilters == null ? - new Layer2SignatureDetector(onSignature) : - new Layer2SignatureDetector(onSignature, onSignatureMacFilters, signatureDuration, isRangeBased); + new Layer2SignatureDetector(onSignature, signatureDuration, isRangeBasedForOn, eps) : + new Layer2SignatureDetector(onSignature, onSignatureMacFilters, signatureDuration, isRangeBasedForOn, eps); Layer2SignatureDetector offDetector = offSignatureMacFilters == null ? - new Layer2SignatureDetector(offSignature) : - new Layer2SignatureDetector(offSignature, offSignatureMacFilters, signatureDuration, isRangeBased); + new Layer2SignatureDetector(offSignature, signatureDuration, isRangeBasedForOff, eps) : + new Layer2SignatureDetector(offSignature, offSignatureMacFilters, signatureDuration, isRangeBasedForOff, eps); + final List detectedEvents = new ArrayList<>(); onDetector.addObserver((signature, match) -> { UserAction event = new UserAction(UserAction.Type.TOGGLE_ON, match.get(0).get(0).getTimestamp()); PrintWriterUtils.println(event, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); + detectedEvents.add(event); }); offDetector.addObserver((signature, match) -> { UserAction event = new UserAction(UserAction.Type.TOGGLE_OFF, match.get(0).get(0).getTimestamp()); PrintWriterUtils.println(event, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); + for (PcapPacket pcap : match.get(0)) { + System.out.println(pcap.length() + " -> " + pcap.getTimestamp()); + } + detectedEvents.add(event); }); // Load the PCAP file @@ -141,6 +179,13 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb // Parse the file reader.readFromHandle(); + String resultOn = "Number of detected events of type " + UserAction.Type.TOGGLE_ON + ": " + + detectedEvents.stream().filter(ua -> ua.getType() == UserAction.Type.TOGGLE_ON).count(); + String resultOff = "Number of detected events of type " + UserAction.Type.TOGGLE_OFF + ": " + + detectedEvents.stream().filter(ua -> ua.getType() == UserAction.Type.TOGGLE_OFF).count(); + PrintWriterUtils.println(resultOn, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); + PrintWriterUtils.println(resultOff, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); + // Flush output to results file and close it. resultsWriter.flush(); resultsWriter.close(); @@ -179,21 +224,23 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb private int mInclusionTimeMillis; - public Layer2SignatureDetector(List>> searchedSignature) { - this(searchedSignature, null, 0, false); + public Layer2SignatureDetector(List>> searchedSignature, int signatureDuration, boolean isRangeBased, double eps) { + this(searchedSignature, null, signatureDuration, isRangeBased, eps); } public Layer2SignatureDetector(List>> searchedSignature, List> flowFilters, int inclusionTimeMillis, boolean isRangeBased) { + Boolean>> flowFilters, int inclusionTimeMillis, boolean isRangeBased, double eps) { if (flowFilters != null && flowFilters.size() != searchedSignature.size()) { - throw new IllegalArgumentException("If flow filters are used, there must be a flow filter for each cluster of the signature."); + throw new IllegalArgumentException("If flow filters are used, there must be a flow filter for each cluster " + + "of the signature."); } mSignature = Collections.unmodifiableList(searchedSignature); List clusterMatchers = new ArrayList<>(); for (int i = 0; i < mSignature.size(); i++) { List> cluster = mSignature.get(i); Layer2ClusterMatcher clusterMatcher = flowFilters == null ? - new Layer2ClusterMatcher(cluster) : new Layer2ClusterMatcher(cluster, flowFilters.get(i), isRangeBased); + new Layer2ClusterMatcher(cluster, inclusionTimeMillis, isRangeBased, eps) : + new Layer2ClusterMatcher(cluster, flowFilters.get(i), inclusionTimeMillis, isRangeBased, eps); clusterMatcher.addObserver(this); clusterMatchers.add(clusterMatcher); }