1 package edu.uci.iotproject;
3 import edu.uci.iotproject.analysis.PcapPacketPair;
4 import edu.uci.iotproject.analysis.TcpConversationUtils;
5 import edu.uci.iotproject.analysis.TriggerTrafficExtractor;
6 import edu.uci.iotproject.io.TriggerTimesFileReader;
7 import org.pcap4j.core.*;
8 import org.pcap4j.packet.IpV4Packet;
9 import org.pcap4j.packet.namednumber.DataLinkType;
11 import java.io.EOFException;
12 import java.net.UnknownHostException;
13 import java.time.Instant;
14 import java.util.ArrayList;
15 import java.util.Collections;
16 import java.util.HashMap;
17 import java.util.List;
18 import java.util.concurrent.TimeoutException;
21 * This is a system that reads PCAP files to compare
22 * patterns of DNS hostnames, packet sequences, and packet
23 * lengths with training data to determine certain events
24 * or actions for smart home devices.
26 * @author Janus Varmarken
27 * @author Rahmadi Trimananda (rtrimana@uci.edu)
33 public static void main(String[] args) throws PcapNativeException, NotOpenException, EOFException, TimeoutException, UnknownHostException {
34 // -------------------------------------------------------------------------------------------------------------
35 // Example/debug code for searching for a pattern at the MAC layer.
36 // String fileName = "./pcap/mac-tplink.local.pcapng";
39 // handle = Pcaps.openOffline(fileName, PcapHandle.TimestampPrecision.NANO);
40 // } catch (PcapNativeException pne) {
41 // handle = Pcaps.openOffline(fileName);
43 // Arrays.asList(1590, 1590, 1590, 1001, 337, 197, 636, 1311, 177) // Full pattern (all non-zero payload packets).
44 // MacLayerFlowPattern pattern = new MacLayerFlowPattern("TP_LINK_LOCAL_OFF_MAC", "50:c7:bf:33:1f:09", Arrays.asList(637, 1312));
45 // MacLayerFlowPatternFinder finder = new MacLayerFlowPatternFinder(handle, pattern);
46 // finder.findFlowPattern();
47 // -------------------------------------------------------------------------------------------------------------
49 // //final String fileName = args.length > 0 ? args[0] : "/home/rtrimana/pcap_processing/smart_home_traffic/Code/Projects/SmartPlugDetector/pcap/wlan1.local.dns.pcap";
50 // final String fileName = args.length > 0 ? args[0] : "/scratch/June-2018/TPLink/wlan1/tplink.wlan1.local.pcap";
51 // //final String fileName = args.length > 0 ? args[0] : "/scratch/June-2018/DLink/wlan1/dlink.wlan1.local.pcap";
52 // final String trainingFileName = "./pcap/TP_LINK_LOCAL_ON_SUBSET.pcap";
53 //// final String trainingFileName = "./pcap/TP_LINK_LOCAL_ON.pcap";
55 //// // ====== Debug code ======
57 // PcapHandle trainingPcap;
59 // handle = Pcaps.openOffline(fileName, PcapHandle.TimestampPrecision.NANO);
60 // trainingPcap = Pcaps.openOffline(trainingFileName, PcapHandle.TimestampPrecision.NANO);
61 // } catch (PcapNativeException pne) {
62 // handle = Pcaps.openOffline(fileName);
63 // trainingPcap = Pcaps.openOffline(trainingFileName);
66 //// // TODO: The followings are the way to extract multiple hostnames and their associated packet lengths lists
67 //// //List<String> list = new ArrayList<>();
68 //// //list.add("events.tplinkra.com");
69 //// //FlowPattern fp = new FlowPattern("TP_LINK_LOCAL_ON", list, trainingPcap);
70 //// //List<String> list2 = new ArrayList<>();
71 //// //list2.add("devs.tplinkcloud.com");
72 //// //list2.add("events.tplinkra.com");
73 //// //FlowPattern fp3 = new FlowPattern("TP_LINK_REMOTE_ON", list2, trainingPcap);
75 // FlowPattern fp = new FlowPattern("TP_LINK_LOCAL_ON", "events.tplinkra.com", trainingPcap);
76 // //FlowPattern fp = new FlowPattern("DLINK_LOCAL_ON", "rfe-us-west-1.dch.dlink.com", trainingPcap);
77 // FlowPatternFinder fpf = new FlowPatternFinder(handle, fp);
80 //// // ========================
83 PcapReader pcapReader = new PcapReader(args[0]);
84 PcapProcessingPipeline pipeline = new PcapProcessingPipeline(pcapReader);
85 TcpReassembler tcpReassembler = new TcpReassembler();
86 pipeline.addPcapPacketConsumer(tcpReassembler);
87 pipeline.executePipeline();
88 System.out.println("Pipeline terminated");
90 List<List<PcapPacketPair>> pairs = new ArrayList<>();
91 for (Conversation c : tcpReassembler.getTcpConversations()) {
92 pairs.add(TcpConversationUtils.extractPacketPairs(c));
97 // -------- 07-17-2018 --------
98 // Only consider packets to/from the TP-Link plug.
99 PcapReader pcapReader = new PcapReader(args[0], "ip host 192.168.1.159");
100 TcpReassembler tcpReassembler = new TcpReassembler();
102 while((packet = pcapReader.readNextPacket()) != null) {
103 tcpReassembler.consumePacket(packet);
105 // Now we have a set of reassembled TCP conversations.
106 List<Conversation> conversations = tcpReassembler.getTcpConversations();
107 for(Conversation c : conversations) {
108 List<PcapPacketPair> pairs = TcpConversationUtils.extractPacketPairs(c);
109 for (PcapPacketPair pair : pairs) {
111 // 1. discard packets that are not within X seconds after trigger time
112 // 2. conversations may be (are) with different servers - so need to plot in different plots, one per hostname?
116 // ----------------------------
119 // -------- 07-19-2018 --------
120 TriggerTimesFileReader ttfr = new TriggerTimesFileReader();
121 // List<Instant> triggerTimes = ttfr.readTriggerTimes("/Users/varmarken/Downloads/tplink-feb-13-2018.timestamps", false);
122 List<Instant> triggerTimes = ttfr.readTriggerTimes("/Users/varmarken/temp/UCI IoT Project/June2018 experiments/tplink/tplink-june-14-2018-timestamps.txt", false);
123 // String pcapFile = "/Users/varmarken/Development/Repositories/UCI/NetworkingGroup/smart_home_traffic/Code/Projects/SmartPlugDetector/pcap/wlan1.local.dns.pcap";
124 String pcapFile = "/Users/varmarken/temp/UCI IoT Project/June2018 experiments/tplink/tplink.wlan1.local.pcap";
125 String tpLinkPlugIp = "192.168.1.159";
126 TriggerTrafficExtractor tte = new TriggerTrafficExtractor(pcapFile, triggerTimes, tpLinkPlugIp);
127 // final PcapDumper outputter = Pcaps.openDead(DataLinkType.EN10MB, 65536).dumpOpen("/Users/varmarken/temp/traces/output/tplink-filtered.pcap");
128 final PcapDumper outputter = Pcaps.openDead(DataLinkType.EN10MB, 65536).dumpOpen("/Users/varmarken/temp/UCI IoT Project/June2018 experiments/tplink/tplink-filtered.pcap");
129 DnsMap dnsMap = new DnsMap();
130 TcpReassembler tcpReassembler = new TcpReassembler();
131 tte.performExtraction(pkt -> {
134 } catch (NotOpenException e) {
137 }, dnsMap, tcpReassembler);
143 for (Conversation c : tcpReassembler.getTcpConversations()) {
144 packets += c.getPackets().size();
145 packets += c.getSynPackets().size();
146 // only count the FIN packets, not the ACKs; every FinAckPair holds a FIN packet
147 packets += c.getFinAckPairs().size();
149 // Produces 271 packets for the Feb 13 experiment
150 // Applying filter: "(tcp and not tcp.len == 0 and not tcp.analysis.retransmission and not tcp.analysis.fast_retransmission) or (tcp.flags.syn == 1) or (tcp.flags.fin == 1)"
151 // to the file gives 295 packets, but there are 24 TCP-Out-Of-Order SYN/SYNACKs which are filtered as retransmissions in Conversation, so the numbers seem to match.
152 System.out.println("number of packets: " + packets);
155 List<List<PcapPacketPair>> pairs = new ArrayList<>();
156 for (Conversation c : tcpReassembler.getTcpConversations()) {
157 pairs.add(TcpConversationUtils.extractPacketPairs(c));
160 // Sort pairs according to timestamp of first packet of conversation for (debugging) convenience.
161 Collections.sort(pairs, (l1, l2) -> {
162 if (l1.get(0).getFirst().getTimestamp().isBefore(l2.get(0).getFirst().getTimestamp())) return -1;
163 else if (l2.get(0).getFirst().getTimestamp().isBefore(l1.get(0).getFirst().getTimestamp())) return 1;
167 System.out.println("list of pairs produced");
168 List<PcapPacketPair> eventstplinkraPairs = new ArrayList<>();
169 List<List<PcapPacketPair>> otherPairs = new ArrayList<>();
170 String hostname = "events.tplinkra.com";
172 for (List<PcapPacketPair> lppp : pairs) {
173 if (lppp.size() < 1) {
177 IpV4Packet ipPacket = lppp.get(0).getFirst().get(IpV4Packet.class);
178 // If packets are associated with the hostname
179 if (dnsMap.isRelatedToCloudServer(ipPacket.getHeader().getSrcAddr().getHostAddress(), hostname) ||
180 dnsMap.isRelatedToCloudServer(ipPacket.getHeader().getDstAddr().getHostAddress(), hostname)) {
181 eventstplinkraPairs.addAll(lppp);
183 // Pairs associated with different server
184 otherPairs.add(lppp);
187 System.out.println("number of empty list of packet pairs: " + emptyLists);
188 HashMap<String, Integer> pairCount = new HashMap<>();
189 for (PcapPacketPair ppp : eventstplinkraPairs) {
190 if (pairCount.containsKey(ppp.toString())) {
191 pairCount.put(ppp.toString(), pairCount.get(ppp.toString()) + 1);
193 pairCount.put(ppp.toString(), 1);
196 System.out.println("pairCount map built");
198 // Build map containing frequencies of packet lengths exchanged with events.tplinkra.com as well as a map with
199 // the frequencies of specific sequences of packet lengths for the same hostname
200 HashMap<Integer, Integer> eventstplinkraPacketLengthFreqMap = new HashMap<>();
201 HashMap<String, Integer> eventstplinkraPacketSequenceFreqMap = new HashMap<>();
202 for (Conversation c : tcpReassembler.getTcpConversations()) {
203 if (c.getPackets().size() == 0) {
206 PcapPacket firstPacket = c.getPackets().get(0);
207 IpV4Packet firstPacketIp = firstPacket.get(IpV4Packet.class);
208 if (!dnsMap.isRelatedToCloudServer(firstPacketIp.getHeader().getSrcAddr().getHostAddress(), hostname) &&
209 !dnsMap.isRelatedToCloudServer(firstPacketIp.getHeader().getDstAddr().getHostAddress(), hostname)) {
212 // Update the packet length freq map
213 for (PcapPacket pp : c.getPackets()) {
214 eventstplinkraPacketLengthFreqMap.merge(pp.length(), 1, (i1, i2) -> i1 + i2);
216 // Update the packet sequence freq map
217 StringBuilder sb = new StringBuilder();
218 for (PcapPacket pp : c.getPackets()) {
219 sb.append(pp.length() + " ");
221 eventstplinkraPacketSequenceFreqMap.merge(sb.toString(), 1, (i1, i2) -> i1+i2);
223 System.out.println("packet length frequency map created");
226 // ----------------------------
232 // TP-Link MAC 50:c7:bf:33:1f:09 and usually IP 192.168.1.159 (remember to verify per file)