X-Git-Url: http://demsky.eecs.uci.edu/git/?a=blobdiff_plain;f=Code%2FProjects%2FPacketLevelSignatureExtractor%2Fsrc%2Fmain%2Fjava%2Fedu%2Fuci%2Fiotproject%2Fdetection%2Flayer2%2FLayer2SignatureDetector.java;h=5e9d8a053a2f2c07016cd9d27a43b47fc9f59e00;hb=321d6c31113ec547c99d782a06635969d773232c;hp=cc3a128329a824f94f6fb105b6b79cc49059378f;hpb=7e6a00a5a2e03a0a7c2714bb3d4f2bf98976a9e7;p=pingpong.git diff --git a/Code/Projects/PacketLevelSignatureExtractor/src/main/java/edu/uci/iotproject/detection/layer2/Layer2SignatureDetector.java b/Code/Projects/PacketLevelSignatureExtractor/src/main/java/edu/uci/iotproject/detection/layer2/Layer2SignatureDetector.java index cc3a128..5e9d8a0 100644 --- a/Code/Projects/PacketLevelSignatureExtractor/src/main/java/edu/uci/iotproject/detection/layer2/Layer2SignatureDetector.java +++ b/Code/Projects/PacketLevelSignatureExtractor/src/main/java/edu/uci/iotproject/detection/layer2/Layer2SignatureDetector.java @@ -44,11 +44,11 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb * This is only useful for the filter for direction when it is a WAN signature (Phone-Cloud or Device-Cloud). * Phone-Device signatures do not have router MAC address in it. */ - // TODO: MAKE THESE INPUT PARAMETERS - private static String TRAINING_ROUTER_WLAN_MAC = "b0:b9:8a:73:69:8e"; - private static String ROUTER_WLAN_MAC = "00:c1:b1:14:eb:31"; - //private static String TRAINING_ROUTER_WLAN_MAC = null; - //private static String ROUTER_WLAN_MAC = null; + // TODO: We can remove the following constants if we do remove router's MAC filtering for directions + private static String TRAINING_ROUTER_WLAN_MAC = null; + private static String ROUTER_WLAN_MAC = null; + //private static String TRAINING_ROUTER_WLAN_MAC = "b0:b9:8a:73:69:8e"; + //private static String ROUTER_WLAN_MAC = "00:c1:b1:14:eb:31"; private static List> parseSignatureMacFilters(String filtersString) { List> filters = new ArrayList<>(); @@ -63,7 +63,7 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb public static void main(String[] args) throws PcapNativeException, NotOpenException, IOException { // Parse required parameters. - if (args.length < 10) { + if (args.length < 8) { String errMsg = String.format("SPECTO version 1.0\n" + "Copyright (C) 2018-2019 Janus Varmarken and Rahmadi Trimananda.\n" + "University of California, Irvine.\n" + @@ -77,9 +77,7 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb "\n offSignatureFile: the file that contains the OFF signature to search for" + "\n resultsFile: where to write the results of the detection" + "\n signatureDuration: the maximum duration of signature detection" + - "\n eps: the epsilon value for the DBSCAN algorithm" + - "\n onMaxSkippedPackets: the maximum duration of ON signature detection (put -1 if not used)" + - "\n offMaxSkippedPackets: the maximum duration of OFF signature detection (put -1 if not used)", + "\n eps: the epsilon value for the DBSCAN algorithm", Layer2SignatureDetector.class.getSimpleName()); System.out.println(errMsg); String optParamsExplained = "Above are the required, positional arguments. In addition to these, the " + @@ -92,7 +90,10 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb "that matches the vendor's prefix).\n" + " '-offmacfilters ;;...;' works exactly the same as onmacfilters, but " + "applies to the OFF signature instead of the ON signature.\n" + - " '-sout ' true/false literal indicating if output should also be printed to std out; default is true."; + " '-sout ' true/false literal indicating if output should also be printed to std out; default is true.\n" + + " '-vpn ' router's MAC address; this is to simulate a VPN that combines all flows even when the traffic is not a VPN traffic.\n" + + " '-onskipped ' the maximum duration of ON signature detection.\n" + + " '-offskipped ' the maximum duration of OFF signature detection.\n"; System.out.println(optParamsExplained); return; } @@ -104,12 +105,13 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb final String resultsFile = args[5]; final int signatureDuration = Integer.parseInt(args[6]); final double eps = Double.parseDouble(args[7]); - final int onMaxSkippedPackets = Integer.parseInt(args[8]); - final int offMaxSkippedPackets = Integer.parseInt(args[9]); // Parse optional parameters. List> onSignatureMacFilters = null, offSignatureMacFilters = null; - final int optParamsStartIdx = 7; + String vpnClientMacAddress = null; + int onMaxSkippedPackets = -1; + int offMaxSkippedPackets = -1; + final int optParamsStartIdx = 8; if (args.length > optParamsStartIdx) { for (int i = optParamsStartIdx; i < args.length; i++) { if (args[i].equalsIgnoreCase("-onMacFilters")) { @@ -121,6 +123,16 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb } else if (args[i].equalsIgnoreCase("-sout")) { // Next argument is a boolean true/false literal. DUPLICATE_OUTPUT_TO_STD_OUT = Boolean.parseBoolean(args[i+1]); + } else if (args[i].equalsIgnoreCase("-vpn")) { + vpnClientMacAddress = args[i+1]; + } else if (args[i].equalsIgnoreCase("-onskipped")) { + if (i+2 > args.length - 1 || !args[i+2].equalsIgnoreCase("-offskipped")) { + throw new Error("Please make sure that the -onskipped and -offskipped options are both used at the same time..."); + } + if (args[i+2].equalsIgnoreCase("-offskipped")) { + onMaxSkippedPackets = Integer.parseInt(args[i+1]); + offMaxSkippedPackets = Integer.parseInt(args[i+3]); + } } } } @@ -163,14 +175,15 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb } Layer2SignatureDetector onDetector = onSignatureMacFilters == null ? new Layer2SignatureDetector(onSignature, TRAINING_ROUTER_WLAN_MAC, ROUTER_WLAN_MAC, signatureDuration, - isRangeBasedForOn, eps, onMaxSkippedPackets) : + isRangeBasedForOn, eps, onMaxSkippedPackets, vpnClientMacAddress) : new Layer2SignatureDetector(onSignature, TRAINING_ROUTER_WLAN_MAC, ROUTER_WLAN_MAC, - onSignatureMacFilters, signatureDuration, isRangeBasedForOn, eps, onMaxSkippedPackets); + onSignatureMacFilters, signatureDuration, isRangeBasedForOn, eps, onMaxSkippedPackets, + vpnClientMacAddress); Layer2SignatureDetector offDetector = offSignatureMacFilters == null ? new Layer2SignatureDetector(offSignature, TRAINING_ROUTER_WLAN_MAC, ROUTER_WLAN_MAC, signatureDuration, - isRangeBasedForOff, eps, offMaxSkippedPackets) : + isRangeBasedForOff, eps, offMaxSkippedPackets, vpnClientMacAddress) : new Layer2SignatureDetector(offSignature, TRAINING_ROUTER_WLAN_MAC, ROUTER_WLAN_MAC, offSignatureMacFilters, - signatureDuration, isRangeBasedForOff, eps, offMaxSkippedPackets); + signatureDuration, isRangeBasedForOff, eps, offMaxSkippedPackets, vpnClientMacAddress); final List detectedEvents = new ArrayList<>(); onDetector.addObserver((signature, match) -> { UserAction event = new UserAction(UserAction.Type.TOGGLE_ON, match.get(0).get(0).getTimestamp()); @@ -204,15 +217,17 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb Integer.toString(offDetector.getMaxSkippedPackets()); PrintWriterUtils.println(resultOn, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); PrintWriterUtils.println(resultOff, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); - PrintWriterUtils.println(onMaximumSkippedPackets, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); - // TODO: We do not use the feature for now because it is essentially the same as signature duration. - //for(Integer skippedPackets : onDetector.getSkippedPackets()) { - // PrintWriterUtils.println(skippedPackets, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); - //} - PrintWriterUtils.println(offMaximumSkippedPackets, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); - //for(Integer skippedPackets : offDetector.getSkippedPackets()) { - // PrintWriterUtils.println(skippedPackets, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); - //} + // Perform the skipped packet analysis if needed + if (onMaxSkippedPackets != -1 && offMaxSkippedPackets != -1) { + PrintWriterUtils.println(onMaximumSkippedPackets, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); + for (Integer skippedPackets : onDetector.getSkippedPackets()) { + PrintWriterUtils.println(skippedPackets, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); + } + PrintWriterUtils.println(offMaximumSkippedPackets, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); + for (Integer skippedPackets : offDetector.getSkippedPackets()) { + PrintWriterUtils.println(skippedPackets, resultsWriter, DUPLICATE_OUTPUT_TO_STD_OUT); + } + } // Flush output to results file and close it. resultsWriter.flush(); resultsWriter.close(); @@ -245,7 +260,7 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb /** * In charge of reassembling layer 2 packet flows. */ - private final Layer2FlowReassembler mFlowReassembler = new Layer2FlowReassembler(); + private Layer2FlowReassembler mFlowReassembler; private final List mObservers = new ArrayList<>(); @@ -261,14 +276,15 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb public Layer2SignatureDetector(List>> searchedSignature, String trainingRouterWlanMac, String routerWlanMac, int signatureDuration, boolean isRangeBased, double eps, - int limitSkippedPackets) { + int limitSkippedPackets, String vpnClientMacAddress) { this(searchedSignature, trainingRouterWlanMac, routerWlanMac, null, signatureDuration, isRangeBased, - eps, limitSkippedPackets); + eps, limitSkippedPackets, vpnClientMacAddress); } public Layer2SignatureDetector(List>> searchedSignature, String trainingRouterWlanMac, String routerWlanMac, List> flowFilters, - int inclusionTimeMillis, boolean isRangeBased, double eps, int limitSkippedPackets) { + int inclusionTimeMillis, boolean isRangeBased, double eps, int limitSkippedPackets, + String vpnClientMacAddress) { if (flowFilters != null && flowFilters.size() != searchedSignature.size()) { throw new IllegalArgumentException("If flow filters are used, there must be a flow filter for each cluster " + "of the signature."); @@ -296,6 +312,11 @@ public class Layer2SignatureDetector implements PacketListener, ClusterMatcherOb } mClusterMatcherIds = Collections.unmodifiableMap(clusterMatcherIds); // Register all cluster matchers to receive a notification whenever a new flow is encountered. + if (vpnClientMacAddress != null) { + mFlowReassembler = new Layer2FlowReassembler(vpnClientMacAddress); + } else { + mFlowReassembler = new Layer2FlowReassembler(); + } mClusterMatchers.forEach(cm -> mFlowReassembler.addObserver(cm)); mInclusionTimeMillis = inclusionTimeMillis == 0 ? TriggerTrafficExtractor.INCLUSION_WINDOW_MILLIS : inclusionTimeMillis;