hostage/src/de/tudarmstadt/informatik/hostage/ConnectionGuard.java

package de.tudarmstadt.informatik.hostage;

import android.util.Log;

/**
 * Class used to detect port scans. 
 * We assume a port scan if at least 2 different ports get a connection in a small amount of time.
 *
 */
public class ConnectionGuard {

	private final static ConnectionGuard INSTANCE = new ConnectionGuard();

	private ConnectionGuard() {
	}

	/**
	 * Intervall between 2 connection in wich we assume a port scan
	 */
	public final static long TIMESTAMP_THRESHOLD_MS = 60000;

	private static long lastConnectionTimestamp = 0;
	private static long lastPortscanTimestamp = 0;
	private static String lastIP = "";
	private static int lastPort = 0;

	/**
	 * Register a connection for port scan detection. Stores information about the last connection.
	 * @param port The local port used for communication.
	 * @param ip The IP address of the remote device.
	 * @return True if a port scan has been detected.
	 */
	public synchronized static boolean registerConnection(int port, String ip) {
		long timestamp = System.currentTimeMillis();
		boolean result = detectedPortscan(port, ip, timestamp);
		
		lastConnectionTimestamp = timestamp;
		if (result) {
			lastPortscanTimestamp = timestamp;
		}
		lastIP = ip;
		lastPort = port;
		return result;
	}

	public synchronized static boolean portscanInProgress() {
		return (System.currentTimeMillis() - lastPortscanTimestamp) < TIMESTAMP_THRESHOLD_MS;
	}
	
	/**
	 * Check if the new connection is part of a port scan attack.
	 * @param port The local port used for communication.
	 * @param ip The IP address of the remote device.
	 * @param timestamp Time stamp of connection
	 * @return True if a port scan has been detected.
	 */
	private synchronized static boolean detectedPortscan(int port, String ip, long timestamp) {
		Log.i("Alte Werte:", "LastTime: " + lastConnectionTimestamp + " ,LastIP: " + lastIP + ", lastPort:" + port);
		Log.i("Alte Werte:", "Time: " + timestamp + " ,IP: " + ip + ", Port:" + port);
		boolean result = false;
		boolean belowThreshold = ((timestamp - lastConnectionTimestamp) < TIMESTAMP_THRESHOLD_MS);
		boolean sameIP = (lastIP.equals(ip));
		boolean samePort = (lastPort == port);
		if (sameIP && belowThreshold && !samePort) {
			result = true;
		}
		
		return result;
	}
}