statistics.cpp 42 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931
  1. #include <iostream>
  2. #include <fstream>
  3. #include <vector>
  4. #include <math.h>
  5. #include "statistics.h"
  6. #include <sstream>
  7. #include <SQLiteCpp/SQLiteCpp.h>
  8. #include "statistics_db.h"
  9. #include "statistics.h"
  10. #include "utilities.h"
  11. using namespace Tins;
  12. /**
  13. * Checks if there is a payload and increments payloads counter.
  14. * @param pdu_l4 The packet that should be checked if it has a payload or not.
  15. */
  16. void statistics::checkPayload(const PDU *pdu_l4) {
  17. if(this->getDoExtraTests()) {
  18. // pdu_l4: Tarnsport layer 4
  19. int pktSize = pdu_l4->size();
  20. int headerSize = pdu_l4->header_size(); // TCP/UDP header
  21. int payloadSize = pktSize - headerSize;
  22. if (payloadSize > 0)
  23. payloadCount++;
  24. }
  25. }
  26. /**
  27. * Checks the correctness of TCP checksum and increments counter if the checksum was incorrect.
  28. * @param ipAddressSender The source IP.
  29. * @param ipAddressReceiver The destination IP.
  30. * @param tcpPkt The packet to get checked.
  31. */
  32. void statistics::checkTCPChecksum(const std::string &ipAddressSender, const std::string &ipAddressReceiver, TCP tcpPkt) {
  33. if(this->getDoExtraTests()) {
  34. if(check_tcpChecksum(ipAddressSender, ipAddressReceiver, tcpPkt))
  35. correctTCPChecksumCount++;
  36. else incorrectTCPChecksumCount++;
  37. }
  38. }
  39. /**
  40. * Calculates entropy of the source and destination IPs in a time interval.
  41. * @param intervalStartTimestamp The timstamp where the interval starts.
  42. * @return a vector: contains source IP entropy and destination IP entropy.
  43. */
  44. std::vector<double> statistics::calculateLastIntervalIPsEntropy(std::chrono::microseconds intervalStartTimestamp){
  45. if(this->getDoExtraTests()) {
  46. // TODO: change datastructures
  47. std::vector<long> IPsSrcPktsCounts;
  48. std::vector<long> IPsDstPktsCounts;
  49. std::vector<long> IPsSrcNovelPktsCounts;
  50. std::vector<long> IPsDstNovelPktsCounts;
  51. std::vector<double> IPsSrcProb;
  52. std::vector<double> IPsDstProb;
  53. std::vector<double> IPsSrcNovelProb;
  54. std::vector<double> IPsDstNovelProb;
  55. long pktsSent = 0, pktsReceived = 0, novelPktsSent = 0, novelPktsReceived = 0;
  56. for (auto i = ip_statistics.begin(); i != ip_statistics.end(); i++) {
  57. long IPsSrcPktsCount = 0;
  58. long IPsSrcNovelPktsCount = 0;
  59. if (intervalCumIPStats.count(i->first) == 0) {
  60. IPsSrcPktsCount = i->second.pkts_sent;
  61. IPsSrcNovelPktsCount = i->second.pkts_sent;
  62. IPsSrcNovelPktsCounts.push_back(IPsSrcNovelPktsCount);
  63. novelPktsSent += IPsSrcNovelPktsCount;
  64. } else {
  65. IPsSrcPktsCount = i->second.pkts_sent-intervalCumIPStats[i->first].pkts_sent;
  66. }
  67. if(IPsSrcPktsCount != 0) {
  68. IPsSrcPktsCounts.push_back(IPsSrcPktsCount);
  69. pktsSent += IPsSrcPktsCount;
  70. }
  71. long IPsDstPktsCount = 0;
  72. long IPsDstNovelPktsCount = 0;
  73. if (intervalCumIPStats.count(i->first) == 0) {
  74. IPsDstPktsCount = i->second.pkts_received;
  75. IPsDstNovelPktsCount = i->second.pkts_received;
  76. IPsDstNovelPktsCounts.push_back(IPsDstNovelPktsCount);
  77. novelPktsReceived += IPsDstNovelPktsCount;
  78. } else {
  79. IPsDstPktsCount = i->second.pkts_received-intervalCumIPStats[i->first].pkts_received;
  80. }
  81. if(IPsDstPktsCount != 0) {
  82. IPsDstPktsCounts.push_back(IPsDstPktsCount);
  83. pktsReceived += IPsDstPktsCount;
  84. }
  85. }
  86. for (auto i = IPsSrcPktsCounts.begin(); i != IPsSrcPktsCounts.end(); i++) {
  87. IPsSrcProb.push_back(static_cast<double>(*i) / static_cast<double>(pktsSent));
  88. }
  89. for (auto i = IPsDstPktsCounts.begin(); i != IPsDstPktsCounts.end(); i++) {
  90. IPsDstProb.push_back(static_cast<double>(*i) / static_cast<double>(pktsReceived));
  91. }
  92. for (auto i = IPsSrcNovelPktsCounts.begin(); i != IPsSrcNovelPktsCounts.end(); i++) {
  93. IPsSrcNovelProb.push_back(static_cast<double>(*i) / static_cast<double>(novelPktsSent));
  94. }
  95. for (auto i = IPsDstNovelPktsCounts.begin(); i != IPsDstNovelPktsCounts.end(); i++) {
  96. IPsDstNovelProb.push_back(static_cast<double>(*i) / static_cast<double>(novelPktsReceived));
  97. }
  98. // Calculate IP source entropy
  99. double IPsSrcEntropy = 0;
  100. for (unsigned i = 0; i < IPsSrcProb.size(); i++) {
  101. if (IPsSrcProb[i] > 0)
  102. IPsSrcEntropy += -IPsSrcProb[i] * log2(IPsSrcProb[i]);
  103. }
  104. // Calculate IP destination entropy
  105. double IPsDstEntropy = 0;
  106. for (unsigned i = 0; i < IPsDstProb.size(); i++) {
  107. if (IPsDstProb[i] > 0)
  108. IPsDstEntropy += -IPsDstProb[i] * log2(IPsDstProb[i]);
  109. }
  110. // Calculate IP source novel entropy
  111. double IPsSrcNovelEntropy = 0;
  112. for (unsigned i = 0; i < IPsSrcNovelProb.size(); i++) {
  113. if (IPsSrcNovelProb[i] > 0)
  114. IPsSrcNovelEntropy += -IPsSrcNovelProb[i] * log2(IPsSrcNovelProb[i]);
  115. }
  116. // Calculate IP destination novel entropy
  117. double IPsDstNovelEntropy = 0;
  118. for (unsigned i = 0; i < IPsDstNovelProb.size(); i++) {
  119. if (IPsDstNovelProb[i] > 0)
  120. IPsDstNovelEntropy += -IPsDstNovelProb[i] * log2(IPsDstNovelProb[i]);
  121. }
  122. this->ip_src_novel_count = IPsSrcNovelPktsCounts.size();
  123. this->ip_dst_novel_count = IPsDstNovelPktsCounts.size();
  124. double norm_src_entropy = 0;
  125. if (IPsSrcPktsCounts.size() > 0 && log2(IPsSrcPktsCounts.size()) > 0) {
  126. norm_src_entropy = IPsSrcEntropy / log2(IPsSrcPktsCounts.size());
  127. }
  128. double norm_dst_entropy = 0;
  129. if (IPsDstPktsCounts.size() > 0 && log2(IPsDstPktsCounts.size()) > 0) {
  130. norm_dst_entropy = IPsDstEntropy / log2(IPsDstPktsCounts.size());
  131. }
  132. double norm_novel_src_entropy = 0;
  133. if (IPsSrcNovelPktsCounts.size() > 0 && log2(IPsSrcNovelPktsCounts.size()) > 0) {
  134. norm_novel_src_entropy = IPsSrcNovelEntropy / log2(IPsSrcNovelPktsCounts.size());
  135. }
  136. double norm_novel_dst_entropy = 0;
  137. if (IPsDstNovelPktsCounts.size() > 0 && log2(IPsDstNovelPktsCounts.size()) > 0) {
  138. norm_novel_dst_entropy = IPsDstNovelEntropy / log2(IPsDstNovelPktsCounts.size());
  139. }
  140. std::vector<double> entropies = {IPsSrcEntropy, IPsDstEntropy, IPsSrcNovelEntropy, IPsDstNovelEntropy, norm_src_entropy, norm_dst_entropy, norm_novel_src_entropy, norm_novel_dst_entropy};
  141. return entropies;
  142. }
  143. else {
  144. return {-1, -1, -1, -1, -1, -1, -1, -1};
  145. }
  146. }
  147. /**
  148. * Calculates the cumulative entropy of the source and destination IPs, i.e., the entropy for packets from the beginning of the pcap file.
  149. * @return a vector: contains the cumulative entropies of source and destination IPs
  150. */
  151. std::vector<double> statistics::calculateIPsCumEntropy(){
  152. if(this->getDoExtraTests()) {
  153. std::vector <std::string> IPs;
  154. std::vector <double> IPsSrcProb;
  155. std::vector <double> IPsDstProb;
  156. for (auto i = ip_statistics.begin(); i != ip_statistics.end(); i++) {
  157. IPs.push_back(i->first);
  158. IPsSrcProb.push_back(static_cast<double>(i->second.pkts_sent)/static_cast<double>(packetCount));
  159. IPsDstProb.push_back(static_cast<double>(i->second.pkts_received)/static_cast<double>(packetCount));
  160. }
  161. // Calculate IP source entropy
  162. double IPsSrcEntropy = 0;
  163. for(unsigned i=0; i < IPsSrcProb.size();i++){
  164. if (IPsSrcProb[i] > 0)
  165. IPsSrcEntropy += - IPsSrcProb[i]*log2(IPsSrcProb[i]);
  166. }
  167. // Calculate IP destination entropy
  168. double IPsDstEntropy = 0;
  169. for(unsigned i=0; i < IPsDstProb.size();i++){
  170. if (IPsDstProb[i] > 0)
  171. IPsDstEntropy += - IPsDstProb[i]*log2(IPsDstProb[i]);
  172. }
  173. double norm_src_entropy = 0;
  174. if (IPsSrcProb.size() > 0 && log2(IPsDstProb.size()) > 0) {
  175. norm_src_entropy = IPsSrcEntropy / log2(IPsSrcProb.size());
  176. }
  177. double norm_dst_entropy = 0;
  178. if (IPsDstProb.size() > 0 && log2(IPsDstProb.size()) > 0) {
  179. norm_dst_entropy = IPsDstEntropy / log2(IPsDstProb.size());
  180. }
  181. std::vector<double> entropies = {IPsSrcEntropy, IPsDstEntropy, norm_src_entropy, norm_dst_entropy};
  182. return entropies;
  183. }
  184. else {
  185. return {-1, -1, -1, -1};
  186. }
  187. }
  188. /**
  189. * Calculates sending packet rate for each IP in a time interval. Finds min and max packet rate and adds them to ip_statistics map.
  190. * @param intervalStartTimestamp The timstamp where the interval starts.
  191. */
  192. void statistics::calculateIPIntervalPacketRate(std::chrono::duration<int, std::micro> interval, std::chrono::microseconds intervalStartTimestamp){
  193. for (auto i = ip_statistics.begin(); i != ip_statistics.end(); i++) {
  194. int IPsSrcPktsCount = 0;
  195. for (auto j = i->second.pkts_sent_timestamp.begin(); j != i->second.pkts_sent_timestamp.end(); j++) {
  196. if(*j >= intervalStartTimestamp)
  197. IPsSrcPktsCount++;
  198. }
  199. float interval_pkt_rate = (float) IPsSrcPktsCount * 1000000 / interval.count(); // used 10^6 because interval in microseconds
  200. i->second.interval_pkt_rate.push_back(interval_pkt_rate);
  201. if(interval_pkt_rate > i->second.max_interval_pkt_rate || i->second.max_interval_pkt_rate == 0)
  202. i->second.max_interval_pkt_rate = interval_pkt_rate;
  203. if(interval_pkt_rate < i->second.min_interval_pkt_rate || i->second.min_interval_pkt_rate == 0)
  204. i->second.min_interval_pkt_rate = interval_pkt_rate;
  205. }
  206. }
  207. /**
  208. * Calculates the entropies for the count of integer values.
  209. * @param current map containing the values with counts
  210. * @param an old map containing the values with counts (from last iteration)
  211. * @return a vector containing the calculated entropies: entropy of all updated values, entropy of all novel values, normalized entropy of all, normalized entropy of novel
  212. */
  213. std::vector<double> statistics::calculateEntropies(std::unordered_map<int, int> &map, std::unordered_map<int, int> &old) {
  214. std::vector<double> counts;
  215. int count_total = 0;
  216. double entropy = 0.0;
  217. std::vector<double> novel_counts;
  218. int novel_count_total = 0;
  219. double novel_entropy = 0.0;
  220. // iterate over all values
  221. for (auto iter: map) {
  222. if (old.count(iter.first) == 0) {
  223. // count novel values
  224. double novel_count = static_cast<double>(iter.second);
  225. counts.push_back(novel_count);
  226. count_total += novel_count;
  227. novel_counts.push_back(novel_count);
  228. novel_count_total += novel_count;
  229. } else if (iter.second != old[iter.first]) {
  230. // count all increased values
  231. double count = static_cast<double>(iter.second-old[iter.first]);
  232. if (count != 0.0) {
  233. counts.push_back(count);
  234. count_total += count;
  235. }
  236. }
  237. }
  238. // calculate entropy
  239. for (auto count: counts) {
  240. double prob = count / static_cast<double>(count_total);
  241. entropy += -1 * prob * log2(prob);
  242. }
  243. // calculate novelty entropy
  244. for (auto novel_count: novel_counts) {
  245. double novel_prob = novel_count / static_cast<double>(novel_count_total);
  246. novel_entropy += -1 * novel_prob * log2(novel_prob);
  247. }
  248. double norm_entropy = 0;
  249. if (counts.size() > 0 && log2(counts.size()) > 0) {
  250. norm_entropy = entropy / log2(counts.size());
  251. }
  252. double norm_novel_entropy = 0;
  253. if (novel_counts.size() > 0 && log2(novel_counts.size()) > 0) {
  254. norm_novel_entropy = novel_entropy / log2(novel_counts.size());
  255. }
  256. return {entropy, novel_entropy, norm_entropy, norm_novel_entropy};
  257. }
  258. /**
  259. * Registers statistical data for a time interval.
  260. * @param intervalStartTimestamp The timstamp where the interval starts.
  261. * @param intervalEndTimestamp The timstamp where the interval ends.
  262. * @param previousPacketCount The total number of packets in last interval.
  263. */
  264. void statistics::addIntervalStat(std::chrono::duration<int, std::micro> interval, std::chrono::microseconds intervalStartTimestamp, std::chrono::microseconds intervalEndTimestamp){
  265. // Add packet rate for each IP to ip_statistics map
  266. calculateIPIntervalPacketRate(interval, intervalStartTimestamp);
  267. std::vector<double> ipEntopies = calculateLastIntervalIPsEntropy(intervalStartTimestamp);
  268. std::vector<double> ipCumEntopies = calculateIPsCumEntropy();
  269. std::string lastPktTimestamp_s = std::to_string(intervalEndTimestamp.count());
  270. std::string intervalStartTimestamp_s = std::to_string(intervalStartTimestamp.count());
  271. // The intervalStartTimestamp_s is the previous interval lastPktTimestamp_s
  272. // TODO: check with carlos if first and last packet timestamps are alright
  273. interval_statistics[lastPktTimestamp_s].start = std::to_string(intervalStartTimestamp.count());
  274. interval_statistics[lastPktTimestamp_s].end = std::to_string(intervalEndTimestamp.count());
  275. interval_statistics[lastPktTimestamp_s].pkts_count = packetCount - intervalCumPktCount;
  276. interval_statistics[lastPktTimestamp_s].pkt_rate = static_cast<float>(interval_statistics[lastPktTimestamp_s].pkts_count) / (static_cast<double>(interval.count()) / 1000000);
  277. interval_statistics[lastPktTimestamp_s].kbytes = static_cast<float>(sumPacketSize - intervalCumSumPktSize) / 1024;
  278. interval_statistics[lastPktTimestamp_s].kbyte_rate = interval_statistics[lastPktTimestamp_s].kbytes / (static_cast<double>(interval.count()) / 1000000);
  279. interval_statistics[lastPktTimestamp_s].payload_count = payloadCount - intervalPayloadCount;
  280. interval_statistics[lastPktTimestamp_s].incorrect_tcp_checksum_count = incorrectTCPChecksumCount - intervalIncorrectTCPChecksumCount;
  281. interval_statistics[lastPktTimestamp_s].correct_tcp_checksum_count = correctTCPChecksumCount - intervalCorrectTCPChecksumCount;
  282. interval_statistics[lastPktTimestamp_s].novel_ip_src_count = this->ip_src_novel_count;
  283. interval_statistics[lastPktTimestamp_s].novel_ip_dst_count = this->ip_dst_novel_count;
  284. interval_statistics[lastPktTimestamp_s].novel_ttl_count = static_cast<int>(ttl_values.size()) - intervalCumNovelTTLCount;
  285. interval_statistics[lastPktTimestamp_s].novel_win_size_count = static_cast<int>(win_values.size()) - intervalCumNovelWinSizeCount;
  286. interval_statistics[lastPktTimestamp_s].novel_tos_count = static_cast<int>(tos_values.size()) - intervalCumNovelToSCount;
  287. interval_statistics[lastPktTimestamp_s].novel_mss_count = static_cast<int>(mss_values.size()) - intervalCumNovelMSSCount;
  288. interval_statistics[lastPktTimestamp_s].novel_port_count = static_cast<int>(port_values.size()) - intervalCumNovelPortCount;
  289. interval_statistics[lastPktTimestamp_s].ttl_entropies = calculateEntropies(ttl_values, intervalCumTTLValues);
  290. interval_statistics[lastPktTimestamp_s].win_size_entropies = calculateEntropies(win_values, intervalCumWinSizeValues);
  291. interval_statistics[lastPktTimestamp_s].tos_entropies = calculateEntropies(tos_values, intervalCumTosValues);
  292. interval_statistics[lastPktTimestamp_s].mss_entropies = calculateEntropies(mss_values, intervalCumMSSValues);
  293. interval_statistics[lastPktTimestamp_s].port_entropies = calculateEntropies(port_values, intervalCumPortValues);
  294. intervalPayloadCount = payloadCount;
  295. intervalIncorrectTCPChecksumCount = incorrectTCPChecksumCount;
  296. intervalCorrectTCPChecksumCount = correctTCPChecksumCount;
  297. intervalCumPktCount = packetCount;
  298. intervalCumSumPktSize = sumPacketSize;
  299. intervalCumNovelIPCount = static_cast<int>(ip_statistics.size());
  300. intervalCumNovelTTLCount = static_cast<int>(ttl_values.size());
  301. intervalCumNovelWinSizeCount = static_cast<int>(win_values.size());
  302. intervalCumNovelToSCount =static_cast<int>(tos_values.size());
  303. intervalCumNovelMSSCount = static_cast<int>(mss_values.size());
  304. intervalCumNovelPortCount = static_cast<int>(port_values.size());
  305. intervalCumIPStats = ip_statistics;
  306. intervalCumTTLValues = ttl_values;
  307. intervalCumWinSizeValues = win_values;
  308. intervalCumTosValues = tos_values;
  309. intervalCumMSSValues = mss_values;
  310. intervalCumPortValues = port_values;
  311. interval_statistics[lastPktTimestamp_s].ip_entropies = ipEntopies;
  312. interval_statistics[lastPktTimestamp_s].ip_cum_entropies = ipCumEntopies;
  313. }
  314. /**
  315. * Registers statistical data for a sent packet in a given conversation (two IPs, two ports).
  316. * Increments the counter packets_A_B or packets_B_A.
  317. * Adds the timestamp of the packet in pkts_A_B_timestamp or pkts_B_A_timestamp.
  318. * @param ipAddressSender The sender IP address.
  319. * @param sport The source port.
  320. * @param ipAddressReceiver The receiver IP address.
  321. * @param dport The destination port.
  322. * @param timestamp The timestamp of the packet.
  323. */
  324. void statistics::addConvStat(const std::string &ipAddressSender,int sport,const std::string &ipAddressReceiver,int dport, std::chrono::microseconds timestamp, small_uint<12> flags){
  325. conv f1 = {ipAddressReceiver, dport, ipAddressSender, sport};
  326. conv f2 = {ipAddressSender, sport, ipAddressReceiver, dport};
  327. // if already exist A(ipAddressReceiver, dport), B(ipAddressSender, sport) conversation
  328. if (conv_statistics.count(f1)>0){
  329. conv_statistics[f1].pkts_count++;
  330. if(conv_statistics[f1].pkts_count<=3)
  331. conv_statistics[f1].interarrival_time.push_back(std::chrono::duration_cast<std::chrono::microseconds> (timestamp - conv_statistics[f1].pkts_timestamp.back()));
  332. conv_statistics[f1].pkts_timestamp.push_back(timestamp);
  333. conv_statistics[f1].tcp_types.push_back(flags);
  334. }
  335. // Add new conversation A(ipAddressSender, sport), B(ipAddressReceiver, dport)
  336. else{
  337. conv_statistics[f2].pkts_count++;
  338. if(conv_statistics[f2].pkts_timestamp.size()>0 && conv_statistics[f2].pkts_count<=3 )
  339. conv_statistics[f2].interarrival_time.push_back(std::chrono::duration_cast<std::chrono::microseconds> (timestamp - conv_statistics[f2].pkts_timestamp.back()));
  340. conv_statistics[f2].pkts_timestamp.push_back(timestamp);
  341. conv_statistics[f2].tcp_types.push_back(flags);
  342. }
  343. }
  344. /**
  345. * Registers statistical data for a sent packet in a given extended conversation (two IPs, two ports, protocol).
  346. * Increments the counter packets_A_B or packets_B_A.
  347. * Adds the timestamp of the packet in pkts_A_B_timestamp or pkts_B_A_timestamp.
  348. * Updates all other statistics of conv_statistics_extended
  349. * @param ipAddressSender The sender IP address.
  350. * @param sport The source port.
  351. * @param ipAddressReceiver The receiver IP address.
  352. * @param dport The destination port.
  353. * @param protocol The used protocol.
  354. * @param timestamp The timestamp of the packet.
  355. */
  356. void statistics::addConvStatExt(const std::string &ipAddressSender,int sport,const std::string &ipAddressReceiver,int dport,const std::string &protocol, std::chrono::microseconds timestamp){
  357. if(this->getDoExtraTests()) {
  358. convWithProt f1 = {ipAddressReceiver, dport, ipAddressSender, sport, protocol};
  359. convWithProt f2 = {ipAddressSender, sport, ipAddressReceiver, dport, protocol};
  360. convWithProt f;
  361. // if there already exists a communication interval for the specified conversation
  362. if (conv_statistics_extended.count(f1) > 0 || conv_statistics_extended.count(f2) > 0){
  363. // find out which direction of conversation is contained in conv_statistics_extended
  364. if (conv_statistics_extended.count(f1) > 0)
  365. f = f1;
  366. else
  367. f = f2;
  368. // increase pkts count and check on delay
  369. conv_statistics_extended[f].pkts_count++;
  370. if (conv_statistics_extended[f].pkts_timestamp.size()>0 && conv_statistics_extended[f].pkts_count<=3)
  371. conv_statistics_extended[f].interarrival_time.push_back(std::chrono::duration_cast<std::chrono::microseconds> (timestamp - conv_statistics_extended[f].pkts_timestamp.back()));
  372. conv_statistics_extended[f].pkts_timestamp.push_back(timestamp);
  373. // if the time difference has exceeded the threshold, create a new interval with this message
  374. if (timestamp - conv_statistics_extended[f].comm_intervals.back().end > (std::chrono::microseconds) ((unsigned long) COMM_INTERVAL_THRESHOLD)) { // > or >= ?
  375. commInterval new_interval = {timestamp, timestamp, 1};
  376. conv_statistics_extended[f].comm_intervals.push_back(new_interval);
  377. }
  378. // otherwise, set the time of the last interval message to the current timestamp and increase interval packet count by 1
  379. else{
  380. conv_statistics_extended[f].comm_intervals.back().end = timestamp;
  381. conv_statistics_extended[f].comm_intervals.back().pkts_count++;
  382. }
  383. }
  384. // if there does not exist a communication interval for the specified conversation
  385. else{
  386. // add initial interval entry for this conversation
  387. commInterval initial_interval = {timestamp, timestamp, 1};
  388. entry_convStatExt entry;
  389. entry.comm_intervals.push_back(initial_interval);
  390. entry.pkts_count = 1;
  391. entry.pkts_timestamp.push_back(timestamp);
  392. conv_statistics_extended[f2] = entry;
  393. }
  394. }
  395. }
  396. /**
  397. * Aggregate the collected information about all communication intervals within conv_statistics_extended of every conversation.
  398. * Do this by computing the average packet rate per interval and the average time between intervals.
  399. * Also compute average interval duration and total communication duration (i.e. last_msg.time - first_msg.time)
  400. */
  401. void statistics::createCommIntervalStats(){
  402. // iterate over all <convWithProt, entry_convStatExt> pairs
  403. for (auto &cur_elem : conv_statistics_extended) {
  404. entry_convStatExt &entry = cur_elem.second;
  405. std::vector<commInterval> &intervals = entry.comm_intervals;
  406. // if there is only one interval, the time between intervals cannot be computed and is therefore set to 0
  407. if (intervals.size() == 1){
  408. double interval_duration = (double) (intervals[0].end - intervals[0].start).count() / (double) 1e6;
  409. entry.avg_int_pkts_count = (double) intervals[0].pkts_count;
  410. entry.avg_time_between_ints = (double) 0;
  411. entry.avg_interval_time = interval_duration;
  412. }
  413. // If there is more than one interval, compute the specified averages
  414. else if (intervals.size() > 1){
  415. long summed_pkts_count = intervals[0].pkts_count;
  416. std::chrono::microseconds time_between_ints_sum = (std::chrono::microseconds) 0;
  417. std::chrono::microseconds summed_int_duration = intervals[0].end - intervals[0].start;
  418. for (std::size_t i = 1; i < intervals.size(); i++) {
  419. summed_pkts_count += intervals[i].pkts_count;
  420. summed_int_duration += intervals[i].end - intervals[i].start;
  421. time_between_ints_sum += intervals[i].start - intervals[i - 1].end;
  422. }
  423. entry.avg_int_pkts_count = summed_pkts_count / ((double) intervals.size());
  424. entry.avg_time_between_ints = (time_between_ints_sum.count() / (double) (intervals.size() - 1)) / (double) 1e6;
  425. entry.avg_interval_time = (summed_int_duration.count() / (double) intervals.size()) / (double) 1e6;
  426. }
  427. entry.total_comm_duration = (double) (entry.pkts_timestamp.back() - entry.pkts_timestamp.front()).count() / (double) 1e6;
  428. }
  429. }
  430. /**
  431. * Increments the packet counter for the given IP address and MSS value.
  432. * @param ipAddress The IP address whose MSS packet counter should be incremented.
  433. * @param mssValue The MSS value of the packet.
  434. */
  435. void statistics::incrementMSScount(const std::string &ipAddress, int mssValue) {
  436. mss_values[mssValue]++;
  437. mss_distribution[{ipAddress, mssValue}]++;
  438. }
  439. /**
  440. * Increments the packet counter for the given IP address and window size.
  441. * @param ipAddress The IP address whose window size packet counter should be incremented.
  442. * @param winSize The window size of the packet.
  443. */
  444. void statistics::incrementWinCount(const std::string &ipAddress, int winSize) {
  445. win_values[winSize]++;
  446. win_distribution[{ipAddress, winSize}]++;
  447. }
  448. /**
  449. * Increments the packet counter for the given IP address and TTL value.
  450. * @param ipAddress The IP address whose TTL packet counter should be incremented.
  451. * @param ttlValue The TTL value of the packet.
  452. */
  453. void statistics::incrementTTLcount(const std::string &ipAddress, int ttlValue) {
  454. ttl_values[ttlValue]++;
  455. ttl_distribution[{ipAddress, ttlValue}]++;
  456. }
  457. /**
  458. * Increments the packet counter for the given IP address and ToS value.
  459. * @param ipAddress The IP address whose ToS packet counter should be incremented.
  460. * @param tosValue The ToS value of the packet.
  461. */
  462. void statistics::incrementToScount(const std::string &ipAddress, int tosValue) {
  463. tos_values[tosValue]++;
  464. tos_distribution[{ipAddress, tosValue}]++;
  465. }
  466. /**
  467. * Increments the protocol counter for the given IP address and protocol.
  468. * @param ipAddress The IP address whose protocol packet counter should be incremented.
  469. * @param protocol The protocol of the packet.
  470. */
  471. void statistics::incrementProtocolCount(const std::string &ipAddress, const std::string &protocol) {
  472. protocol_distribution[{ipAddress, protocol}].count++;
  473. }
  474. /**
  475. * Returns the number of packets seen for the given IP address and protocol.
  476. * @param ipAddress The IP address whose packet count is wanted.
  477. * @param protocol The protocol whose packet count is wanted.
  478. */
  479. int statistics::getProtocolCount(const std::string &ipAddress, const std::string &protocol) {
  480. return protocol_distribution[{ipAddress, protocol}].count;
  481. }
  482. /**
  483. * Increases the byte counter for the given IP address and protocol.
  484. * @param ipAddress The IP address whose protocol byte counter should be increased.
  485. * @param protocol The protocol of the packet.
  486. * @param byteSent The packet's size.
  487. */
  488. void statistics::increaseProtocolByteCount(const std::string &ipAddress, const std::string &protocol, long bytesSent) {
  489. protocol_distribution[{ipAddress, protocol}].byteCount += bytesSent;
  490. }
  491. /**
  492. * Returns the number of bytes seen for the given IP address and protocol.
  493. * @param ipAddress The IP address whose byte count is wanted.
  494. * @param protocol The protocol whose byte count is wanted.
  495. * @return a float: The number of bytes
  496. */
  497. float statistics::getProtocolByteCount(const std::string &ipAddress, const std::string &protocol) {
  498. return protocol_distribution[{ipAddress, protocol}].byteCount;
  499. }
  500. /**
  501. * Increments the packet counter for
  502. * - the given sender IP address with outgoing port and
  503. * - the given receiver IP address with incoming port.
  504. * @param ipAddressSender The IP address of the packet sender.
  505. * @param outgoingPort The port used by the sender.
  506. * @param ipAddressReceiver The IP address of the packet receiver.
  507. * @param incomingPort The port used by the receiver.
  508. */
  509. void statistics::incrementPortCount(const std::string &ipAddressSender, int outgoingPort, const std::string &ipAddressReceiver,
  510. int incomingPort, const std::string &protocol) {
  511. port_values[outgoingPort]++;
  512. port_values[incomingPort]++;
  513. ip_ports[{ipAddressSender, "out", outgoingPort, protocol}].count++;
  514. ip_ports[{ipAddressReceiver, "in", incomingPort, protocol}].count++;
  515. }
  516. /**
  517. * Increases the packet byte counter for
  518. * - the given sender IP address with outgoing port and
  519. * - the given receiver IP address with incoming port.
  520. * @param ipAddressSender The IP address of the packet sender.
  521. * @param outgoingPort The port used by the sender.
  522. * @param ipAddressReceiver The IP address of the packet receiver.
  523. * @param incomingPort The port used by the receiver.
  524. * @param byteSent The packet's size.
  525. */
  526. void statistics::increasePortByteCount(const std::string &ipAddressSender, int outgoingPort, const std::string &ipAddressReceiver,
  527. int incomingPort, long bytesSent, const std::string &protocol) {
  528. ip_ports[{ipAddressSender, "out", outgoingPort, protocol}].byteCount += bytesSent;
  529. ip_ports[{ipAddressReceiver, "in", incomingPort, protocol}].byteCount += bytesSent;
  530. }
  531. /**
  532. * Increments the packet counter for
  533. * - the given sender MAC address and
  534. * - the given receiver MAC address.
  535. * @param srcMac The MAC address of the packet sender.
  536. * @param dstMac The MAC address of the packet receiver.
  537. * @param typeNumber The payload type number of the packet.
  538. */
  539. void statistics::incrementUnrecognizedPDUCount(const std::string &srcMac, const std::string &dstMac, uint32_t typeNumber,
  540. const std::string &timestamp) {
  541. unrecognized_PDUs[{srcMac, dstMac, typeNumber}].count++;
  542. unrecognized_PDUs[{srcMac, dstMac, typeNumber}].timestamp_last_occurrence = timestamp;
  543. }
  544. /**
  545. * Creates a new statistics object.
  546. */
  547. statistics::statistics(std::string resourcePath) {;
  548. this->resourcePath = resourcePath;
  549. }
  550. /**
  551. * Stores the assignment IP address -> MAC address.
  552. * @param ipAddress The IP address belonging to the given MAC address.
  553. * @param macAddress The MAC address belonging to the given IP address.
  554. */
  555. void statistics::assignMacAddress(const std::string &ipAddress, const std::string &macAddress) {
  556. ip_mac_mapping[ipAddress] = macAddress;
  557. }
  558. /**
  559. * Registers statistical data for a sent packet. Increments the counter packets_sent for the sender and
  560. * packets_received for the receiver. Adds the bytes as kbytes_sent (sender) and kybtes_received (receiver).
  561. * @param ipAddressSender The IP address of the packet sender.
  562. * @param ipAddressReceiver The IP address of the packet receiver.
  563. * @param bytesSent The packet's size.
  564. */
  565. void statistics::addIpStat_packetSent(const std::string &ipAddressSender, const std::string &ipAddressReceiver, long bytesSent, std::chrono::microseconds timestamp) {
  566. // Adding IP as a sender for first time
  567. if(ip_statistics[ipAddressSender].pkts_sent==0){
  568. // Add the IP class
  569. ip_statistics[ipAddressSender].ip_class = getIPv4Class(ipAddressSender);
  570. }
  571. // Adding IP as a receiver for first time
  572. if(ip_statistics[ipAddressReceiver].pkts_received==0){
  573. // Add the IP class
  574. ip_statistics[ipAddressReceiver].ip_class = getIPv4Class(ipAddressReceiver);
  575. }
  576. // Update stats for packet sender
  577. ip_statistics[ipAddressSender].kbytes_sent += (float(bytesSent) / 1024);
  578. ip_statistics[ipAddressSender].pkts_sent++;
  579. ip_statistics[ipAddressSender].pkts_sent_timestamp.push_back(timestamp);
  580. // Update stats for packet receiver
  581. ip_statistics[ipAddressReceiver].kbytes_received += (float(bytesSent) / 1024);
  582. ip_statistics[ipAddressReceiver].pkts_received++;
  583. ip_statistics[ipAddressReceiver].pkts_received_timestamp.push_back(timestamp);
  584. if(this->getDoExtraTests()) {
  585. // Increment Degrees for sender and receiver, if Sender sends its first packet to this receiver
  586. std::unordered_set<std::string>::const_iterator found_receiver = contacted_ips[ipAddressSender].find(ipAddressReceiver);
  587. if(found_receiver == contacted_ips[ipAddressSender].end()){
  588. // Receiver is NOT contained in the List of IPs, that the Sender has contacted, therefore this is the first packet in this direction
  589. ip_statistics[ipAddressSender].out_degree++;
  590. ip_statistics[ipAddressReceiver].in_degree++;
  591. // Increment overall_degree only if this is the first packet for the connection (both directions)
  592. // Therefore check, whether Receiver has contacted Sender before
  593. std::unordered_set<std::string>::const_iterator sender_contacted = contacted_ips[ipAddressReceiver].find(ipAddressSender);
  594. if(sender_contacted == contacted_ips[ipAddressReceiver].end()){
  595. ip_statistics[ipAddressSender].overall_degree++;
  596. ip_statistics[ipAddressReceiver].overall_degree++;
  597. }
  598. contacted_ips[ipAddressSender].insert(ipAddressReceiver);
  599. }
  600. }
  601. }
  602. /**
  603. * Setter for the timestamp_firstPacket field.
  604. * @param ts The timestamp of the first packet in the PCAP file.
  605. */
  606. void statistics::setTimestampFirstPacket(Tins::Timestamp ts) {
  607. timestamp_firstPacket = ts;
  608. }
  609. /**
  610. * Setter for the timestamp_lastPacket field.
  611. * @param ts The timestamp of the last packet in the PCAP file.
  612. */
  613. void statistics::setTimestampLastPacket(Tins::Timestamp ts) {
  614. timestamp_lastPacket = ts;
  615. }
  616. /**
  617. * Getter for the timestamp_firstPacket field.
  618. */
  619. Tins::Timestamp statistics::getTimestampFirstPacket() {
  620. return timestamp_firstPacket;
  621. }
  622. /**
  623. * Getter for the timestamp_lastPacket field.
  624. */
  625. Tins::Timestamp statistics::getTimestampLastPacket() {
  626. return timestamp_lastPacket;
  627. }
  628. /**
  629. * Getter for the packetCount field.
  630. */
  631. int statistics::getPacketCount() {
  632. return packetCount;
  633. }
  634. /**
  635. * Getter for the sumPacketSize field.
  636. */
  637. int statistics::getSumPacketSize() {
  638. return sumPacketSize;
  639. }
  640. /**
  641. * Returns the average packet size.
  642. * @return a float indicating the average packet size in kbytes.
  643. */
  644. float statistics::getAvgPacketSize() const {
  645. // AvgPktSize = (Sum of all packet sizes / #Packets)
  646. return (sumPacketSize / packetCount) / 1024;
  647. }
  648. /**
  649. * Adds the size of a packet (to be used to calculate the avg. packet size).
  650. * @param packetSize The size of the current packet in bytes.
  651. */
  652. void statistics::addPacketSize(uint32_t packetSize) {
  653. sumPacketSize += ((float) packetSize);
  654. }
  655. /**
  656. * Setter for the doExtraTests field.
  657. */
  658. void statistics::setDoExtraTests(bool var) {
  659. doExtraTests = var;
  660. }
  661. /**
  662. * Getter for the doExtraTests field.
  663. */
  664. bool statistics::getDoExtraTests() {
  665. return doExtraTests;
  666. }
  667. /**
  668. * Calculates the capture duration.
  669. * @return a formatted string HH:MM:SS.mmmmmm with
  670. * HH: hour, MM: minute, SS: second, mmmmmm: microseconds
  671. */
  672. std::string statistics::getCaptureDurationTimestamp() const {
  673. // Calculate duration
  674. timeval fp, lp, d;
  675. fp.tv_sec = timestamp_firstPacket.seconds();
  676. fp.tv_usec = timestamp_firstPacket.microseconds();
  677. lp.tv_sec = timestamp_lastPacket.seconds();
  678. lp.tv_usec = timestamp_lastPacket.microseconds();
  679. timersub(&lp, &fp, &d);
  680. long int hour = d.tv_sec / 3600;
  681. long int remainder = (d.tv_sec - hour * 3600);
  682. long int minute = remainder / 60;
  683. long int second = (remainder - minute * 60) % 60;
  684. long int microseconds = d.tv_usec;
  685. // Build desired output format: YYYY-mm-dd hh:mm:ss
  686. char out[64];
  687. sprintf(out, "%02ld:%02ld:%02ld.%06ld ", hour, minute, second, microseconds);
  688. return std::string(out);
  689. }
  690. /**
  691. * Calculates the capture duration.
  692. * @return a formatted string SS.mmmmmm with
  693. * S: seconds (UNIX time), mmmmmm: microseconds
  694. */
  695. float statistics::getCaptureDurationSeconds() const {
  696. timeval fp, lp, d;
  697. fp.tv_sec = timestamp_firstPacket.seconds();
  698. fp.tv_usec = timestamp_firstPacket.microseconds();
  699. lp.tv_sec = timestamp_lastPacket.seconds();
  700. lp.tv_usec = timestamp_lastPacket.microseconds();
  701. timersub(&lp, &fp, &d);
  702. char buf[64];
  703. snprintf(buf, sizeof(buf), "%u.%06u", static_cast<uint>(d.tv_sec), static_cast<uint>(d.tv_usec));
  704. return std::stof(std::string(buf));
  705. }
  706. /**
  707. * Creates a timestamp based on a time_t seconds (UNIX time format) and microseconds.
  708. * @param seconds
  709. * @param microseconds
  710. * @return a formatted string Y-m-d H:M:S.m with
  711. * Y: year, m: month, d: day, H: hour, M: minute, S: second, m: microseconds
  712. */
  713. std::string statistics::getFormattedTimestamp(time_t seconds, suseconds_t microseconds) const {
  714. timeval tv;
  715. tv.tv_sec = seconds;
  716. tv.tv_usec = microseconds;
  717. char tmbuf[20], buf[64];
  718. auto nowtm = gmtime(&(tv.tv_sec));
  719. strftime(tmbuf, sizeof(tmbuf), "%Y-%m-%d %H:%M:%S", nowtm);
  720. snprintf(buf, sizeof(buf), "%s.%06u", tmbuf, static_cast<uint>(tv.tv_usec));
  721. return std::string(buf);
  722. }
  723. /**
  724. * Calculates the statistics for a given IP address.
  725. * @param ipAddress The IP address whose statistics should be calculated.
  726. * @return a ip_stats struct containing statistical data derived by the statistical data collected.
  727. */
  728. ip_stats statistics::getStatsForIP(const std::string &ipAddress) {
  729. float duration = getCaptureDurationSeconds();
  730. entry_ipStat ipStatEntry = ip_statistics[ipAddress];
  731. ip_stats s;
  732. s.bandwidthKBitsIn = (ipStatEntry.kbytes_received / duration) * 8;
  733. s.bandwidthKBitsOut = (ipStatEntry.kbytes_sent / duration) * 8;
  734. s.packetPerSecondIn = (ipStatEntry.pkts_received / duration);
  735. s.packetPerSecondOut = (ipStatEntry.pkts_sent / duration);
  736. s.AvgPacketSizeSent = (ipStatEntry.kbytes_sent / ipStatEntry.pkts_sent);
  737. s.AvgPacketSizeRecv = (ipStatEntry.kbytes_received / ipStatEntry.pkts_received);
  738. return s;
  739. }
  740. int statistics::getDefaultInterval() {
  741. return this->default_interval;
  742. }
  743. void statistics::setDefaultInterval(int interval) {
  744. this->default_interval = interval;
  745. }
  746. /**
  747. * Increments the packet counter.
  748. */
  749. void statistics::incrementPacketCount() {
  750. packetCount++;
  751. }
  752. /**
  753. * Prints the statistics of the PCAP and IP specific statistics for the given IP address.
  754. * @param ipAddress The IP address whose statistics should be printed. Can be empty "" to print only general file statistics.
  755. */
  756. void statistics::printStats(const std::string &ipAddress) {
  757. std::stringstream ss;
  758. ss << std::endl;
  759. ss << "Capture duration: " << getCaptureDurationSeconds() << " seconds" << std::endl;
  760. ss << "Capture duration (HH:MM:SS.mmmmmm): " << getCaptureDurationTimestamp() << std::endl;
  761. ss << "#Packets: " << packetCount << std::endl;
  762. ss << std::endl;
  763. // Print IP address specific statistics only if IP address was given
  764. if (ipAddress != "") {
  765. entry_ipStat e = ip_statistics[ipAddress];
  766. ss << "\n----- STATS FOR IP ADDRESS [" << ipAddress << "] -------" << std::endl;
  767. ss << std::endl << "KBytes sent: " << e.kbytes_sent << std::endl;
  768. ss << "KBytes received: " << e.kbytes_received << std::endl;
  769. ss << "Packets sent: " << e.pkts_sent << std::endl;
  770. ss << "Packets received: " << e.pkts_received << "\n\n";
  771. ip_stats is = getStatsForIP(ipAddress);
  772. ss << "Bandwidth IN: " << is.bandwidthKBitsIn << " kbit/s" << std::endl;
  773. ss << "Bandwidth OUT: " << is.bandwidthKBitsOut << " kbit/s" << std::endl;
  774. ss << "Packets per second IN: " << is.packetPerSecondIn << std::endl;
  775. ss << "Packets per second OUT: " << is.packetPerSecondOut << std::endl;
  776. ss << "Avg Packet Size Sent: " << is.AvgPacketSizeSent << " kbytes" << std::endl;
  777. ss << "Avg Packet Size Received: " << is.AvgPacketSizeRecv << " kbytes" << std::endl;
  778. }
  779. std::cout << ss.str();
  780. }
  781. /**
  782. * Derives general PCAP file statistics from the collected statistical data and
  783. * writes all data into a SQLite database, located at database_path.
  784. * @param database_path The path of the SQLite database file ending with .sqlite3.
  785. */
  786. void statistics::writeToDatabase(std::string database_path, std::vector<std::chrono::duration<int, std::micro>> timeIntervals, bool del) {
  787. // Generate general file statistics
  788. float duration = getCaptureDurationSeconds();
  789. long sumPacketsSent = 0, senderCountIP = 0;
  790. float sumBandwidthIn = 0.0, sumBandwidthOut = 0.0;
  791. for (auto i = ip_statistics.begin(); i != ip_statistics.end(); i++) {
  792. sumPacketsSent += i->second.pkts_sent;
  793. // Consumed bandwith (bytes) for sending packets
  794. sumBandwidthIn += (i->second.kbytes_received / duration);
  795. sumBandwidthOut += (i->second.kbytes_sent / duration);
  796. senderCountIP++;
  797. }
  798. float avgPacketRate = (packetCount / duration);
  799. long avgPacketSize = getAvgPacketSize();
  800. if(senderCountIP>0) {
  801. long avgPacketsSentPerHost = (sumPacketsSent / senderCountIP);
  802. float avgBandwidthInKBits = (sumBandwidthIn / senderCountIP) * 8;
  803. float avgBandwidthOutInKBits = (sumBandwidthOut / senderCountIP) * 8;
  804. // Create database and write information
  805. statistics_db db(database_path, resourcePath);
  806. db.writeStatisticsFile(packetCount, getCaptureDurationSeconds(),
  807. getFormattedTimestamp(timestamp_firstPacket.seconds(), timestamp_firstPacket.microseconds()),
  808. getFormattedTimestamp(timestamp_lastPacket.seconds(), timestamp_lastPacket.microseconds()),
  809. avgPacketRate, avgPacketSize, avgPacketsSentPerHost, avgBandwidthInKBits,
  810. avgBandwidthOutInKBits, doExtraTests);
  811. db.writeStatisticsIP(ip_statistics);
  812. db.writeStatisticsTTL(ttl_distribution);
  813. db.writeStatisticsIpMac(ip_mac_mapping);
  814. db.writeStatisticsDegree(ip_statistics);
  815. db.writeStatisticsPorts(ip_ports);
  816. db.writeStatisticsProtocols(protocol_distribution);
  817. db.writeStatisticsMSS(mss_distribution);
  818. db.writeStatisticsToS(tos_distribution);
  819. db.writeStatisticsWin(win_distribution);
  820. db.writeStatisticsConv(conv_statistics);
  821. db.writeStatisticsConvExt(conv_statistics_extended);
  822. db.writeStatisticsInterval(interval_statistics, timeIntervals, del, this->default_interval, this->getDoExtraTests());
  823. db.writeDbVersion();
  824. db.writeStatisticsUnrecognizedPDUs(unrecognized_PDUs);
  825. }
  826. else {
  827. // Tinslib failed to recognize the types of the packets in the input PCAP
  828. std::cerr<<"ERROR: Statistics could not be collected from the input PCAP!"<<"\n";
  829. return;
  830. }
  831. }
  832. void statistics::writeIntervalsToDatabase(std::string database_path, std::vector<std::chrono::duration<int, std::micro>> timeIntervals, bool del) {
  833. statistics_db db(database_path, resourcePath);
  834. db.writeStatisticsInterval(interval_statistics, timeIntervals, del, this->default_interval, this->getDoExtraTests());
  835. }