statistics.h 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751
  1. /*
  2. * Class providing containers and access methods for statistical data collection.
  3. */
  4. #ifndef CPP_PCAPREADER_STATISTICS_H
  5. #define CPP_PCAPREADER_STATISTICS_H
  6. #include <vector>
  7. #include <unordered_map>
  8. #include <unordered_set>
  9. #include <list>
  10. #include <tuple>
  11. #include <tins/timestamp.h>
  12. #include <tins/ip_address.h>
  13. #include "utilities.h"
  14. using namespace Tins;
  15. #define COMM_INTERVAL_THRESHOLD 10e6 // in microseconds; i.e. here 10s
  16. /*
  17. * Definition of structs used in unordered_map fields
  18. */
  19. /*
  20. * Struct used as data structure for method get_stats_for_ip, represents:
  21. * - Incoming bandwidth in KBits
  22. * - Outgoing bandwidth in KBits
  23. * - Number of incoming packets per second
  24. * - Number of outgoing packets per second
  25. * - Average size of sent packets in kbytes
  26. * - Average size of received packets in kybtes
  27. * - Average value of TCP option Maximum Segment Size (MSS)
  28. */
  29. struct ip_stats {
  30. float bandwidthKBitsIn;
  31. float bandwidthKBitsOut;
  32. float packetPerSecondIn;
  33. float packetPerSecondOut;
  34. float AvgPacketSizeSent;
  35. float AvgPacketSizeRecv;
  36. };
  37. /*
  38. * Struct used to represent a conversation by:
  39. * - IP address A
  40. * - Port A
  41. * - IP address B
  42. * - Port B
  43. */
  44. struct conv{
  45. std::string ipAddressA;
  46. int portA;
  47. std::string ipAddressB;
  48. int portB;
  49. bool operator==(const conv &other) const {
  50. return ipAddressA == other.ipAddressA
  51. && portA == other.portA
  52. &&ipAddressB == other.ipAddressB
  53. && portB == other.portB;
  54. }
  55. };
  56. /*
  57. * Struct used to represent a conversation by:
  58. * - IP address A
  59. * - Port A
  60. * - IP address B
  61. * - Port B
  62. * - Protocol
  63. */
  64. struct convWithProt{
  65. std::string ipAddressA;
  66. int portA;
  67. std::string ipAddressB;
  68. int portB;
  69. std::string protocol;
  70. bool operator==(const convWithProt &other) const {
  71. return ipAddressA == other.ipAddressA
  72. && portA == other.portA
  73. &&ipAddressB == other.ipAddressB
  74. && portB == other.portB
  75. && protocol == other.protocol;
  76. }
  77. };
  78. /*
  79. * Struct used to represent:
  80. * - IP address (IPv4 or IPv6)
  81. * - MSS value
  82. */
  83. struct ipAddress_mss {
  84. std::string ipAddress;
  85. int mssValue;
  86. bool operator==(const ipAddress_mss &other) const {
  87. return ipAddress == other.ipAddress
  88. && mssValue == other.mssValue;
  89. }
  90. };
  91. /*
  92. * Struct used to represent:
  93. * - IP address (IPv4 or IPv6)
  94. * - ToS value
  95. */
  96. struct ipAddress_tos {
  97. std::string ipAddress;
  98. int tosValue;
  99. bool operator==(const ipAddress_tos &other) const {
  100. return ipAddress == other.ipAddress
  101. && tosValue == other.tosValue;
  102. }
  103. };
  104. /*
  105. * Struct used to represent:
  106. * - IP address (IPv4 or IPv6)
  107. * - Window size
  108. */
  109. struct ipAddress_win {
  110. std::string ipAddress;
  111. int winSize;
  112. bool operator==(const ipAddress_win &other) const {
  113. return ipAddress == other.ipAddress
  114. && winSize == other.winSize;
  115. }
  116. };
  117. /*
  118. * Struct used to represent:
  119. * - IP address (IPv4 or IPv6)
  120. * - TTL value
  121. */
  122. struct ipAddress_ttl {
  123. std::string ipAddress;
  124. int ttlValue;
  125. bool operator==(const ipAddress_ttl &other) const {
  126. return ipAddress == other.ipAddress
  127. && ttlValue == other.ttlValue;
  128. }
  129. };
  130. /*
  131. * Struct used to represent:
  132. * - IP address (IPv4 or IPv6)
  133. * - Protocol (e.g. TCP, UDP, IPv4, IPv6)
  134. */
  135. struct ipAddress_protocol {
  136. std::string ipAddress;
  137. std::string protocol;
  138. bool operator==(const ipAddress_protocol &other) const {
  139. return ipAddress == other.ipAddress
  140. && protocol == other.protocol;
  141. }
  142. };
  143. /*
  144. * Struct used to represent:
  145. * - Number of received packets
  146. * - Number of sent packets
  147. * - Data received in kbytes
  148. * - Data sent in kbytes
  149. */
  150. struct entry_ipStat {
  151. long pkts_received;
  152. long pkts_sent;
  153. float kbytes_received;
  154. float kbytes_sent;
  155. std::string ip_class;
  156. int in_degree;
  157. int out_degree;
  158. int overall_degree;
  159. // Collects statstics over time interval
  160. std::vector<float> interval_pkt_rate;
  161. float max_interval_pkt_rate;
  162. float min_interval_pkt_rate;
  163. std::vector<std::chrono::microseconds> pkts_sent_timestamp;
  164. std::vector<std::chrono::microseconds> pkts_received_timestamp;
  165. bool operator==(const entry_ipStat &other) const {
  166. return pkts_received == other.pkts_received
  167. && pkts_sent == other.pkts_sent
  168. && kbytes_sent == other.kbytes_sent
  169. && kbytes_received == other.kbytes_received
  170. && interval_pkt_rate == other.interval_pkt_rate
  171. && max_interval_pkt_rate == other.max_interval_pkt_rate
  172. && min_interval_pkt_rate == other.min_interval_pkt_rate
  173. && ip_class == other.ip_class
  174. && pkts_sent_timestamp == other.pkts_sent_timestamp
  175. && pkts_received_timestamp == other.pkts_received_timestamp;
  176. }
  177. };
  178. /*
  179. * Struct used to represent:
  180. * - Number of transmitted packets
  181. * - Number of transmitted bytes
  182. */
  183. struct entry_portStat {
  184. int count;
  185. float byteCount;
  186. };
  187. /*
  188. * Struct used to represent:
  189. * - Number of times the protocol is seen
  190. * - Amount of bytes transmitted with this protocol
  191. */
  192. struct entry_protocolStat {
  193. int count;
  194. float byteCount;
  195. };
  196. /*
  197. * Struct used to represent interval statistics:
  198. * - # packets
  199. * - # bytes
  200. * - IP source entropy
  201. * - IP destination entropy
  202. * - IP source cumulative entropy
  203. * - IP destination cumulative entropy
  204. * - # packets that have payload
  205. * - # incorrect TCP checksum
  206. * - # correct TCP checksum
  207. * - # novel IPs
  208. * - # novel TTL
  209. * - # novel Window Size
  210. * - # novel ToS
  211. * - # novel MSS
  212. */
  213. struct entry_intervalStat {
  214. std::string start;
  215. std::string end;
  216. int pkts_count;
  217. float pkt_rate;
  218. float kbytes;
  219. float kbyte_rate;
  220. std::vector<double> ip_entropies;
  221. std::vector<double> ip_cum_entropies;
  222. std::vector<double> ttl_entropies;
  223. std::vector<double> win_size_entropies;
  224. std::vector<double> tos_entropies;
  225. std::vector<double> mss_entropies;
  226. std::vector<double> port_entropies;
  227. int payload_count;
  228. int incorrect_tcp_checksum_count;
  229. int correct_tcp_checksum_count;
  230. size_t novel_ip_src_count;
  231. size_t novel_ip_dst_count;
  232. int novel_ttl_count;
  233. int novel_win_size_count;
  234. int novel_tos_count;
  235. int novel_mss_count;
  236. int novel_port_count;
  237. // FIXME: add new attributes to operator==
  238. bool operator==(const entry_intervalStat &other) const {
  239. return start == other.start
  240. && end == other.end
  241. && pkts_count == other.pkts_count
  242. && pkt_rate == other.pkt_rate
  243. && kbytes == other.kbytes
  244. && kbyte_rate == other.kbyte_rate
  245. && ip_entropies == other.ip_entropies
  246. && ip_cum_entropies == other.ip_cum_entropies
  247. && payload_count == other.payload_count
  248. && incorrect_tcp_checksum_count == other.incorrect_tcp_checksum_count
  249. && correct_tcp_checksum_count == other.correct_tcp_checksum_count
  250. && novel_ip_src_count == other.novel_ip_src_count
  251. && novel_ip_dst_count == other.novel_ip_dst_count
  252. && novel_ttl_count == other.novel_ttl_count
  253. && novel_win_size_count == other.novel_win_size_count
  254. && novel_tos_count == other.novel_tos_count
  255. && novel_mss_count == other.novel_mss_count
  256. && novel_port_count == other.novel_port_count
  257. && ttl_entropies == other.ttl_entropies
  258. && win_size_entropies == other.win_size_entropies
  259. && tos_entropies == other.tos_entropies
  260. && mss_entropies == other.mss_entropies
  261. && port_entropies == other.port_entropies;
  262. }
  263. };
  264. /*
  265. * Struct used to represent converstaion statistics:
  266. * - # packets
  267. * - Average packet rate
  268. * - Timestamps of packets
  269. * - Inter-arrival time
  270. * - Average inter-arrival time
  271. */
  272. struct entry_convStat {
  273. long pkts_count;
  274. float avg_pkt_rate;
  275. std::vector<std::chrono::microseconds> pkts_timestamp;
  276. std::vector<std::chrono::microseconds> interarrival_time;
  277. std::chrono::microseconds avg_interarrival_time;
  278. bool operator==(const entry_convStat &other) const {
  279. return pkts_count == other.pkts_count
  280. && avg_pkt_rate == avg_pkt_rate
  281. && pkts_timestamp == other.pkts_timestamp
  282. && interarrival_time == other.interarrival_time
  283. && avg_interarrival_time == other.avg_interarrival_time;
  284. }
  285. };
  286. /*
  287. * Struct used to represent:
  288. * - IP address (IPv4 or IPv6)
  289. - Traffic direction (out: outgoing connection, in: incoming connection)
  290. * - Port number
  291. */
  292. struct ipAddress_inOut_port {
  293. std::string ipAddress;
  294. std::string trafficDirection;
  295. int portNumber;
  296. std::string protocol;
  297. bool operator==(const ipAddress_inOut_port &other) const {
  298. return ipAddress == other.ipAddress
  299. && trafficDirection == other.trafficDirection
  300. && portNumber == other.portNumber
  301. && protocol == other.protocol;
  302. }
  303. };
  304. /*
  305. * Struct used to represent a communication interval (for two hosts):
  306. * - Timestamp of the first packet in the interval
  307. * - Timestamp of the last packet in the interval
  308. * - The count of packets within the interval
  309. */
  310. struct commInterval{
  311. std::chrono::microseconds start;
  312. std::chrono::microseconds end;
  313. long pkts_count;
  314. bool operator==(const commInterval &other) const {
  315. return start == other.start
  316. && end == other.end
  317. && pkts_count == other.pkts_count;
  318. }
  319. };
  320. /*
  321. * Struct used to represent converstaion statistics:
  322. * - commnication intervals
  323. * - # packets
  324. * - Average packet rate
  325. * - average # packets per communication interval
  326. * - Average time between intervals
  327. * - Average duration of a communication interval
  328. * - Overall communication duration
  329. * - Timestamps of packets
  330. * - Inter-arrival time
  331. * - Average inter-arrival time
  332. */
  333. struct entry_convStatExt {
  334. std::vector<commInterval> comm_intervals;
  335. long pkts_count;
  336. float avg_pkt_rate;
  337. double avg_int_pkts_count;
  338. double avg_time_between_ints;
  339. double avg_interval_time;
  340. double total_comm_duration;
  341. std::chrono::duration<int, std::micro> timeInterval;
  342. std::vector<std::chrono::microseconds> pkts_timestamp;
  343. std::vector<std::chrono::microseconds> interarrival_time;
  344. std::chrono::microseconds avg_interarrival_time;
  345. bool operator==(const entry_convStatExt &other) const {
  346. return comm_intervals == other.comm_intervals
  347. && pkts_count == other.pkts_count
  348. && avg_pkt_rate == avg_pkt_rate
  349. && avg_int_pkts_count == other.avg_int_pkts_count
  350. && avg_time_between_ints == other.avg_time_between_ints
  351. && avg_interval_time == other.avg_interval_time
  352. && total_comm_duration == other.total_comm_duration
  353. && pkts_timestamp == other.pkts_timestamp
  354. && interarrival_time == other.interarrival_time
  355. && avg_interarrival_time == other.avg_interarrival_time;
  356. }
  357. };
  358. /*
  359. * Struct used to represent:
  360. * - Source MAC address
  361. * - Destination MAC address
  362. * - Payload type number
  363. */
  364. struct unrecognized_PDU {
  365. std::string srcMacAddress;
  366. std::string dstMacAddress;
  367. uint32_t typeNumber;
  368. bool operator==(const unrecognized_PDU &other) const {
  369. return srcMacAddress == other.srcMacAddress
  370. && dstMacAddress == other.dstMacAddress
  371. && typeNumber == other.typeNumber;
  372. }
  373. };
  374. /*
  375. * Struct used to represent:
  376. * - Number of occurrences
  377. * - Formatted timestamp of last occurrence
  378. */
  379. struct unrecognized_PDU_stat {
  380. int count;
  381. std::string timestamp_last_occurrence;
  382. };
  383. /*
  384. * Definition of hash functions for structs used as key in unordered_map
  385. */
  386. namespace std {
  387. template<>
  388. struct hash<ipAddress_ttl> {
  389. std::size_t operator()(const ipAddress_ttl &k) const {
  390. using std::size_t;
  391. using std::hash;
  392. using std::string;
  393. return ((hash<string>()(k.ipAddress)
  394. ^ (hash<int>()(k.ttlValue) << 1)) >> 1);
  395. }
  396. };
  397. template<>
  398. struct hash<ipAddress_mss> {
  399. std::size_t operator()(const ipAddress_mss &k) const {
  400. using std::size_t;
  401. using std::hash;
  402. using std::string;
  403. return ((hash<string>()(k.ipAddress)
  404. ^ (hash<int>()(k.mssValue) << 1)) >> 1);
  405. }
  406. };
  407. template<>
  408. struct hash<ipAddress_tos> {
  409. std::size_t operator()(const ipAddress_tos &k) const {
  410. using std::size_t;
  411. using std::hash;
  412. using std::string;
  413. return ((hash<string>()(k.ipAddress)
  414. ^ (hash<int>()(k.tosValue) << 1)) >> 1);
  415. }
  416. };
  417. template<>
  418. struct hash<ipAddress_win> {
  419. std::size_t operator()(const ipAddress_win &k) const {
  420. using std::size_t;
  421. using std::hash;
  422. using std::string;
  423. return ((hash<string>()(k.ipAddress)
  424. ^ (hash<int>()(k.winSize) << 1)) >> 1);
  425. }
  426. };
  427. template<>
  428. struct hash<conv> {
  429. std::size_t operator()(const conv &k) const {
  430. using std::size_t;
  431. using std::hash;
  432. using std::string;
  433. return ((hash<string>()(k.ipAddressA)
  434. ^ (hash<int>()(k.portA) << 1)) >> 1)
  435. ^ ((hash<string>()(k.ipAddressB)
  436. ^ (hash<int>()(k.portB) << 1)) >> 1);
  437. }
  438. };
  439. template<>
  440. struct hash<convWithProt> {
  441. std::size_t operator()(const convWithProt &c) const {
  442. using std::size_t;
  443. using std::hash;
  444. using std::string;
  445. return ((hash<string>()(c.ipAddressA)
  446. ^ (hash<int>()(c.portA) << 1)) >> 1)
  447. ^ ((hash<string>()(c.ipAddressB)
  448. ^ (hash<int>()(c.portB) << 1)) >> 1)
  449. ^ (hash<string>()(c.protocol));
  450. }
  451. };
  452. template<>
  453. struct hash<ipAddress_protocol> {
  454. std::size_t operator()(const ipAddress_protocol &k) const {
  455. using std::size_t;
  456. using std::hash;
  457. using std::string;
  458. return ((hash<string>()(k.ipAddress)
  459. ^ (hash<string>()(k.protocol) << 1)) >> 1);
  460. }
  461. };
  462. template<>
  463. struct hash<ipAddress_inOut_port> {
  464. std::size_t operator()(const ipAddress_inOut_port &k) const {
  465. using std::size_t;
  466. using std::hash;
  467. using std::string;
  468. return ((hash<string>()(k.ipAddress)
  469. ^ (hash<string>()(k.trafficDirection) << 1)) >> 1)
  470. ^ (hash<int>()(k.portNumber) << 1);
  471. }
  472. };
  473. template<>
  474. struct hash<unrecognized_PDU> {
  475. std::size_t operator()(const unrecognized_PDU &k) const {
  476. using std::size_t;
  477. using std::hash;
  478. using std::string;
  479. return ((hash<string>()(k.srcMacAddress)
  480. ^ (hash<string>()(k.dstMacAddress) << 1)) >> 1)
  481. ^ (hash<uint32_t>()(k.typeNumber) << 1);
  482. }
  483. };
  484. }
  485. class statistics {
  486. public:
  487. /*
  488. * Constructor
  489. */
  490. statistics(std::string resourcePath);
  491. /*
  492. * Methods
  493. */
  494. std::string getFormattedTimestamp(time_t seconds, suseconds_t microseconds) const;
  495. /*
  496. * Access methods for containers
  497. */
  498. void incrementPacketCount();
  499. void calculateIPIntervalPacketRate(std::chrono::duration<int, std::micro> interval, std::chrono::microseconds intervalStartTimestamp);
  500. void incrementMSScount(const std::string &ipAddress, int mssValue);
  501. void incrementWinCount(const std::string &ipAddress, int winSize);
  502. void addConvStat(const std::string &ipAddressSender,int sport, const std::string &ipAddressReceiver,int dport, std::chrono::microseconds timestamp);
  503. void addConvStatExt(const std::string &ipAddressSender,int sport, const std::string &ipAddressReceiver,int dport, const std::string &protocol, std::chrono::microseconds timestamp);
  504. void createCommIntervalStats();
  505. std::vector<double> calculateIPsCumEntropy();
  506. std::vector<double> calculateLastIntervalIPsEntropy(std::chrono::microseconds intervalStartTimestamp);
  507. std::vector<double> calculateEntropies(std::unordered_map<int, int> &map, std::unordered_map<int, int> &old);
  508. void addIntervalStat(std::chrono::duration<int, std::micro> interval, std::chrono::microseconds intervalStartTimestamp, std::chrono::microseconds lastPktTimestamp);
  509. void checkPayload(const PDU *pdu_l4);
  510. void checkTCPChecksum(const std::string &ipAddressSender, const std::string &ipAddressReceiver, TCP tcpPkt);
  511. void checkToS(uint8_t ToS);
  512. void incrementToScount(const std::string &ipAddress, int tosValue);
  513. void incrementTTLcount(const std::string &ipAddress, int ttlValue);
  514. void incrementProtocolCount(const std::string &ipAddress, const std::string &protocol);
  515. void increaseProtocolByteCount(const std::string &ipAddress, const std::string &protocol, long bytesSent);
  516. void incrementUnrecognizedPDUCount(const std::string &srcMac, const std::string &dstMac, uint32_t typeNumber,
  517. const std::string &timestamp);
  518. void incrementPortCount(const std::string &ipAddressSender, int outgoingPort, const std::string &ipAddressReceiver,
  519. int incomingPort, const std::string &protocol);
  520. void increasePortByteCount(const std::string &ipAddressSender, int outgoingPort, const std::string &ipAddressReceiver,
  521. int incomingPort, long bytesSent, const std::string &protocol);
  522. int getProtocolCount(const std::string &ipAddress, const std::string &protocol);
  523. float getProtocolByteCount(const std::string &ipAddress, const std::string &protocol);
  524. void setTimestampFirstPacket(Tins::Timestamp ts);
  525. void setTimestampLastPacket(Tins::Timestamp ts);
  526. Tins::Timestamp getTimestampFirstPacket();
  527. Tins::Timestamp getTimestampLastPacket();
  528. void assignMacAddress(const std::string &ipAddress, const std::string &macAddress);
  529. void addIpStat_packetSent(const std::string &ipAddressSender, const std::string &ipAddressReceiver, long bytesSent, std::chrono::microseconds timestamp);
  530. int getPacketCount();
  531. int getSumPacketSize();
  532. void addMSS(const std::string &ipAddress, int MSSvalue);
  533. void writeToDatabase(std::string database_path, std::vector<std::chrono::duration<int, std::micro>> timeInterval, bool del);
  534. void writeIntervalsToDatabase(std::string database_path, std::vector<std::chrono::duration<int, std::micro>> timeIntervals, bool del);
  535. void addPacketSize(uint32_t packetSize);
  536. std::string getCaptureDurationTimestamp() const;
  537. float getCaptureDurationSeconds() const;
  538. float getAvgPacketSize() const;
  539. void printStats(const std::string &ipAddress);
  540. bool getDoExtraTests();
  541. void setDoExtraTests(bool var);
  542. int getDefaultInterval();
  543. void setDefaultInterval(int interval);
  544. /*
  545. * IP Address-specific statistics
  546. */
  547. ip_stats getStatsForIP(const std::string &ipAddress);
  548. private:
  549. /*
  550. * Data fields
  551. */
  552. Tins::Timestamp timestamp_firstPacket;
  553. Tins::Timestamp timestamp_lastPacket;
  554. float sumPacketSize = 0;
  555. int packetCount = 0;
  556. std::string resourcePath;
  557. /* Extra tests includes:
  558. * - calculate IPs entropies for intervals
  559. * - calculate IPs cumulative entropies interval-wise
  560. * - check payload availability
  561. * - chech TCP checksum correctness
  562. */
  563. bool doExtraTests = false;
  564. int payloadCount = 0;
  565. int incorrectTCPChecksumCount = 0;
  566. int correctTCPChecksumCount = 0;
  567. // Variables that are used for interval-wise statistics
  568. int intervalPayloadCount = 0;
  569. int intervalIncorrectTCPChecksumCount = 0;
  570. int intervalCorrectTCPChecksumCount = 0;
  571. int intervalCumPktCount = 0;
  572. float intervalCumSumPktSize = 0;
  573. size_t ip_src_novel_count = 0;
  574. size_t ip_dst_novel_count = 0;
  575. int intervalCumNovelIPCount = 0;
  576. int intervalCumNovelTTLCount = 0;
  577. int intervalCumNovelWinSizeCount = 0;
  578. int intervalCumNovelToSCount = 0;
  579. int intervalCumNovelMSSCount = 0;
  580. int intervalCumNovelPortCount = 0;
  581. std::unordered_map<std::string, entry_ipStat> intervalCumIPStats;
  582. std::unordered_map<int,int> intervalCumTTLValues;
  583. std::unordered_map<int,int> intervalCumWinSizeValues;
  584. std::unordered_map<int,int> intervalCumTosValues;
  585. std::unordered_map<int,int> intervalCumMSSValues;
  586. std::unordered_map<int,int> intervalCumPortValues;
  587. int default_interval = 0;
  588. /*
  589. * Data containers
  590. */
  591. // {IP Address, TTL value, count}
  592. std::unordered_map<ipAddress_ttl, int> ttl_distribution;
  593. // {IP Address, MSS value, count}
  594. std::unordered_map<ipAddress_mss, int> mss_distribution;
  595. // {IP Address, Win size, count}
  596. std::unordered_map<ipAddress_win, int> win_distribution;
  597. // {IP Address, ToS value, count}
  598. std::unordered_map<ipAddress_tos, int> tos_distribution;
  599. // {IP Address A, Port A, IP Address B, Port B, #packets, packets timestamps, inter-arrival times,
  600. // average of inter-arrival times}
  601. std::unordered_map<conv, entry_convStat> conv_statistics;
  602. // {IP Address A, Port A, IP Address B, Port B, comm_intervals, #packets, avg. pkt rate, avg. #packets per interval,
  603. // avg. time between intervals, avg. interval time, duration, packets timestamps, inter-arrivtal times, average of inter-arrival times}
  604. // Also stores conversation with only one exchanged message. In this case avgPktRate, minDelay, maxDelay and avgDelay are -1
  605. std::unordered_map<convWithProt, entry_convStatExt> conv_statistics_extended;
  606. // {Last timestamp in the interval, #packets, #bytes, source IP entropy, destination IP entropy,
  607. // source IP cumulative entropy, destination IP cumulative entropy, #payload, #incorrect TCP checksum,
  608. // #correct TCP checksum, #novel IP, #novel TTL, #novel Window Size, #novel ToS,#novel MSS}
  609. std::unordered_map<std::string, entry_intervalStat> interval_statistics;
  610. // {TTL value, count}
  611. std::unordered_map<int, int> ttl_values;
  612. // {Win size, count}
  613. std::unordered_map<int, int> win_values;
  614. // {ToS, count}
  615. std::unordered_map<int, int> tos_values;
  616. // {MSS, count}
  617. std::unordered_map<int, int> mss_values;
  618. // {Port, count}
  619. std::unordered_map<int, int> port_values;
  620. //{IP Address, contacted IP Addresses}
  621. std::unordered_map<std::string, std::unordered_set<std::string>> contacted_ips;
  622. // {IP Address, Protocol, #count, #Data transmitted in bytes}
  623. std::unordered_map<ipAddress_protocol, entry_protocolStat> protocol_distribution;
  624. // {IP Address, #received packets, #sent packets, Data received in kbytes, Data sent in kbytes}
  625. std::unordered_map<std::string, entry_ipStat> ip_statistics;
  626. // {IP Address, in_out, Port Number, #count, #Data transmitted in bytes}
  627. std::unordered_map<ipAddress_inOut_port, entry_portStat> ip_ports;
  628. // {IP Address, MAC Address}
  629. std::unordered_map<std::string, std::string> ip_mac_mapping;
  630. // {Source MAC, Destination MAC, typeNumber, #count, #timestamp of last occurrence}
  631. std::unordered_map<unrecognized_PDU, unrecognized_PDU_stat> unrecognized_PDUs;
  632. };
  633. #endif //CPP_PCAPREADER_STATISTICS_H