|
@@ -184,6 +184,16 @@ public abstract class BasicPacketClassifier implements PacketSniffer {
|
|
|
return instance;
|
|
|
}
|
|
|
|
|
|
+
|
|
|
+ * Inserts the
|
|
|
+ * @param map
|
|
|
+ * @param nominal
|
|
|
+ */
|
|
|
+ protected void insertNominalIntoMap(HashSet<String> map, String nominal) {
|
|
|
+ if(map == null || nominal == null)
|
|
|
+ return;
|
|
|
+ map.add(nominal);
|
|
|
+ }
|
|
|
|
|
|
* Transforms the String into an Number
|
|
|
* @param map
|
|
@@ -202,11 +212,23 @@ public abstract class BasicPacketClassifier implements PacketSniffer {
|
|
|
protected void training(HashMap<Link, LinkedList<Packet>> packets) {
|
|
|
for(Entry<Link, LinkedList<Packet>> e:packets.entrySet()) {
|
|
|
Link l = e.getKey();
|
|
|
+
|
|
|
LinkedList<Packet> p = collectedPackets.get(l);
|
|
|
- if(p == null)
|
|
|
+ if(p == null) {
|
|
|
collectedPackets.put(l, new LinkedList<Packet>(e.getValue()));
|
|
|
- else
|
|
|
+ } else
|
|
|
p.addAll(e.getValue());
|
|
|
+ insertNominalIntoMap(link_mappings, l.getName());
|
|
|
+ for(Packet pac: e.getValue()) {
|
|
|
+ if(pac == null || pac.getSource()==null ||pac.getDestination() == null || pac.getSource().getOwner() == null || pac.getDestination().getOwner() == null)
|
|
|
+ continue;
|
|
|
+ insertNominalIntoMap(destination_mappings, pac.getSource().getOwner().getName());
|
|
|
+ insertNominalIntoMap(destination_mappings, pac.getDestination().getOwner().getName());
|
|
|
+ insertNominalIntoMap(source_mappings, pac.getSource().getOwner().getName());
|
|
|
+ insertNominalIntoMap(source_mappings, pac.getDestination().getOwner().getName());
|
|
|
+ insertNominalIntoMap(protocol_mappings, pac.getProtocolName());
|
|
|
+ }
|
|
|
+
|
|
|
}
|
|
|
}
|
|
|
|
|
@@ -216,6 +238,11 @@ public abstract class BasicPacketClassifier implements PacketSniffer {
|
|
|
* @throws Exception
|
|
|
*/
|
|
|
protected void finishDataCollection() throws Exception{
|
|
|
+ printHashSet("Link-Name", link_mappings);
|
|
|
+ printHashSet("Source-Device", source_mappings);
|
|
|
+ printHashSet("Destination-Port", destination_mappings);
|
|
|
+ printHashSet("Protocol-name", protocol_mappings);
|
|
|
+
|
|
|
atts.add(new Attribute("Link-Name", new LinkedList<String>(link_mappings)));
|
|
|
atts.add(new Attribute("Source-Device", new LinkedList<String>(source_mappings)));
|
|
|
atts.add(new Attribute("Source-Port-number", false));
|
|
@@ -263,6 +290,16 @@ public abstract class BasicPacketClassifier implements PacketSniffer {
|
|
|
trainModel(dataset);
|
|
|
}
|
|
|
|
|
|
+ private void printHashSet(String name, HashSet<String> toPrint) {
|
|
|
+ System.out.println(name+":");
|
|
|
+ for (Iterator<String> iterator = toPrint.iterator(); iterator.hasNext();) {
|
|
|
+ String string = (String) iterator.next();
|
|
|
+ System.out.print(string);
|
|
|
+ if(iterator.hasNext())
|
|
|
+ System.out.print(", ");
|
|
|
+ }
|
|
|
+ System.out.println();
|
|
|
+ }
|
|
|
|
|
|
* Try to classify the given packets and detect anomalies
|
|
|
* @param packets packets to be classified
|
|
@@ -298,11 +335,18 @@ public abstract class BasicPacketClassifier implements PacketSniffer {
|
|
|
|
|
|
if(packet_instance == null)continue;
|
|
|
try {
|
|
|
- classifyInstance(packet_instance, packet);
|
|
|
- if(packet.getLabel()==0)
|
|
|
- tn++;
|
|
|
- else
|
|
|
- fn++;
|
|
|
+ double dist = classifyInstance(packet_instance, packet);
|
|
|
+ if(dist<=1.0) {
|
|
|
+ if(packet.getLabel()==0)
|
|
|
+ tn++;
|
|
|
+ else
|
|
|
+ fn++;
|
|
|
+ }else {
|
|
|
+ if(packet.getLabel()==0)
|
|
|
+ fp++;
|
|
|
+ else
|
|
|
+ tp++;
|
|
|
+ }
|
|
|
} catch (Exception e) {
|
|
|
if(packet.getLabel()==0)
|
|
|
fp++;
|
|
@@ -335,9 +379,10 @@ public abstract class BasicPacketClassifier implements PacketSniffer {
|
|
|
* classifies the given instance
|
|
|
* @param instance instance which should be classified
|
|
|
* @param origin original packet, which was transformed into the instance
|
|
|
+ * @return distance to next centroid
|
|
|
* @throws Exception if anomaly was detected
|
|
|
*/
|
|
|
- public abstract void classifyInstance(Instance instance, Packet origin) throws Exception;
|
|
|
+ public abstract double classifyInstance(Instance instance, Packet origin) throws Exception;
|
|
|
|
|
|
|
|
|
* Returns the timestep, after which the classifier should start classifying instead of training.
|