BasicPacketClassifierWitLabels.java 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515
  1. package de.tu_darmstadt.tk.SmartHomeNetworkSim.evaluation;
  2. import java.io.BufferedWriter;
  3. import java.io.File;
  4. import java.io.FileWriter;
  5. import java.io.IOException;
  6. import java.util.ArrayList;
  7. import java.util.HashMap;
  8. import java.util.HashSet;
  9. import java.util.Iterator;
  10. import java.util.LinkedList;
  11. import java.util.Map.Entry;
  12. import de.tu_darmstadt.tk.SmartHomeNetworkSim.core.Link;
  13. import de.tu_darmstadt.tk.SmartHomeNetworkSim.core.Packet;
  14. import de.tu_darmstadt.tk.SmartHomeNetworkSim.core.PacketSniffer;
  15. import de.tu_darmstadt.tk.SmartHomeNetworkSim.core.protocols.packets.MQTTpublishPacket;
  16. import weka.core.Attribute;
  17. import weka.core.DenseInstance;
  18. import weka.core.Instance;
  19. import weka.core.Instances;
  20. /**
  21. * Unsupervised Classifier Basis, which contains methods for transforming {@link Packet}s into {@link Instance}s.
  22. *
  23. * @author Andreas T. Meyer-Berg
  24. */
  25. public abstract class BasicPacketClassifierWitLabels implements PacketSniffer {
  26. /**
  27. * True, if instances should be used for training
  28. */
  29. protected boolean training = true;
  30. /**
  31. * Attributes which should be taken into account
  32. */
  33. protected ArrayList<Attribute> atts = new ArrayList<Attribute>();
  34. /**
  35. * Collected Packets
  36. */
  37. protected Instances dataset;
  38. /**
  39. * CollectedPackets
  40. */
  41. protected HashMap<Link, LinkedList<Packet>> collectedPackets = new HashMap<Link, LinkedList<Packet>>();
  42. /**
  43. * HashMap for calculating transmission delay
  44. */
  45. protected HashMap<Link, LinkedList<Packet>> lastPackets = new HashMap<Link, LinkedList<Packet>>();
  46. /**
  47. * Map for the different Link names
  48. */
  49. protected HashSet<String> link_mappings = new HashSet<String>();
  50. /**
  51. * Map for the difference source device names
  52. */
  53. protected HashSet<String> source_mappings = new HashSet<String>();
  54. /**
  55. * Map for the different destination device names
  56. */
  57. protected HashSet<String> destination_mappings = new HashSet<String>();
  58. /**
  59. * Map for the protocol names
  60. */
  61. protected HashSet<String> protocol_mappings = new HashSet<String>();
  62. /**
  63. * Number of packets which are used to calculate the current transmission speed
  64. */
  65. protected int NUMBER_OF_PACKETS = 200;
  66. private String currentScenario = "";
  67. private int scenarioRun = 0;
  68. /**
  69. * Initializes the different maps
  70. */
  71. public BasicPacketClassifierWitLabels() {
  72. // Initialize Attribute list
  73. source_mappings.add("unknown");
  74. link_mappings.add("unknown");
  75. destination_mappings.add("unknown");
  76. protocol_mappings.add("unknown");
  77. }
  78. @Override
  79. public void processPackets(HashMap<Link, LinkedList<Packet>> packets) {
  80. if(training)
  81. try {
  82. training(packets);
  83. } catch (Exception e) {
  84. e.printStackTrace();
  85. }
  86. else
  87. classify(packets);
  88. }
  89. /**
  90. * Estimates the current Packets per second (depending on the last 100 packets of the link)
  91. * @param link Link which should be checked
  92. * @param packet Packet which should investigated
  93. * @return estimated number of packets per second
  94. */
  95. protected double getEstimatedPacketsPerSecond(Link link, Packet packet) {
  96. /**
  97. * Packets used to calculated the packets per second
  98. */
  99. LinkedList<Packet> list = lastPackets.get(link);
  100. if(list == null) {
  101. /**
  102. * Add list if not present
  103. */
  104. list = new LinkedList<Packet>();
  105. lastPackets.put(link, list);
  106. }
  107. if(list.isEmpty()) {
  108. list.addLast(packet);
  109. // Default 1 packet per second
  110. return 1.0;
  111. }
  112. if(list.size() == NUMBER_OF_PACKETS){
  113. list.removeFirst();
  114. }
  115. list.addLast(packet);
  116. /**
  117. * elapsed time in milliseconds since last packet
  118. */
  119. long elapsed_time = packet.getTimestamp()-list.getFirst().getTimestamp()/list.size();
  120. if(elapsed_time<=0)
  121. return Double.POSITIVE_INFINITY;
  122. /**
  123. * Return number of packets per second
  124. */
  125. return 1000.0/elapsed_time;
  126. }
  127. /**
  128. * Returns the instance representation of the given packet and link
  129. * @param link link the packet was sent on
  130. * @param packet packet which should be transformed
  131. * @param dataset distribution the packet is part of
  132. * @return instance representation
  133. */
  134. protected Instance packet2Instance(Link link, Packet packet, Instances dataset) {
  135. /**
  136. * Instance for the given Packet
  137. */
  138. DenseInstance instance = new DenseInstance(dataset.numAttributes());
  139. instance.setDataset(dataset);
  140. // link
  141. instance.setValue(0, stringToNominal(link_mappings, link.getName()));
  142. // source
  143. if(packet.getSource()==null) {
  144. instance.setValue(1, "unknown");
  145. instance.setValue(2, Double.NEGATIVE_INFINITY);
  146. }else if(packet.getSource().getOwner()==null){
  147. instance.setValue(1, "unknown");
  148. instance.setValue(2, packet.getSource().getPortNumber());
  149. }else {
  150. instance.setValue(1, stringToNominal(source_mappings, packet.getSource().getOwner().getName()));
  151. instance.setValue(2, packet.getSource().getPortNumber());
  152. }
  153. // Destination
  154. if(packet.getDestination()==null) {
  155. instance.setValue(3, "unknown");
  156. instance.setValue(4, Double.NEGATIVE_INFINITY);
  157. }else if(packet.getDestination().getOwner()==null){
  158. instance.setValue(3, "unknown");
  159. instance.setValue(4, packet.getDestination().getPortNumber());
  160. }else {
  161. instance.setValue(3, stringToNominal(destination_mappings, packet.getDestination().getOwner().getName()));
  162. instance.setValue(4, packet.getDestination().getPortNumber());
  163. }
  164. // Protocol name
  165. instance.setValue(5, stringToNominal(protocol_mappings, packet.getProtocolName()));
  166. // Packets per second
  167. //instance.setValue(6, getEstimatedPacketsPerSecond(link, packet));
  168. // MQTT Value
  169. if(packet instanceof MQTTpublishPacket) {
  170. MQTTpublishPacket mqttPack = (MQTTpublishPacket)packet;
  171. if(mqttPack.isBoolean()) {
  172. if(mqttPack.getValue() == 0) {
  173. instance.setValue(6,0);
  174. }
  175. else {
  176. instance.setValue(6, 1);
  177. }
  178. if(mqttPack.getSensorValue() == 0) {
  179. instance.setValue(7,0);
  180. } else {
  181. instance.setValue(7, 1);
  182. }
  183. }else {
  184. instance.setValue(6, ((MQTTpublishPacket)packet).getValue());
  185. instance.setValue(7, ((MQTTpublishPacket)packet).getSensorValue());
  186. }
  187. } else {
  188. instance.setValue(6, -100);
  189. instance.setValue(7, -100);
  190. }
  191. return instance;
  192. }
  193. /**
  194. * Inserts the
  195. * @param map
  196. * @param nominal
  197. */
  198. protected void insertNominalIntoMap(HashSet<String> map, String nominal) {
  199. if(map == null || nominal == null)
  200. return;
  201. map.add(nominal);
  202. }
  203. /**
  204. * Transforms the String into an Number
  205. * @param map
  206. * @param s
  207. * @return
  208. */
  209. protected String stringToNominal(HashSet<String> map, String s) {
  210. return map.contains(s)?s:"unknown";
  211. }
  212. /**
  213. * Train the clusterer by collecting the packets
  214. *
  215. * @param packets packets to be learned
  216. */
  217. protected void training(HashMap<Link, LinkedList<Packet>> packets) {
  218. for(Entry<Link, LinkedList<Packet>> e:packets.entrySet()) {
  219. Link l = e.getKey();
  220. // TODO: ERROR ????????
  221. LinkedList<Packet> p = collectedPackets.get(l);
  222. if(p == null) {
  223. collectedPackets.put(l, new LinkedList<Packet>(e.getValue()));
  224. } else
  225. p.addAll(e.getValue());
  226. insertNominalIntoMap(link_mappings, l.getName());
  227. for(Packet pac: e.getValue()) {
  228. if(pac == null || pac.getSource()==null ||pac.getDestination() == null || pac.getSource().getOwner() == null || pac.getDestination().getOwner() == null)
  229. continue;
  230. insertNominalIntoMap(destination_mappings, pac.getSource().getOwner().getName());
  231. insertNominalIntoMap(destination_mappings, pac.getDestination().getOwner().getName());
  232. insertNominalIntoMap(source_mappings, pac.getSource().getOwner().getName());
  233. insertNominalIntoMap(source_mappings, pac.getDestination().getOwner().getName());
  234. insertNominalIntoMap(protocol_mappings, pac.getProtocolName());
  235. }
  236. //TODO: Add packet/Link/Names etc. to mappings
  237. }
  238. }
  239. /**
  240. * Finishes the collection and trains the clusterer on the collected packets
  241. *
  242. * @throws Exception
  243. */
  244. protected void finishDataCollection() throws Exception{
  245. /**
  246. printHashSet("Link-Name", link_mappings);
  247. printHashSet("Source-Device", source_mappings);
  248. printHashSet("Destination-Port", destination_mappings);
  249. printHashSet("Protocol-name", protocol_mappings);
  250. */
  251. atts.add(new Attribute("Link-Name", new LinkedList<String>(link_mappings)));//TODO:??
  252. atts.add(new Attribute("Source-Device", new LinkedList<String>(source_mappings)));
  253. atts.add(new Attribute("Source-Port-number", false));
  254. atts.add(new Attribute("Destination-Device", new LinkedList<String>(destination_mappings)));
  255. atts.add(new Attribute("Destination-Port-number", false));
  256. Attribute pn = new Attribute("Protocol-name", new LinkedList<String>(protocol_mappings));
  257. //pn.setWeight(10);
  258. atts.add(pn);
  259. //Attribute pps = new Attribute("Packets-per-second", false);
  260. //pps.setWeight(20);
  261. //atts.add(pps);
  262. atts.add(new Attribute("PacketValue", false));
  263. //atts.add(new Attribute("Anomaly", false));
  264. // TODO: Sensor Attribute, given as side channel information
  265. atts.add(new Attribute("SensorValue", false));
  266. /*
  267. atts = new ArrayList<Attribute>();
  268. atts.add(new Attribute("LN", new LinkedList<String>(link_mappings)));//TODO:??
  269. atts.add(new Attribute("SD", new LinkedList<String>(source_mappings)));
  270. atts.add(new Attribute("SPN", false));
  271. atts.add(new Attribute("DD", new LinkedList<String>(destination_mappings)));
  272. atts.add(new Attribute("DPN", false));
  273. atts.add(new Attribute("PN", new LinkedList<String>(protocol_mappings)));
  274. atts.add(new Attribute("PPS", false));
  275. atts.add(new Attribute("A", false));*/
  276. dataset = new Instances("Packets", atts, 100000);
  277. //dataset.setClassIndex(7);
  278. /**
  279. * Add Instances to dataset
  280. */
  281. for (Iterator<Entry<Link, LinkedList<Packet>>> it = collectedPackets.entrySet().iterator(); it.hasNext();) {
  282. Entry<Link, LinkedList<Packet>> entry = it.next();
  283. /**
  284. * Link the packet was captured on
  285. */
  286. Link l = entry.getKey();
  287. for (Iterator<Packet> itPacket = entry.getValue().iterator(); itPacket.hasNext();) {
  288. /**
  289. * Packets to be added to the dataset
  290. */
  291. Packet packet = (Packet) itPacket.next();
  292. dataset.add(packet2Instance(l, packet, dataset));
  293. }
  294. }
  295. trainModel(dataset);
  296. }
  297. private void printHashSet(String name, HashSet<String> toPrint) {
  298. System.out.println(name+":");
  299. for (Iterator<String> iterator = toPrint.iterator(); iterator.hasNext();) {
  300. String string = (String) iterator.next();
  301. System.out.print(string);
  302. if(iterator.hasNext())
  303. System.out.print(", ");
  304. }
  305. System.out.println();
  306. }
  307. /**
  308. * Try to classify the given packets and detect anomalies
  309. * @param packets packets to be classified
  310. */
  311. protected void classify(HashMap<Link, LinkedList<Packet>> packets) {
  312. File anomalyResults = new File("results/"+getCurrentScenario() + scenarioRun + ".csv");
  313. anomalyResults.getParentFile().mkdir();
  314. BufferedWriter writer = null;
  315. try {
  316. writer = new BufferedWriter(new FileWriter(anomalyResults));
  317. writer.write("PacketRepresentation,anomalyFPorTP,sensorInfo\n");
  318. } catch (IOException e1) {
  319. // TODO Auto-generated catch block
  320. e1.printStackTrace();
  321. }
  322. int tp = 0;
  323. int fp = 0;
  324. int tn = 0;
  325. int fn = 0;
  326. long start = Long.MAX_VALUE;
  327. long end = Long.MIN_VALUE;
  328. for (Iterator<Entry<Link, LinkedList<Packet>>> it = packets.entrySet().iterator(); it.hasNext();) {
  329. /**
  330. * Link & its packets
  331. */
  332. Entry<Link, LinkedList<Packet>> entry = it.next();
  333. /**
  334. * Link the packets were captured on
  335. */
  336. Link l = entry.getKey();
  337. for (Iterator<Packet> itPacket = entry.getValue().iterator(); itPacket.hasNext();) {
  338. /**
  339. * Packet which should be checked
  340. */
  341. Packet packet = (Packet) itPacket.next();
  342. start = Math.min(start, packet.getTimestamp());
  343. end = Math.max(end, packet.getTimestamp());
  344. /**
  345. * Instance Representation
  346. */
  347. Instance packet_instance = packet2Instance(l, packet, dataset);
  348. if(packet_instance == null)continue;
  349. String sensorLabel = "";
  350. if(packet instanceof MQTTpublishPacket) {
  351. MQTTpublishPacket mqttPac = (MQTTpublishPacket)packet;
  352. sensorLabel = ""+mqttPac.getSensorValue();
  353. if(mqttPac.isBoolean()) {
  354. sensorLabel = "" + Boolean.parseBoolean(sensorLabel);
  355. }
  356. sensorLabel = ","+sensorLabel;
  357. }
  358. try {
  359. double dist = classifyInstance(packet_instance, packet);
  360. if(dist<=Settings.DECISION_THRESHOLD) {
  361. if(packet.getLabel()==0) {
  362. tn++;
  363. writer.write(packet.getTextualRepresentation()+",TN"+sensorLabel+"\n");
  364. }
  365. else {
  366. fn++;
  367. writer.write(packet.getTextualRepresentation()+",FN"+sensorLabel+"\n");
  368. //System.out.println(packet.getTextualRepresentation()+",AnomalyNotFound"+sensorLabel);
  369. }
  370. }else {
  371. if(packet.getLabel()==0) {
  372. fp++;
  373. writer.write(packet.getTextualRepresentation()+",FP"+sensorLabel+"\n");
  374. } else {
  375. tp++;
  376. writer.write(packet.getTextualRepresentation()+",TP"+sensorLabel+"\n");
  377. }
  378. }
  379. } catch (Exception e) {
  380. if(packet.getLabel()==0) {
  381. fp++;
  382. try {
  383. writer.write(packet.getTextualRepresentation()+",FP"+sensorLabel+"\n");
  384. } catch (IOException e1) {
  385. // TODO Auto-generated catch block
  386. e1.printStackTrace();
  387. }
  388. } else {
  389. tp++;
  390. try {
  391. writer.write(packet.getTextualRepresentation()+",TP"+sensorLabel+"\n");
  392. } catch (IOException e1) {
  393. // TODO Auto-generated catch block
  394. e1.printStackTrace();
  395. }
  396. }
  397. }
  398. }
  399. }
  400. int n = tp+tn+fp+fn;
  401. if(n!=0) {
  402. System.out.println(getAlgoName()+" Performance: ["+start+"ms, "+end+"ms] Scenario: " + getCurrentScenario() + scenarioRun);
  403. scenarioRun++;
  404. System.out.println("n: "+n);
  405. System.out.println("TP: "+tp);
  406. System.out.println("FP: "+fp);
  407. System.out.println("TN: "+tn);
  408. System.out.println("FN: "+fn);
  409. System.out.println("TPR: "+(tp/(tp+fn+0.0)));
  410. System.out.println("FPR: "+(fp/(fp+tn+0.0)));
  411. System.out.println("");
  412. }
  413. try {
  414. writer.close();
  415. } catch (IOException e) {
  416. // TODO Auto-generated catch block
  417. e.printStackTrace();
  418. }
  419. }
  420. /**
  421. * Train the model using the given instances
  422. * @param instances training set, which should be learned
  423. */
  424. public abstract void trainModel(Instances instances);
  425. /**
  426. * classifies the given instance
  427. * @param instance instance which should be classified
  428. * @param origin original packet, which was transformed into the instance
  429. * @return distance to next centroid
  430. * @throws Exception if anomaly was detected
  431. */
  432. public abstract double classifyInstance(Instance instance, Packet origin) throws Exception;
  433. /**
  434. * Returns the timestep, after which the classifier should start classifying instead of training.
  435. * @return timestep of the testing begin.
  436. */
  437. public abstract long getClassificationStart();
  438. @Override
  439. public void setMode(boolean testing) {
  440. training = !testing;
  441. if(testing) {
  442. try {
  443. finishDataCollection();
  444. } catch (Exception e) {
  445. System.out.println("Clustering failed");
  446. e.printStackTrace();
  447. }
  448. }
  449. }
  450. @Override
  451. public boolean getMode() {
  452. return !training;
  453. }
  454. /**
  455. * Short String representation of the classifier
  456. * @return
  457. */
  458. public abstract String getAlgoName();
  459. /**
  460. * @return the currentScenario
  461. */
  462. public String getCurrentScenario() {
  463. return currentScenario;
  464. }
  465. /**
  466. * @param currentScenario the currentScenario to set
  467. */
  468. public void setCurrentScenario(String currentScenario) {
  469. this.currentScenario = currentScenario;
  470. this.scenarioRun = 0;
  471. }
  472. }