Skip to content

Commit 589de4d

Browse files
lucadivitlucadivit
authored
Add files via upload
1 parent 4bc408a commit 589de4d

2 files changed

Lines changed: 107 additions & 66 deletions

File tree

‎CreateFeaturesHandler.py‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
from scapy.all import *
2+
from FeaturesCalc import FeaturesCalc
3+
from CSV import CSV
4+
from PacketFilter import PacketFilter
5+
from AttackerCalc import AttackerCalc
6+
import glob
7+
8+
class CreateFeaturesHandler():
9+
10+
def __init__(self, pkts_window_size=10, single_csv=True):
11+
self.pkts_window_size = pkts_window_size
12+
assert self.pkts_window_size >=1, "Valore per la finestra non valido"
13+
self.single_csv = single_csv
14+
assert (self.single_csv is True) or (self.single_csv is False), "Valore non valido per il flag single_csv"
15+
self.featuresCalc = FeaturesCalc(flow_type="malware", min_window_size=pkts_window_size)
16+
ip_to_ignore = ["127.0.0.1"]
17+
self.filter_1 = PacketFilter(ip_whitelist_filter=[], ip_blacklist_filter=ip_to_ignore, TCP=True)
18+
self.filter_2 = PacketFilter(ip_whitelist_filter=[], ip_blacklist_filter=ip_to_ignore, UDP=True)
19+
self.filter_3 = PacketFilter(ip_whitelist_filter=[], ip_blacklist_filter=ip_to_ignore, ICMP=True)
20+
self.filters = [self.filter_1, self.filter_2, self.filter_3]
21+
22+
if(self.single_csv):
23+
self.csv = CSV(file_name="features")
24+
self.csv.create_empty_csv()
25+
self.csv.add_row(self.featuresCalc.get_features_name())
26+
27+
def compute_features(self):
28+
29+
def malware_features():
30+
folder_name = "Pcaps_Malware"
31+
flow_type = "malware"
32+
if (self.featuresCalc.get_flow_type() == flow_type):
33+
pass
34+
else:
35+
self.featuresCalc.set_flow_type(flow_type)
36+
for pcap in glob.glob(folder_name + "/" + "*.pcap"):
37+
if(self.single_csv):
38+
csv = self.csv
39+
else:
40+
pcap_name = pcap.split("/")
41+
pcap_name = pcap_name[len(pcap_name)-1].replace(".pcap", "")
42+
csv = CSV(file_name=pcap_name, folder_name="Malware_Features")
43+
csv.create_empty_csv()
44+
csv.add_row(self.featuresCalc.get_features_name())
45+
array_of_pkts = []
46+
print("\nCalcolo features di " + pcap + "\n")
47+
attacker = AttackerCalc(pcap=pcap)
48+
ip_to_consider = attacker.compute_attacker()
49+
for filter in self.filters:
50+
filter.set_ip_whitelist_filter(ip_to_consider)
51+
pkts = rdpcap(pcap)
52+
filter_res=[]
53+
for pkt in pkts:
54+
for filter in self.filters:
55+
if(filter.check_packet_filter(pkt)):
56+
filter_res.append(True)
57+
else:
58+
filter_res.append(False)
59+
if(True in filter_res):
60+
array_of_pkts.append(pkt)
61+
if (len(array_of_pkts) >= self.featuresCalc.get_min_window_size()):
62+
features = self.featuresCalc.compute_features(array_of_pkts)
63+
csv.add_row(features)
64+
array_of_pkts.clear()
65+
filter_res.clear()
66+
67+
def legitimate_features():
68+
folder_name = "Pcaps_Legitimate"
69+
flow_type = "legitimate"
70+
if (self.featuresCalc.get_flow_type() == flow_type):
71+
pass
72+
else:
73+
self.featuresCalc.set_flow_type(flow_type)
74+
for filter in self.filters:
75+
filter.set_ip_whitelist_filter([])
76+
for pcap in glob.glob(folder_name + "/" + "*.pcap"):
77+
if(self.single_csv):
78+
csv = self.csv
79+
else:
80+
pcap_name = pcap.split("/")
81+
pcap_name = pcap_name[len(pcap_name) - 1].replace(".pcap", "")
82+
csv = CSV(file_name=pcap_name, folder_name="Legitimate_Features")
83+
csv.create_empty_csv()
84+
csv.add_row(self.featuresCalc.get_features_name())
85+
array_of_pkts = []
86+
filter_res = []
87+
print("\nCalcolo features di " + pcap + "\n")
88+
pkts = rdpcap(pcap)
89+
for pkt in pkts:
90+
for filter in self.filters:
91+
if(filter.check_packet_filter(pkt)):
92+
filter_res.append(True)
93+
else:
94+
filter_res.append(False)
95+
if(True in filter_res):
96+
array_of_pkts.append(pkt)
97+
if (len(array_of_pkts) >= self.featuresCalc.get_min_window_size()):
98+
features = self.featuresCalc.compute_features(array_of_pkts)
99+
csv.add_row(features)
100+
array_of_pkts.clear()
101+
filter_res.clear()
102+
103+
malware_features()
104+
legitimate_features()

‎Main.py‎

Lines changed: 3 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -1,71 +1,8 @@
1-
from scapy.all import *
2-
from FeaturesCalc import FeaturesCalc
3-
from CSV import CSV
4-
from PacketFilter import PacketFilter
5-
from AttackerCalc import AttackerCalc
6-
import glob
1+
from CreateFeaturesHandler import CreateFeaturesHandler
72

83
def main():
9-
10-
pkts_window_size = 10
11-
ip_to_ignore = ["127.0.0.1"]
12-
featuresCalc = FeaturesCalc(flow_type="malware", min_window_size=pkts_window_size)
13-
filter_1 = PacketFilter(ip_whitelist_filter=[], ip_blacklist_filter=ip_to_ignore, IPv4=True, TCP=True,
14-
UDP=False)
15-
filter_2 = PacketFilter(ip_whitelist_filter=[], ip_blacklist_filter=ip_to_ignore, IPv4=True, TCP=False,
16-
UDP=True)
17-
filter_3 = PacketFilter(ip_whitelist_filter=[], ip_blacklist_filter=ip_to_ignore, IPv4=True, TCP=False,
18-
UDP=False)
19-
csv = CSV(file_name="features")
20-
csv.create_empty_csv()
21-
csv.add_row(featuresCalc.get_features_name())
22-
23-
def malware_features():
24-
folder_name = "Pcaps_Malware"
25-
flow_type = "malware"
26-
if (featuresCalc.get_flow_type() == flow_type):
27-
pass
28-
else:
29-
featuresCalc.set_flow_type(flow_type)
30-
for pcap in glob.glob(folder_name + "/" + "*.pcap"):
31-
array_of_pkts = []
32-
attacker = AttackerCalc(pcap=pcap)
33-
ip_to_consider = attacker.compute_attacker()
34-
filter_1.set_ip_whitelist_filter(ip_to_consider)
35-
filter_2.set_ip_whitelist_filter(ip_to_consider)
36-
filter_3.set_ip_whitelist_filter(ip_to_consider)
37-
pkts = rdpcap(pcap)
38-
for pkt in pkts:
39-
if ((filter_2.check_packet_filter(pkt) or filter_1.check_packet_filter(pkt) or filter_3.check_packet_filter(pkt)) is True):
40-
array_of_pkts.append(pkt)
41-
if (len(array_of_pkts) >= featuresCalc.get_min_window_size()):
42-
features = featuresCalc.compute_features(array_of_pkts)
43-
csv.add_row(features)
44-
array_of_pkts.clear()
45-
46-
def legitimate_features():
47-
folder_name = "Pcaps_Legitimate"
48-
flow_type = "legitimate"
49-
if (featuresCalc.get_flow_type() == flow_type):
50-
pass
51-
else:
52-
featuresCalc.set_flow_type(flow_type)
53-
filter_1.set_ip_whitelist_filter([])
54-
filter_2.set_ip_whitelist_filter([])
55-
filter_3.set_ip_whitelist_filter([])
56-
for pcap in glob.glob(folder_name + "/" + "*.pcap"):
57-
array_of_pkts = []
58-
pkts = rdpcap(pcap)
59-
for pkt in pkts:
60-
if ((filter_2.check_packet_filter(pkt) or filter_1.check_packet_filter(pkt) or filter_3.check_packet_filter(pkt)) is True):
61-
array_of_pkts.append(pkt)
62-
if (len(array_of_pkts) >= featuresCalc.get_min_window_size()):
63-
features = featuresCalc.compute_features(array_of_pkts)
64-
csv.add_row(features)
65-
array_of_pkts.clear()
66-
67-
malware_features()
68-
legitimate_features()
4+
cfh = CreateFeaturesHandler(single_csv=False)
5+
cfh.compute_features()
696

707
if __name__== "__main__":
718
main()

0 commit comments

Comments
 (0)