private void LoadAndTest(FlowProfile profile, IEnumerable <IPacketRecord> packets)
{
var getFlowKeyFunc = FlowKey.GetFlowKeyFunc(profile.FlowAggregation);
var getModelKeyFunc = profile.ProtocolFactory.GetModelKeyFunc(profile.ModelKey);
var startTime = packets.First().TimeEpoch;
var packetBins = packets.GroupBy(p => (int)Math.Floor((p.TimeEpoch - startTime) / profile.WindowSize));
var normalTotal = 0;
var abnormalTotal = 0;
var unknownTotal = 0;
foreach (var group in packetBins)
{
var flows = profile.ProtocolFactory.CollectCoapFlows(group, getModelKeyFunc, getFlowKeyFunc);
var testResults = TestAndPrint(profile, flows, $"{DateTime.UnixEpoch.AddSeconds((long)startTime + (group.Key * profile.WindowSize))}");
normalTotal += testResults.Normal;
abnormalTotal += testResults.Abnormal;
unknownTotal += testResults.Unknown;
}
var measuresTable = new DataTable();
measuresTable.Columns.Add("Metric", typeof(string));
measuresTable.Columns.Add("Value", typeof(double));
measuresTable.Rows.Add("Normal", normalTotal);
measuresTable.Rows.Add("Abnormal", abnormalTotal);
measuresTable.Rows.Add("Unknown", unknownTotal);
Console.WriteLine("Measures:");
ConsoleTableBuilder.From(measuresTable)
.WithFormat(ConsoleTableBuilderFormat.MarkDown)
.ExportAndWriteLine();
}
public static Func <IPacketRecord, string> GetFlowKeyFunc(FlowKey.Fields aggregation = Fields.None)
{
return(p =>
{
var fk = new FlowKey
{
IpSrc = aggregation.HasFlag(FlowKey.Fields.IpSrc) ? "0.0.0.0" : p.IpSrc,
SrcPort = aggregation.HasFlag(FlowKey.Fields.SrcPort) ? 0 : p.SrcPort,
IpDst = aggregation.HasFlag(FlowKey.Fields.IpDst) ? "0.0.0.0" : p.IpDst,
DstPort = aggregation.HasFlag(FlowKey.Fields.DstPort) ? 0 : p.DstPort
};
return fk.ToString();
});
}
private void LoadAndCompute(FlowProfile profile, string inputFile, IList <CoapPacketRecord> packets, double windowSize, LearningWindow learningWindows,
ProtocolFactory protocolFactory, Enum modelKey, FlowKey.Fields flowAggregation = FlowKey.Fields.None)
{
var getFlowKeyFunc = FlowKey.GetFlowKeyFunc(flowAggregation);
var getModelKeyFunc = protocolFactory.GetModelKeyFunc(modelKey);
Console.WriteLine("┌ Load packets and compute profile:");
Console.WriteLine($"├─ input file: {inputFile}");
Console.WriteLine($"├─ packets count: {packets.Count}");
Console.WriteLine($"├─ window size: {windowSize} seconds");
Console.WriteLine($"├─ learning window: {learningWindows.Meassure}({learningWindows.Value})");
Console.WriteLine($"├─ protocol: {protocolFactory.Name}");
Console.WriteLine($"├─ model key: {modelKey}");
Console.WriteLine($"├─ flow aggregation: {flowAggregation}");
var sw = new Stopwatch();
sw.Start();
var startTime = packets.First().TimeEpoch;
var packetBins = packets.GroupBy(p => (int)Math.Floor((p.TimeEpoch - startTime) / windowSize)).ToList();
var learningBins = learningWindows.Meassure == LearningWindow.ValueType.Absolute ? packetBins.Take((int)learningWindows.Value) :
packetBins.Take((int)(packetBins.Count() * learningWindows.Value));
var pb1 = (RuntimeInformation.IsOSPlatform(OSPlatform.Windows)) ? new ProgressBar(packetBins.Count()) : null;
foreach (var group in packetBins)
{
if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
{
pb1.Next($"├─ processing bin {group.Key}: {group.Count()} items");
}
var flows = protocolFactory.CollectCoapFlows(group, getModelKeyFunc, getFlowKeyFunc);
ComputeProfile(profile, flows);
}
var pb2 = (RuntimeInformation.IsOSPlatform(OSPlatform.Windows)) ? new ProgressBar(profile.Count) : null;
profile.Commit(() => { if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
{
pb2.Next($"├─ fitting models");
}
});
Console.WriteLine($"└ done [{sw.Elapsed}].");
}
public static CoapFlowRecord GetFlow(IGrouping <string, IPacketRecord> arg)
{
var first = arg.First() as CoapPacketRecord;
var last = arg.Last();
var flowKey = FlowKey.Parse(arg.Key);
return(new CoapFlowRecord
{
StartMsec = first.TimeEpoch,
EndMsec = last.TimeEpoch,
SrcAddr = flowKey.IpSrc,
SrcPort = flowKey.SrcPort,
DstAddr = flowKey.IpDst,
DstPort = flowKey.DstPort,
CoapCode = first.CoapCode,
CoapType = first.CoapType,
CoapUriPath = first.CoapUriPath,
FlowOctets = arg.Sum(x => x.PayloadLength),
FlowPackets = arg.Count()
});
}
