Inheritance: IPState
Exemple #1
0
        private static Trial[] LoadDataParallel(string path)
        {
            BlockingCollection <string> inputLines = new BlockingCollection <string>();
            ConcurrentBag <Trial>       trials     = new ConcurrentBag <Trial>();
            int       itemsAdded      = 0;
            int       itemsProcessed  = 0;
            const int outputFrequency = 100000;

            List <Task> consumerTasks = new List <Task>();
            int         counter       = 0;

            using (StreamReader file = new StreamReader(path))
            {
                // Skip header
                file.ReadLine();
                string lineRead;
                while ((lineRead = file.ReadLine()) != null)
                {
                    inputLines.Add(lineRead);
                    ++itemsAdded;
                    if (++counter >= outputFrequency)
                    {
                        counter = 0;
                        Console.Out.WriteLine("Trial lines Read: {0}", itemsAdded);

                        if (inputLines.Count >= outputFrequency * consumerTasks.Count)
                        {
                            consumerTasks.Add(Task.Run(() =>
                            {
                                string line;
                                do
                                {
                                    while (inputLines.TryTake(out line))
                                    {
                                        string[] fields = line.Trim().Split(new char[] { ',' });
                                        if (fields.Length >= 11)
                                        {
                                            Trial trial = new Trial(fields);
                                            trials.Add(trial);
                                        }
                                        int numProcessed = Interlocked.Increment(ref itemsProcessed);
                                        if (numProcessed % 100000 == 0)
                                        {
                                            Console.Out.WriteLine("Trial lines processed: {0}", numProcessed);
                                        }
                                    }
                                    Thread.Sleep(100);
                                } while (!inputLines.IsCompleted);
                            }));
                        }
                    }
                }
                inputLines.CompleteAdding();
            }

            Task.WaitAll(consumerTasks.ToArray());
            return(trials.ToArray());
        }
Exemple #2
0
        private static Trial[] LoadDataParallel(string path)
        {
            BlockingCollection<string> inputLines = new BlockingCollection<string>();
            ConcurrentBag<Trial> trials = new ConcurrentBag<Trial>();
            int itemsAdded = 0;
            int itemsProcessed = 0;
            const int outputFrequency = 100000;

            List<Task> consumerTasks = new List<Task>();
            int counter = 0;
            using (StreamReader file = new StreamReader(path))
            {
                // Skip header
                file.ReadLine();
                string lineRead;
                while ((lineRead = file.ReadLine()) != null)
                {
                    inputLines.Add(lineRead);
                    ++itemsAdded;
                    if (++counter >= outputFrequency)
                    {
                        counter = 0;
                        Console.Out.WriteLine("Trial lines Read: {0}", itemsAdded);

                        if (inputLines.Count >= outputFrequency * consumerTasks.Count)
                        {
                            consumerTasks.Add(Task.Run(() =>
                            {
                                string line;
                                do
                                {
                                    while (inputLines.TryTake(out line))
                                    {
                                        string[] fields = line.Trim().Split(new char[] { ',' });
                                        if (fields.Length >= 11)
                                        {
                                            Trial trial = new Trial(fields);
                                            trials.Add(trial);
                                        }
                                        int numProcessed = Interlocked.Increment(ref itemsProcessed);
                                        if (numProcessed % 100000 == 0)
                                            Console.Out.WriteLine("Trial lines processed: {0}", numProcessed);
                                    }
                                    Thread.Sleep(100);
                                } while (!inputLines.IsCompleted);
                            }));
                        }

                    }
                }
                inputLines.CompleteAdding();
            }

            Task.WaitAll(consumerTasks.ToArray());
            return trials.ToArray();
        }
Exemple #3
0
        public int CompareTo(Trial other, int condition)
        {
            float myScore     = GetScoreForCondition(condition);
            float othersScore = other.GetScoreForCondition(condition);

            if (myScore < othersScore)
            {
                return(-1);
            }
            if (myScore > othersScore)
            {
                return(1);
            }
            return(0);
        }
Exemple #4
0
        //public float GetScoreForCondition(Condition c)
        //{

        //    double score =
        //        c.alpha*
        //        ( (
        //            AccountFailuresInfrequentPassword*c.phi_infrequent +
        //            AccountFailuresFrequentPassword*c.phi_frequent
        //            ) +
        //            c.repeat *
        //           (
        //            RepeatAccountFailuresInfrequentPassword*c.phi_infrequent +
        //            RepeatAccountFailuresFrequentPassword*c.phi_frequent
        //           )
        //        )
        //        +
        //        c.beta_notypo * c.phi_infrequent * (
        //            PasswordFailuresNoTypoInfrequentPassword +
        //            RepeatPasswordFailuresNoTypoInfrequentPassword * c.repeat)
        //        +
        //        c.beta_notypo * c.phi_frequent * (
        //            PasswordFailuresNoTypoFrequentPassword +
        //            RepeatPasswordFailuresNoTypoFrequentPassword * c.repeat)
        //        +
        //        c.beta_typo * c.phi_infrequent * (
        //            PasswordFailuresTypoInfrequentPassword +
        //            RepeatPasswordFailuresTypoInfrequentPassword * c.repeat)
        //        +
        //        c.beta_typo * c.phi_frequent * (
        //            PasswordFailuresTypoFrequentPassword +
        //            RepeatPasswordFailuresTypoFrequentPassword * c.repeat)
        //        ;
        //  score -= c.gamma*SuccessfulLogins;
        //    if (!IsFrequentlyGuessedPassword)
        //        score /= c.T;
        //    if (DeviceCookieHadPriorSuccessfulLoginForThisAccount)
        //        score = 0;

        //    return (float) score;
        //}

        public int CompareTo(Trial other, ICondition condition)
        {
            float myScore     = condition.GetScore(this);
            float othersScore = condition.GetScore(other);

            if (myScore < othersScore)
            {
                return(-1);
            }
            if (myScore > othersScore)
            {
                return(1);
            }
            return(0);
        }
Exemple #5
0
        //public static IEnumerable<StopGuessingCondition> GetConditions()
        //{
        //    return new StopGuessingCondition[]
        //    {
        //        new StopGuessingCondition("AllOn"),
        //        new StopGuessingCondition("NoTypoDetection") {beta_typo = 0},
        //        new StopGuessingCondition("NoRepeatCorrection") {repeat = 1},
        //        new StopGuessingCondition("PhiIgnoresFrequency") {phi_frequent = 1},
        //        new StopGuessingCondition("FixedThreshold") {T = 1},
        //        new StopGuessingCondition("NoAlpha") {alpha = 1},
        //        new StopGuessingCondition("Control") {alpha = 1, beta_typo =1, beta_notypo=1, phi_frequent = 1, phi_infrequent = 1, T=1, repeat =1, gamma=0},
        //        new StopGuessingCondition("ControlNoRepeats") {alpha = 1, beta_typo =1, beta_notypo=1, phi_frequent = 1, phi_infrequent = 1, T=1, repeat =0, gamma=0}
        //    };
        //}

        public float GetScore(Trial t)
        {
            double score =
                alpha *
                ((
                     t.AccountFailuresInfrequentPassword * phi_infrequent +
                     t.AccountFailuresFrequentPassword * phi_frequent
                     ) +
                 repeat *
                 (
                     t.RepeatAccountFailuresInfrequentPassword * phi_infrequent +
                     t.RepeatAccountFailuresFrequentPassword * phi_frequent
                 )
                )
                +
                beta_notypo * phi_infrequent * (
                    t.PasswordFailuresNoTypoInfrequentPassword +
                    t.RepeatPasswordFailuresNoTypoInfrequentPassword * repeat)
                +
                beta_notypo * phi_frequent * (
                    t.PasswordFailuresNoTypoFrequentPassword +
                    t.RepeatPasswordFailuresNoTypoFrequentPassword * repeat)
                +
                beta_typo * phi_infrequent * (
                    t.PasswordFailuresTypoInfrequentPassword +
                    t.RepeatPasswordFailuresTypoInfrequentPassword * repeat)
                +
                beta_typo * phi_frequent * (
                    t.PasswordFailuresTypoFrequentPassword +
                    t.RepeatPasswordFailuresTypoFrequentPassword * repeat)
            ;

            score -= gamma * t.SuccessfulLogins;
            if (!t.IsFrequentlyGuessedPassword)
            {
                score /= T;
            }
            if (t.DeviceCookieHadPriorSuccessfulLoginForThisAccount && !cookies_off)
            {
                score = 0;
            }

            return((float)score);
        }
Exemple #6
0
        //public static IEnumerable<StopGuessingCondition> GetConditions()
        //{
        //    return new StopGuessingCondition[]
        //    {
        //        new StopGuessingCondition("AllOn"),
        //        new StopGuessingCondition("NoTypoDetection") {beta_typo = 0},
        //        new StopGuessingCondition("NoRepeatCorrection") {repeat = 1},
        //        new StopGuessingCondition("PhiIgnoresFrequency") {phi_frequent = 1},
        //        new StopGuessingCondition("FixedThreshold") {T = 1},
        //        new StopGuessingCondition("NoAlpha") {alpha = 1},
        //        new StopGuessingCondition("Control") {alpha = 1, beta_typo =1, beta_notypo=1, phi_frequent = 1, phi_infrequent = 1, T=1, repeat =1, gamma=0},
        //        new StopGuessingCondition("ControlNoRepeats") {alpha = 1, beta_typo =1, beta_notypo=1, phi_frequent = 1, phi_infrequent = 1, T=1, repeat =0, gamma=0}
        //    };
        //}

        public float GetScore(Trial t)
        {

            double score =
                alpha *
                ((
                    t.AccountFailuresInfrequentPassword * phi_infrequent +
                    t.AccountFailuresFrequentPassword * phi_frequent
                    ) +
                    repeat *
                   (
                    t.RepeatAccountFailuresInfrequentPassword * phi_infrequent +
                    t.RepeatAccountFailuresFrequentPassword * phi_frequent
                   )
                )
                +
                beta_notypo * phi_infrequent * (
                    t.PasswordFailuresNoTypoInfrequentPassword +
                    t.RepeatPasswordFailuresNoTypoInfrequentPassword * repeat)
                +
                beta_notypo * phi_frequent * (
                    t.PasswordFailuresNoTypoFrequentPassword +
                    t.RepeatPasswordFailuresNoTypoFrequentPassword * repeat)
                +
                beta_typo * phi_infrequent * (
                    t.PasswordFailuresTypoInfrequentPassword +
                    t.RepeatPasswordFailuresTypoInfrequentPassword * repeat)
                +
                beta_typo * phi_frequent * (
                    t.PasswordFailuresTypoFrequentPassword +
                    t.RepeatPasswordFailuresTypoFrequentPassword * repeat)
                ;
            score -= gamma * t.SuccessfulLogins;
            if (!t.IsFrequentlyGuessedPassword)
                score /= T;
            if (t.DeviceCookieHadPriorSuccessfulLoginForThisAccount && !cookies_off)
                score = 0;

            return (float)score;
        }
Exemple #7
0
        public static void Main()   // string[] args
        {
            string        runDirectoryPath = @"F:\OneDrive\StopGuessingData\Run_5000000_9_15_14_17";
            DirectoryInfo runDir           = new DirectoryInfo(runDirectoryPath);

            foreach (DirectoryInfo testDir in runDir.EnumerateDirectories())
            {
                string path = testDir.FullName;
                Console.Out.WriteLine("Experiment: {0}", path);

                if (!File.Exists(path + @"\LegitimateAttemptsWithValidPasswords.txt") || !File.Exists(path + @"\AttackAttemptsWithValidPasswords.txt"))
                {
                    continue;
                }

                Trial[] trialsUsersCorrectPassword   = LoadData(path + @"\LegitimateAttemptsWithValidPasswords.txt");
                Trial[] trialsGuessesCorrectPassword = LoadData(path + @"\AttackAttemptsWithValidPasswords.txt");

                int benignWithCookie = trialsUsersCorrectPassword.Count(r => r.DeviceCookieHadPriorSuccessfulLoginForThisAccount);

                //Trial[] trialsWithCorrectPassword = trials.Where(t => t.IsPasswordCorrect).ToArray();
                //Trial[] trialsUsersCorrectPassword = trials.Where(t => t.IsPasswordCorrect && !(t.IsFromAttacker && t.IsAGuess)).ToArray();
                //Trial[] trialsGuessesCorrectPassword = trials.Where(t => t.IsPasswordCorrect && (t.IsFromAttacker && t.IsAGuess)).ToArray();
                //int numConditions = 15;

                //long numCorrectBenignFromAttackersIPpool = trialsUsersCorrectPassword.LongCount(t => t.IsIpInAttackersPool);
                //long numCorrectBenignFromProxy = trialsUsersCorrectPassword.LongCount(t => t.IsClientAProxyIP);
                //long numCorrectBenignBoth = trialsUsersCorrectPassword.LongCount(t => t.IsIpInAttackersPool && t.IsClientAProxyIP);
                long        numCorrectGuessesFromProxy        = trialsGuessesCorrectPassword.LongCount(t => t.IsClientAProxyIP);
                long        numCorrectGuessesFromBenignIpPool = trialsGuessesCorrectPassword.LongCount(t => t.IsIpInBenignPool);
                long        numCorrectGuessesFromBoth         = trialsGuessesCorrectPassword.LongCount(t => t.IsIpInBenignPool); // && t.IsClientAProxyIP
                List <Task> tasks = new List <Task>();

                ICondition[] conditions = new ICondition[]
                {
                    new StopGuessingCondition("AllOn"),
                    new StopGuessingCondition("NoTypoDetection")
                    {
                        beta_typo = 1
                    },
                    new StopGuessingCondition("NoRepeatCorrection")
                    {
                        repeat = 1
                    },
                    new StopGuessingCondition("PhiIgnoresFrequency")
                    {
                        phi_frequent = 1
                    },
                    new StopGuessingCondition("FixedThreshold")
                    {
                        T = 1
                    },
                    new StopGuessingCondition("NoCookies")
                    {
                        cookies_off = true
                    },
                    new StopGuessingCondition("NoAlpha")
                    {
                        alpha = 1
                    },
                    new StopGuessingCondition("Control")
                    {
                        alpha = 1, beta_typo = 1, beta_notypo = 1, phi_frequent = 1, phi_infrequent = 1, T = 1, repeat = 1, gamma = 0
                    },
                    new StopGuessingCondition("ControlNoRepeats")
                    {
                        alpha = 1, beta_typo = 1, beta_notypo = 1, phi_frequent = 1, phi_infrequent = 1, T = 1, repeat = 0, gamma = 0
                    },
                    new PasswordFrequencyOnlyCondition(),
                    new PasswordFrequencyOnlyLadderBinaryCondition(),
                    new AccountLoginFailuresOnlyCondition()
                };

                foreach (ICondition condition in conditions)
                {
                    Console.Out.WriteLine("Starting work on Condition: {0}", condition.Name);
                    List <ROCPoint> rocPoints = new List <ROCPoint>();

                    {
                        Queue <Trial> malicious =
                            new Queue <Trial>(
                                trialsGuessesCorrectPassword.AsParallel()
                                .OrderByDescending((x) => condition.GetScore(x)));
                        Console.Out.WriteLine("Sort 1 completed for Condition {0}", condition.Name);
                        Queue <Trial> benign =
                            new Queue <Trial>(
                                trialsUsersCorrectPassword.AsParallel()
                                .OrderByDescending((x) => condition.GetScore(x)));
                        Console.Out.WriteLine("Sort 2 completed for Condition {0}", condition.Name);
                        int originalMaliciousCount = malicious.Count;
                        int originalBenignCount    = benign.Count;


                        int            falsePositives                       = 0;
                        int            falsePositivesWithProxy              = 0;
                        int            falsePositivesWithAttackerIp         = 0;
                        int            falsePositivesWithProxyAndAttackerIp = 0;
                        long           falseNegativeWithProxy               = numCorrectGuessesFromProxy;
                        long           falseNegativeBenignIp                = numCorrectGuessesFromBenignIpPool;
                        long           falseNegativeBenignProxyIp           = numCorrectGuessesFromBoth;
                        HashSet <int>  falsePositiveUsers                   = new HashSet <int>();
                        HashSet <uint> falsePositiveIPs                     = new HashSet <uint>();
                        //int falseNegativeFromDefendersIpPool;


                        double blockThreshold = malicious.Count == 0 ? 0 : condition.GetScore(malicious.Peek());
                        rocPoints.Add(
                            new ROCPoint(0, 0, 0, 0, originalMaliciousCount, originalBenignCount,
                                         falsePositivesWithAttackerIp, falsePositivesWithProxy,
                                         falsePositivesWithProxyAndAttackerIp,
                                         falseNegativeBenignIp, falseNegativeWithProxy, falseNegativeBenignProxyIp,
                                         blockThreshold));

                        while (malicious.Count > 0)
                        {
                            // Remove all malicious requests above this new threshold
                            while (malicious.Count > 0 &&
                                   condition.GetScore(malicious.Peek()) >= blockThreshold)
                            {
                                Trial t = malicious.Dequeue();
                                if (t.IsClientAProxyIP)
                                {
                                    falseNegativeWithProxy--;
                                }
                                if (t.IsIpInBenignPool)
                                {
                                    falseNegativeBenignIp--;
                                }
                                if (t.IsIpInBenignPool && t.IsClientAProxyIP)
                                {
                                    falseNegativeBenignProxyIp--;
                                }
                            }

                            // Remove all benign requests above this new threshold
                            while (benign.Count > 0 &&
                                   condition.GetScore(benign.Peek()) >= blockThreshold)
                            {
                                Trial t = benign.Dequeue();
                                falsePositives++;
                                falsePositiveUsers.Add(t.UserID);
                                falsePositiveIPs.Add(t.ClientIP);
                                if (t.IsIpInAttackersPool)
                                {
                                    falsePositivesWithAttackerIp++;
                                }
                                if (t.IsClientAProxyIP)
                                {
                                    falsePositivesWithProxy++;
                                }
                                if (t.IsIpInAttackersPool && t.IsClientAProxyIP)
                                {
                                    falsePositivesWithProxyAndAttackerIp++;
                                }
                            }

                            rocPoints.Add(new ROCPoint(
                                              falsePositives, //originalBenign.Count - benign.Count,
                                              falsePositiveUsers.Count(),
                                              falsePositiveIPs.Count(),
                                              //falseNegatives, //
                                              originalMaliciousCount - malicious.Count,
                                              malicious.Count,
                                              benign.Count,
                                              falsePositivesWithAttackerIp, falsePositivesWithProxy,
                                              falsePositivesWithProxyAndAttackerIp,
                                              falseNegativeBenignIp, falseNegativeWithProxy, falseNegativeBenignProxyIp,
                                              blockThreshold));

                            // Identify next threshold
                            if (malicious.Count > 0)
                            {
                                blockThreshold = condition.GetScore(malicious.Peek());
                            }
                        }
                    }

                    Console.Out.WriteLine("ROC Points identified for Condition {0}", condition.Name);

                    List <ROCPoint>  finalROCPoints = new List <ROCPoint>();
                    Queue <ROCPoint> rocPointQueue  = new Queue <ROCPoint>(rocPoints);
                    while (rocPointQueue.Count > 0)
                    {
                        ROCPoint point = rocPointQueue.Dequeue();
                        if (rocPointQueue.Count == 0 || rocPointQueue.Peek().FalsePositives > point.FalsePositives)
                        {
                            finalROCPoints.Add(point);
                        }
                    }

                    using (
                        StreamWriter writer = new StreamWriter(path + @"\PointsFor_" + condition.Name + ".csv")
                        )
                    {
                        writer.WriteLine("{0},{1},{2},{3},{4},{5},{6},{7},{8},{9},{10},{11},{12},{13},{14},{15},{16}",
                                         "False +",
                                         "False + users",
                                         "False + IPs",
                                         "False -",
                                         "True +",
                                         "True -",
                                         "FP Rate",
                                         "TP Rate",
                                         "Precision",
                                         "Recall",
                                         "FPwAttackerIP",
                                         "FPwProxy",
                                         "FPwBoth",
                                         "FNwBenignIP",
                                         "FNwProxy",
                                         "FNwBoth",
                                         "Threshold");


                        foreach (ROCPoint point in finalROCPoints)
                        {
                            writer.WriteLine(
                                "{0},{1},{2},{3},{4},{5},{6},{7},{8},{9},{10},{11},{12},{13},{14},{15},{16}",
                                point.FalsePositives,
                                point.FalsePositiveUniqueUsers,
                                point.FalsePositiveUniqueIPs,
                                point.FalseNegatives, point.TruePositives, point.TrueNegatives,
                                point.FalsePositiveRate, point.TruePositiveRate, point.Precision, point.Recall,
                                point.FalsePositivesWithAttackerIp, point.FalsePositivesWithProxy,
                                point.FalsePositivesWithProxyAndAttackerIp,
                                point.FalseNegativesWithBenignIp, point.FalseNegativesWithProxy,
                                point.FalseNegativesWithBenignProxyIp,
                                point.BlockingThreshold);
                        }
                        writer.Flush();
                    }
                    Console.Out.WriteLine("Finished with Condition {0}", condition.Name);
                }
            }
        }
Exemple #8
0
 public float GetScore(Trial t) => (float)t.DecayedMaxConsecutiveIncorrectAttemptsPerAccount;
Exemple #9
0
 public float GetScore(Trial t) => t.IsFrequentlyGuessedPassword ? 1f : 0f;
Exemple #10
0
 public float GetScore(Trial t) => (float)t.InvalidAttemptsPerPassword;
Exemple #11
0
        public static void Main()   // string[] args
        {
            string path = @"E:\Size_7_Strategy_BreadthFirst_Remove_0_Proxies_0_Overlap_0_Run_2_5_15_30\";

            Trial[] trials = LoadDataParallel(path + "data.txt");

            //Trial[] trialsWithCorrectPassword = trials.Where(t => t.IsPasswordCorrect).ToArray();
            Trial[] trialsUsersCorrectPassword   = trials.Where(t => t.IsPasswordCorrect && !(t.IsFromAttacker && t.IsAGuess)).ToArray();
            Trial[] trialsGuessesCorrectPassword = trials.Where(t => t.IsPasswordCorrect && (t.IsFromAttacker && t.IsAGuess)).ToArray();
            int     numConditions = 15;

            //long numCorrectBenignFromAttackersIPpool = trialsUsersCorrectPassword.LongCount(t => t.IsIpInAttackersPool);
            //long numCorrectBenignFromProxy = trialsUsersCorrectPassword.LongCount(t => t.IsClientAProxyIP);
            //long numCorrectBenignBoth = trialsUsersCorrectPassword.LongCount(t => t.IsIpInAttackersPool && t.IsClientAProxyIP);
            long        numCorrectGuessesFromProxy        = trialsGuessesCorrectPassword.LongCount(t => t.IsClientAProxyIP);
            long        numCorrectGuessesFromBenignIpPool = trialsGuessesCorrectPassword.LongCount(t => t.IsIpInBenignPool);
            long        numCorrectGuessesFromBoth         = trialsGuessesCorrectPassword.LongCount(t => t.IsIpInBenignPool && t.IsClientAProxyIP);
            List <Task> tasks = new List <Task>();

            for (int c = 0; c < numConditions; c++)
            {
                //List<Trial> originalMalicious = new List<Trial>(trialsGuessesCorrectPassword);
                //List<Trial> originalBenign = new List<Trial>(trialsUsersCorrectPassword);
                //originalMalicious.Sort((a, b) => -a.CompareTo(b, conditionNumber));
                //originalBenign.Sort((a, b) => -a.CompareTo(b, conditionNumber));
                //Queue<Trial> malicious = new Queue<Trial>(originalMalicious);
                //Queue<Trial> benign = new Queue<Trial>(originalBenign);
                if (c > 0 && c < 7)
                {
                    continue;
                }

                int conditionNumber = c;
                tasks.Add(Task.Run(() =>
                {
                    Console.Out.WriteLine("Starting work on Condition: {0}", conditionNumber);
                    List <ROCPoint> rocPoints = new List <ROCPoint>();

                    {
                        Queue <Trial> malicious =
                            new Queue <Trial>(
                                trialsGuessesCorrectPassword.AsParallel().OrderByDescending((x) => x.GetScoreForCondition(conditionNumber)));
                        Console.Out.WriteLine("Sort 1 completed for Condition {0}", conditionNumber);
                        Queue <Trial> benign =
                            new Queue <Trial>(
                                trialsUsersCorrectPassword.AsParallel().OrderByDescending((x) => x.GetScoreForCondition(conditionNumber)));
                        Console.Out.WriteLine("Sort 2 completed for Condition {0}", conditionNumber);
                        int originalMaliciousCount = malicious.Count;
                        int originalBenignCount    = benign.Count;

                        int falsePositives                       = 0;
                        int falsePositivesWithProxy              = 0;
                        int falsePositivesWithAttackerIp         = 0;
                        int falsePositivesWithProxyAndAttackerIp = 0;
                        long falseNegativeWithProxy              = numCorrectGuessesFromProxy;
                        long falseNegativeBenignIp               = numCorrectGuessesFromBenignIpPool;
                        long falseNegativeBenignProxyIp          = numCorrectGuessesFromBoth;
                        HashSet <int> falsePositiveUsers         = new HashSet <int>();
                        HashSet <uint> falsePositiveIPs          = new HashSet <uint>();
                        //int falseNegativeFromDefendersIpPool;


                        double blockThreshold = malicious.Peek().GetScoreForCondition(conditionNumber);
                        rocPoints.Add(
                            new ROCPoint(0, 0, 0, 0, originalMaliciousCount, originalBenignCount,
                                         falsePositivesWithAttackerIp, falsePositivesWithProxy,
                                         falsePositivesWithProxyAndAttackerIp,
                                         falseNegativeBenignIp, falseNegativeWithProxy, falseNegativeBenignProxyIp,
                                         blockThreshold));

                        while (malicious.Count > 0)
                        {
                            // Remove all malicious requests above this new threshold
                            while (malicious.Count > 0 &&
                                   malicious.Peek().GetScoreForCondition(conditionNumber) >= blockThreshold)
                            {
                                Trial t = malicious.Dequeue();
                                if (t.IsClientAProxyIP)
                                {
                                    falseNegativeWithProxy--;
                                }
                                if (t.IsIpInBenignPool)
                                {
                                    falseNegativeBenignIp--;
                                }
                                if (t.IsIpInBenignPool && t.IsClientAProxyIP)
                                {
                                    falseNegativeBenignProxyIp--;
                                }
                            }

                            // Remove all benign requests above this new threshold
                            while (benign.Count > 0 &&
                                   benign.Peek().GetScoreForCondition(conditionNumber) >= blockThreshold)
                            {
                                Trial t = benign.Dequeue();
                                falsePositives++;
                                falsePositiveUsers.Add(t.UserID);
                                falsePositiveIPs.Add(t.ClientIP);
                                if (t.IsIpInAttackersPool)
                                {
                                    falsePositivesWithAttackerIp++;
                                }
                                if (t.IsClientAProxyIP)
                                {
                                    falsePositivesWithProxy++;
                                }
                                if (t.IsIpInAttackersPool && t.IsClientAProxyIP)
                                {
                                    falsePositivesWithProxyAndAttackerIp++;
                                }
                            }

                            rocPoints.Add(new ROCPoint(
                                              falsePositives, //originalBenign.Count - benign.Count,
                                              falsePositiveUsers.Count(),
                                              falsePositiveIPs.Count(),
                                              //falseNegatives, //
                                              originalMaliciousCount - malicious.Count,
                                              malicious.Count,
                                              benign.Count,
                                              falsePositivesWithAttackerIp, falsePositivesWithProxy,
                                              falsePositivesWithProxyAndAttackerIp,
                                              falseNegativeBenignIp, falseNegativeWithProxy, falseNegativeBenignProxyIp,
                                              blockThreshold));

                            // Identify next threshold
                            if (malicious.Count > 0)
                            {
                                blockThreshold = malicious.Peek().GetScoreForCondition(conditionNumber);
                            }
                        }
                    }

                    Console.Out.WriteLine("ROC Points identified for Condition {0}", conditionNumber);

                    List <ROCPoint> finalROCPoints = new List <ROCPoint>();
                    Queue <ROCPoint> rocPointQueue = new Queue <ROCPoint>(rocPoints);
                    while (rocPointQueue.Count > 0)
                    {
                        ROCPoint point = rocPointQueue.Dequeue();
                        if (rocPointQueue.Count == 0 || rocPointQueue.Peek().FalsePositives > point.FalsePositives)
                        {
                            finalROCPoints.Add(point);
                        }
                    }

                    using (
                        StreamWriter writer = new StreamWriter(path + "PointsFor_" + conditionNumber.ToString() + ".csv")
                        )
                    {
                        writer.WriteLine("{0},{1},{2},{3},{4},{5},{6},{7},{8},{9},{10},{11},{12},{13},{14},{15},{16}",
                                         "False +",
                                         "False + users",
                                         "False + IPs",
                                         "False -",
                                         "True +",
                                         "True -",
                                         "FP Rate",
                                         "TP Rate",
                                         "Precision",
                                         "Recall",
                                         "FPwAttackerIP",
                                         "FPwProxy",
                                         "FPwBoth",
                                         "FNwBenignIP",
                                         "FNwProxy",
                                         "FNwBoth",
                                         "Threshold");


                        foreach (ROCPoint point in finalROCPoints)
                        {
                            writer.WriteLine(
                                "{0},{1},{2},{3},{4},{5},{6},{7},{8},{9},{10},{11},{12},{13},{14},{15},{16}",
                                point.FalsePositives,
                                point.FalsePositiveUniqueUsers,
                                point.FalsePositiveUniqueIPs,
                                point.FalseNegatives, point.TruePositives, point.TrueNegatives,
                                point.FalsePositiveRate, point.TruePositiveRate, point.Precision, point.Recall,
                                point.FalsePositivesWithAttackerIp, point.FalsePositivesWithProxy,
                                point.FalsePositivesWithProxyAndAttackerIp,
                                point.FalseNegativesWithBenignIp, point.FalseNegativesWithProxy,
                                point.FalseNegativesWithBenignProxyIp,
                                point.BlockingThreshold);
                        }
                        writer.Flush();
                    }
                    Console.Out.WriteLine("Finished with Condition {0}", conditionNumber);
                }));
            }
            Task.WaitAll(tasks.ToArray());
        }
Exemple #12
0
 public float GetScore(Trial t) => (float)t.DecayedMaxConsecutiveIncorrectAttemptsPerAccount;
Exemple #13
0
 public float GetScore(Trial t) => t.IsFrequentlyGuessedPassword ? 1f : 0f;
Exemple #14
0
 public float GetScore(Trial t) => (float) t.InvalidAttemptsPerPassword;
Exemple #15
0
        //public float GetScoreForCondition(Condition c)
        //{

        //    double score =
        //        c.alpha*
        //        ( ( 
        //            AccountFailuresInfrequentPassword*c.phi_infrequent +
        //            AccountFailuresFrequentPassword*c.phi_frequent 
        //            ) +
        //            c.repeat * 
        //           (
        //            RepeatAccountFailuresInfrequentPassword*c.phi_infrequent + 
        //            RepeatAccountFailuresFrequentPassword*c.phi_frequent
        //           )
        //        )
        //        +
        //        c.beta_notypo * c.phi_infrequent * (
        //            PasswordFailuresNoTypoInfrequentPassword +
        //            RepeatPasswordFailuresNoTypoInfrequentPassword * c.repeat)
        //        +
        //        c.beta_notypo * c.phi_frequent * (
        //            PasswordFailuresNoTypoFrequentPassword +
        //            RepeatPasswordFailuresNoTypoFrequentPassword * c.repeat)
        //        +
        //        c.beta_typo * c.phi_infrequent * (
        //            PasswordFailuresTypoInfrequentPassword +
        //            RepeatPasswordFailuresTypoInfrequentPassword * c.repeat)
        //        +
        //        c.beta_typo * c.phi_frequent * (
        //            PasswordFailuresTypoFrequentPassword +
        //            RepeatPasswordFailuresTypoFrequentPassword * c.repeat)
        //        ;
        //  score -= c.gamma*SuccessfulLogins;
        //    if (!IsFrequentlyGuessedPassword)
        //        score /= c.T;
        //    if (DeviceCookieHadPriorSuccessfulLoginForThisAccount)
        //        score = 0;
            
        //    return (float) score;
        //}

        public int CompareTo(Trial other, ICondition condition)
        {
            float myScore = condition.GetScore(this);
            float othersScore = condition.GetScore(other);
            if (myScore < othersScore)
                return -1;
            if (myScore > othersScore)
                return 1;
            return 0;
        }