def test_get_interval_pps_below_max(self):
cipps = [(5, 1), (10, 2), (15, 3)]
self.assertEqual(Utility.get_interval_pps(cipps, 3), 1)
self.assertEqual(Utility.get_interval_pps(cipps, 7), 2)
self.assertEqual(Utility.get_interval_pps(cipps, 12), 3)
def generate_attack_packets(self):
"""
Creates the attack packets.
"""
# Timestamp
timestamp_next_pkt = self.get_param_value(self.INJECT_AT_TIMESTAMP)
pps = self.get_param_value(self.PACKETS_PER_SECOND)
# calculate complement packet rates of BG traffic per interval
complement_interval_pps = self.statistics.calculate_complement_packet_rates(
pps)
# Initialize parameters
mac_source = self.get_param_value(self.MAC_SOURCE)
ip_source = self.get_param_value(self.IP_SOURCE)
# FIXME: why is port_source never used?
port_source = self.get_param_value(self.PORT_SOURCE)
mac_destination = self.get_param_value(self.MAC_DESTINATION)
ip_destination = self.get_param_value(self.IP_DESTINATION)
port_destination = self.get_param_value(self.PORT_DESTINATION)
# Check ip.src == ip.dst
self.ip_src_dst_catch_equal(ip_source, ip_destination)
# Set TTL based on TTL distribution of IP address
source_ttl_dist = self.statistics.get_ttl_distribution(ip_source)
if len(source_ttl_dist) > 0:
source_ttl_prob_dict = lea.Lea.fromValFreqsDict(source_ttl_dist)
source_ttl_value = source_ttl_prob_dict.random()
else:
source_ttl_value = Util.handle_most_used_outputs(
self.statistics.get_most_used_ttl_value())
destination_ttl_dist = self.statistics.get_ttl_distribution(
ip_destination)
if len(destination_ttl_dist) > 0:
destination_ttl_prob_dict = lea.Lea.fromValFreqsDict(
destination_ttl_dist)
destination_ttl_value = destination_ttl_prob_dict.random()
else:
destination_ttl_value = Util.handle_most_used_outputs(
self.statistics.get_most_used_ttl_value())
# Set Window Size based on Window Size distribution of IP address
source_win_dist = self.statistics.get_win_distribution(ip_source)
if len(source_win_dist) > 0:
source_win_prob_dict = lea.Lea.fromValFreqsDict(source_win_dist)
else:
source_win_dist = self.statistics.get_win_distribution(
self.statistics.get_most_used_ip_address())
source_win_prob_dict = lea.Lea.fromValFreqsDict(source_win_dist)
destination_win_dist = self.statistics.get_win_distribution(
ip_destination)
if len(destination_win_dist) > 0:
destination_win_prob_dict = lea.Lea.fromValFreqsDict(
destination_win_dist)
else:
destination_win_dist = self.statistics.get_win_distribution(
self.statistics.get_most_used_ip_address())
destination_win_prob_dict = lea.Lea.fromValFreqsDict(
destination_win_dist)
# Set MSS (Maximum Segment Size) based on MSS distribution of IP address
mss_value = Util.handle_most_used_outputs(
self.statistics.get_most_used_mss_value())
if not mss_value:
mss_value = 1465
# Inject EternalBlue exploit packets
# Read Win7_eternalblue_exploit pcap file
source_origin_wins, destination_origin_wins = {}, {}
exploit_raw_packets = scapy.utils.RawPcapReader(
self.template_attack_pcap_path)
port_source = rnd.randint(
self.minDefaultPort,
self.maxDefaultPort) # experiments show this range of ports
# conversations = {(ip.src, ip.dst, port.src, port.dst): packets}
conversations, order_list_conversations = self.packets_to_convs(
exploit_raw_packets)
exploit_raw_packets.close()
conv_start_timesamp = timestamp_next_pkt
for conv_index, conv in enumerate(order_list_conversations):
# the distance between the starts of the converstaions
conv_start_timesamp = conv_start_timesamp + rnd.uniform(
0.001, 0.01)
timestamp_next_pkt = conv_start_timesamp
conv_pkts = conversations[conv]
inter_arrival_times = self.get_inter_arrival_time(conv_pkts)
if conv_index == len(
order_list_conversations) - 2: # Not the last conversation
timestamp_next_pkt = self.packets[-1].time + rnd.uniform(
0.001, 0.01)
if conv_index != len(
order_list_conversations) - 1: # Not the last conversation
port_source += 2
for self.pkt_num, pkt in enumerate(conv_pkts):
eth_frame = inet.Ether(pkt[0])
ip_pkt = eth_frame.payload
tcp_pkt = ip_pkt.payload
if self.pkt_num == 0:
if tcp_pkt.getfieldval("dport") == SMBLib.smb_port:
orig_ip_dst = ip_pkt.getfieldval("dst")
# Request
if ip_pkt.getfieldval("dst") == orig_ip_dst: # victim IP
# Ether
eth_frame.setfieldval("src", mac_source)
eth_frame.setfieldval("dst", mac_destination)
# IP
ip_pkt.setfieldval("src", ip_source)
ip_pkt.setfieldval("dst", ip_destination)
ip_pkt.setfieldval("ttl", source_ttl_value)
# TCP
tcp_pkt.setfieldval("sport", port_source)
tcp_pkt.setfieldval("dport", port_destination)
# Window Size
source_origin_win = tcp_pkt.getfieldval("window")
if source_origin_win not in source_origin_wins:
source_origin_wins[
source_origin_win] = source_win_prob_dict.random(
)
new_win = source_origin_wins[source_origin_win]
tcp_pkt.setfieldval("window", new_win)
# MSS
tcp_options = tcp_pkt.getfieldval("options")
if tcp_options:
if tcp_options[0][0] == "MSS":
tcp_options[0] = ("MSS", mss_value)
tcp_pkt.setfieldval("options", tcp_options)
new_pkt = (eth_frame / ip_pkt / tcp_pkt)
new_pkt.time = timestamp_next_pkt
pps = max(
Util.get_interval_pps(complement_interval_pps,
timestamp_next_pkt), 10)
timestamp_next_pkt = self.timestamp_controller.next_timestamp(
) + inter_arrival_times[
self.pkt_num] # float(timeSteps.random())
# Reply
else:
# Ether
eth_frame.setfieldval("src", mac_destination)
eth_frame.setfieldval("dst", mac_source)
# IP
ip_pkt.setfieldval("src", ip_destination)
ip_pkt.setfieldval("dst", ip_source)
ip_pkt.setfieldval("ttl", destination_ttl_value)
# TCP
tcp_pkt.setfieldval("dport", port_source)
tcp_pkt.setfieldval("sport", port_destination)
# Window Size
destination_origin_win = tcp_pkt.getfieldval("window")
if destination_origin_win not in destination_origin_wins:
destination_origin_wins[
destination_origin_win] = destination_win_prob_dict.random(
)
new_win = destination_origin_wins[
destination_origin_win]
tcp_pkt.setfieldval("window", new_win)
# MSS
tcp_options = tcp_pkt.getfieldval("options")
if tcp_options:
if tcp_options[0][0] == "MSS":
tcp_options[0] = ("MSS", mss_value)
tcp_pkt.setfieldval("options", tcp_options)
new_pkt = (eth_frame / ip_pkt / tcp_pkt)
pps = max(
Util.get_interval_pps(complement_interval_pps,
timestamp_next_pkt), 10)
timestamp_next_pkt = self.timestamp_controller.next_timestamp(
) + inter_arrival_times[
self.pkt_num] # float(timeSteps.random())
new_pkt.time = timestamp_next_pkt
self.add_packet(new_pkt, ip_source, ip_destination)
else: # Last conversation where the victim start a connection with the attacker
timestamp_next_pkt = self.packets[-1].time + rnd.uniform(
0.001, 0.01)
port_source = rnd.randint(self.minDefaultPort,
self.maxDefaultPort)
for self.pkt_num, pkt in enumerate(conv_pkts):
eth_frame = inet.Ether(pkt[0])
ip_pkt = eth_frame.payload
tcp_pkt = ip_pkt.payload
# Request
if tcp_pkt.getfieldval("dport") == self.last_conn_dst_port:
# Ether
eth_frame.setfieldval("src", mac_destination)
eth_frame.setfieldval("dst", mac_source)
# IP
ip_pkt.setfieldval("src", ip_destination)
ip_pkt.setfieldval("dst", ip_source)
ip_pkt.setfieldval("ttl", destination_ttl_value)
# TCP
tcp_pkt.setfieldval("sport", port_source)
# destination port is fixed 4444
# Window Size
destination_origin_win = tcp_pkt.getfieldval("window")
if destination_origin_win not in destination_origin_wins:
destination_origin_wins[
destination_origin_win] = destination_win_prob_dict.random(
)
new_win = destination_origin_wins[
destination_origin_win]
tcp_pkt.setfieldval("window", new_win)
# MSS
tcp_options = tcp_pkt.getfieldval("options")
if tcp_options:
if tcp_options[0][0] == "MSS":
tcp_options[0] = ("MSS", mss_value)
tcp_pkt.setfieldval("options", tcp_options)
new_pkt = (eth_frame / ip_pkt / tcp_pkt)
new_pkt.time = timestamp_next_pkt
pps = max(
Util.get_interval_pps(complement_interval_pps,
timestamp_next_pkt), 10)
timestamp_next_pkt = self.timestamp_controller.next_timestamp(
) + inter_arrival_times[
self.pkt_num] # float(timeSteps.random())
# Reply
else:
# Ether
eth_frame.setfieldval("src", mac_source)
eth_frame.setfieldval("dst", mac_destination)
# IP
ip_pkt.setfieldval("src", ip_source)
ip_pkt.setfieldval("dst", ip_destination)
ip_pkt.setfieldval("ttl", source_ttl_value)
# TCP
tcp_pkt.setfieldval("dport", port_source)
# source port is fixed 4444
# Window Size
source_origin_win = tcp_pkt.getfieldval("window")
if source_origin_win not in source_origin_wins:
source_origin_wins[
source_origin_win] = source_win_prob_dict.random(
)
new_win = source_origin_wins[source_origin_win]
tcp_pkt.setfieldval("window", new_win)
# MSS
tcp_options = tcp_pkt.getfieldval("options")
if tcp_options:
if tcp_options[0][0] == "MSS":
tcp_options[0] = ("MSS", mss_value)
tcp_pkt.setfieldval("options", tcp_options)
new_pkt = (eth_frame / ip_pkt / tcp_pkt)
pps = max(
Util.get_interval_pps(complement_interval_pps,
timestamp_next_pkt), 10)
timestamp_next_pkt = self.timestamp_controller.next_timestamp(
) + inter_arrival_times[
self.pkt_num] # float(timeSteps.random())
new_pkt.time = timestamp_next_pkt
self.add_packet(new_pkt, ip_source, ip_destination)
def test_get_interval_pps_above_max(self):
cipps = [(5, 1), (10, 2), (15, 3)]
self.assertEqual(Utility.get_interval_pps(cipps, 30), 3)