def test__update_twotuplebi_noupdate(): afg = AnubisFG(bidirectional=True) capture = rdpcap('tests/data/test_100_rows.pcap') # First packet is a STP packet that should not be read. packet = capture[0] afg._update_twotuplebi(packet) assert afg.memory_twotup == dict() with pytest.raises(IndexError, match='Packet does not have an IP layer'): afg._update_twotuplebi(packet, ignore_errors=False)
def test_update(): capture = rdpcap('tests/data/test_100_rows.pcap') # Will be tested considering all possible sets of attributes. for bidir in [True, False]: for onlytwo in [True, False]: for onlyfive in set([not onlytwo, False]): # This will be updated by the method update. afg_1 = AnubisFG(bidirectional=bidir, only_twotuple=onlytwo, only_fivetuple=onlyfive) # This will be updated by the specific method(s) tested above. afg_2 = AnubisFG(bidirectional=bidir, only_twotuple=onlytwo, only_fivetuple=onlyfive) for i in range(1, 4): packet = capture[i] afg_1.update(packet) assert afg_1.lst_timestamp == datetime.utcfromtimestamp( packet.time) if bidir: if onlytwo: afg_2._update_twotuplebi(packet) elif onlyfive: afg_2._update_fivetuplebi(packet) else: afg_2._update_twotuplebi(packet) afg_2._update_fivetuplebi(packet) else: if onlytwo: afg_2._update_twotupleuni(packet) elif onlyfive: afg_2._update_fivetupleuni(packet) else: afg_2._update_twotupleuni(packet) afg_2._update_fivetupleuni(packet) if afg_1.memory_twotup is None: assert afg_2.memory_twotup is None else: assert afg_1.memory_twotup.keys( ) == afg_2.memory_twotup.keys() for key in afg_1.memory_twotup.keys(): assert afg_1.memory_twotup[ key].__dict__ == afg_2.memory_twotup[ key].__dict__ if afg_1.memory_fivetup is None: assert afg_2.memory_fivetup is None else: assert afg_1.memory_fivetup.keys( ) == afg_2.memory_fivetup.keys() for key in afg_1.memory_fivetup.keys(): assert afg_1.memory_fivetup[ key].__dict__ == afg_2.memory_fivetup[ key].__dict__
def test__generate_features_twotuplebi(): ''' ''' n_features = 41 ip_src = '172.16.0.5' ip_dst = '192.168.50.1' key = (ip_src, ip_dst) afg = AnubisFG(bidirectional=True) # Tuple that is not on the memory. empty = afg._generate_features_twotuplebi(key) assert empty == [0] * n_features # Duration 0 capture = rdpcap('tests/data/test_100_rows.pcap') # Second packet is a SYN TCP packet. packet = capture[1] timestamp = datetime(2018, 12, 1, 13, 17, 11, 183810) afg._update_twotuplebi(packet) expected = [ # fwd 1, # qt_pkt 1, # qt_pkt_tcp 0, # qt_pkt_udp 0, # qt_pkt_icmp 0, # qt_pkt_ip 1, # qt_prtcl 1, # qt_src_prt 1, # qt_dst_prt 0, # qt_fin_fl 1, # qt_syn_fl 0, # qt_res_fl 0, # qt_psh_fl 0, # qt_ack_fl 0, # qt_urg_fl 0, # qt_ecn_fl 0, # qt_cwr_fl 20, # avg_hdr_len 74, # avg_pkt_len 1, # frq_pkt 63, # avg_ttl # bck 0, # qt_pkt 0, # qt_pkt_tcp 0, # qt_pkt_udp 0, # qt_pkt_icmp 0, # qt_pkt_ip 0, # qt_prtcl 0, # qt_src_prt 0, # qt_dst_prt 0, # qt_fin_fl 0, # qt_syn_fl 0, # qt_res_fl 0, # qt_psh_fl 0, # qt_ack_fl 0, # qt_urg_fl 0, # qt_ecn_fl 0, # qt_cwr_fl 0, # avg_hdr_len 0, # avg_pkt_len 0, # frq_pkt 0, # avg_ttl # non-directional 0, # tm_dur_s ] ftrs = afg._generate_features_twotuplebi(key) assert ftrs == expected # Inverted expected = [ # bck 0, # qt_pkt 0, # qt_pkt_tcp 0, # qt_pkt_udp 0, # qt_pkt_icmp 0, # qt_pkt_ip 0, # qt_prtcl 0, # qt_src_prt 0, # qt_dst_prt 0, # qt_fin_fl 0, # qt_syn_fl 0, # qt_res_fl 0, # qt_psh_fl 0, # qt_ack_fl 0, # qt_urg_fl 0, # qt_ecn_fl 0, # qt_cwr_fl 0, # avg_hdr_len 0, # avg_pkt_len 0, # frq_pkt 0, # avg_ttl # fwd 1, # qt_pkt 1, # qt_pkt_tcp 0, # qt_pkt_udp 0, # qt_pkt_icmp 0, # qt_pkt_ip 1, # qt_prtcl 1, # qt_src_prt 1, # qt_dst_prt 0, # qt_fin_fl 1, # qt_syn_fl 0, # qt_res_fl 0, # qt_psh_fl 0, # qt_ack_fl 0, # qt_urg_fl 0, # qt_ecn_fl 0, # qt_cwr_fl 20, # avg_hdr_len 74, # avg_pkt_len 1, # frq_pkt 63, # avg_ttl # non-directional 0, # tm_dur_s ] ftrs = afg._generate_features_twotuplebi((key[1], key[0])) assert ftrs == expected # Duration > 0 # Updating # Third packet is another SYN TCP packet with same IPs and Ports packet = capture[2] afg._update_twotuplebi(packet) new_timestamp = datetime(2018, 12, 1, 13, 17, 11, 183813) dur = (new_timestamp - timestamp).total_seconds() expected = [ 2, # qt_pkt 2, # qt_pkt_tcp 0, # qt_pkt_udp 0, # qt_pkt_icmp 0, # qt_pkt_ip 1, # qt_prtcl 1, # qt_src_prt 1, # qt_dst_prt 0, # qt_fin_fl 2, # qt_syn_fl 0, # qt_res_fl 0, # qt_psh_fl 0, # qt_ack_fl 0, # qt_urg_fl 0, # qt_ecn_fl 0, # qt_cwr_fl 20, # avg_hdr_len 74, # avg_pkt_len 2 / dur, # frq_pkt 63, # avg_ttl # bck 0, # qt_pkt 0, # qt_pkt_tcp 0, # qt_pkt_udp 0, # qt_pkt_icmp 0, # qt_pkt_ip 0, # qt_prtcl 0, # qt_src_prt 0, # qt_dst_prt 0, # qt_fin_fl 0, # qt_syn_fl 0, # qt_res_fl 0, # qt_psh_fl 0, # qt_ack_fl 0, # qt_urg_fl 0, # qt_ecn_fl 0, # qt_cwr_fl 0, # avg_hdr_len 0, # avg_pkt_len 0, # frq_pkt 0, # avg_ttl # non-directional dur, # tm_dur_s ] ftrs = afg._generate_features_twotuplebi(key) assert ftrs == expected # Using now datetime. new_timestamp = datetime.now() dur = (new_timestamp - timestamp).total_seconds() expected = [ 2, # qt_pkt 2, # qt_pkt_tcp 0, # qt_pkt_udp 0, # qt_pkt_icmp 0, # qt_pkt_ip 1, # qt_prtcl 1, # qt_src_prt 1, # qt_dst_prt 0, # qt_fin_fl 2, # qt_syn_fl 0, # qt_res_fl 0, # qt_psh_fl 0, # qt_ack_fl 0, # qt_urg_fl 0, # qt_ecn_fl 0, # qt_cwr_fl 20, # avg_hdr_len 74, # avg_pkt_len 2 / dur, # frq_pkt 63, # avg_ttl # bck 0, # qt_pkt 0, # qt_pkt_tcp 0, # qt_pkt_udp 0, # qt_pkt_icmp 0, # qt_pkt_ip 0, # qt_prtcl 0, # qt_src_prt 0, # qt_dst_prt 0, # qt_fin_fl 0, # qt_syn_fl 0, # qt_res_fl 0, # qt_psh_fl 0, # qt_ack_fl 0, # qt_urg_fl 0, # qt_ecn_fl 0, # qt_cwr_fl 0, # avg_hdr_len 0, # avg_pkt_len 0, # frq_pkt 0, # avg_ttl # non-directional dur, # tm_dur_s ] ftrs = afg._generate_features_twotuplebi(key, now=True) assert np.isclose(ftrs, expected).all() # Backward features # Updating # Fourth packet is a SYN ACK response TCP packet with inverted IPs and packet = capture[3] afg._update_twotuplebi(packet) new_timestamp = datetime(2018, 12, 1, 13, 17, 11, 183932) dur = (new_timestamp - timestamp).total_seconds() expected = [ 2, # qt_pkt 2, # qt_pkt_tcp 0, # qt_pkt_udp 0, # qt_pkt_icmp 0, # qt_pkt_ip 1, # qt_prtcl 1, # qt_src_prt 1, # qt_dst_prt 0, # qt_fin_fl 2, # qt_syn_fl 0, # qt_res_fl 0, # qt_psh_fl 0, # qt_ack_fl 0, # qt_urg_fl 0, # qt_ecn_fl 0, # qt_cwr_fl 20, # avg_hdr_len 74, # avg_pkt_len 2 / dur, # frq_pkt 63, # avg_ttl # bck 1, # qt_pkt 1, # qt_pkt_tcp 0, # qt_pkt_udp 0, # qt_pkt_icmp 0, # qt_pkt_ip 1, # qt_prtcl 1, # qt_src_prt 1, # qt_dst_prt 0, # qt_fin_fl 1, # qt_syn_fl 0, # qt_res_fl 0, # qt_psh_fl 1, # qt_ack_fl 0, # qt_urg_fl 0, # qt_ecn_fl 0, # qt_cwr_fl 20, # avg_hdr_len 74, # avg_pkt_len 1 / dur, # frq_pkt 64, # avg_ttl # non-directional dur, # tm_dur_s ] ftrs = afg._generate_features_twotuplebi(key) # breakpoint() assert np.isclose(ftrs, expected).all() # Zero forward packets on existing flow ip_src_1 = '192.168.0.1' ip_dst_1 = '192.168.0.2' key_1 = (ip_src_1, ip_dst_1) t2_1 = TwoTupleBidirectionalNode() memory_twotup_1 = {key_1: t2_1} afg_1 = AnubisFG(bidirectional=True, memory_twotup=memory_twotup_1) ftrs = afg_1._generate_features_twotuplebi(key_1) assert ftrs == [0] * n_features
def test__update_twotuplebi_update(): afg = AnubisFG(bidirectional=True) capture = rdpcap('tests/data/test_100_rows.pcap') # Second packet is a SYN TCP packet. packet = capture[1] ip_src = '172.16.0.5' ip_dst = '192.168.50.1' timestamp = datetime(2018, 12, 1, 13, 17, 11, 183810) src_port = 60675 dst_port = 80 protocol = 6 hdr_len = 20 length = 74 ttl = 63 fwd_pkt_flag_counter = [0] * 8 # SYN flag fwd_pkt_flag_counter[1] = 1 bck_pkt_flag_counter = [0] * 8 # Creating afg._update_twotuplebi(packet) expected = { 'fst_timestamp': timestamp, 'lst_timestamp': timestamp, 'fwd_set_src_ports': {src_port}, 'fwd_set_dst_ports': {dst_port}, 'fwd_pkt_flag_counter': fwd_pkt_flag_counter, 'fwd_pkt_protocol_counter': { protocol: 1 }, 'fwd_tot_header_len': hdr_len, 'fwd_tot_packet_len': length, 'fwd_tot_ttl': ttl, 'bck_set_src_ports': set(), 'bck_set_dst_ports': set(), 'bck_pkt_flag_counter': bck_pkt_flag_counter, 'bck_pkt_protocol_counter': dict(), 'bck_tot_header_len': 0, 'bck_tot_packet_len': 0, 'bck_tot_ttl': 0 } assert len(afg.memory_twotup) == 1 assert afg.memory_twotup[(ip_src, ip_dst)].__dict__ == expected # Updating Forward # Third packet is another SYN TCP packet with same IPs and Ports packet = capture[2] new_timestamp = datetime(2018, 12, 1, 13, 17, 11, 183813) # SYN flag fwd_pkt_flag_counter[1] += 1 afg._update_twotuplebi(packet) expected = { 'fst_timestamp': timestamp, 'lst_timestamp': new_timestamp, 'fwd_set_src_ports': {src_port}, 'fwd_set_dst_ports': {dst_port}, 'fwd_pkt_flag_counter': fwd_pkt_flag_counter, 'fwd_pkt_protocol_counter': { protocol: 2 }, 'fwd_tot_header_len': hdr_len * 2, 'fwd_tot_packet_len': length * 2, 'fwd_tot_ttl': ttl * 2, 'bck_set_src_ports': set(), 'bck_set_dst_ports': set(), 'bck_pkt_flag_counter': bck_pkt_flag_counter, 'bck_pkt_protocol_counter': dict(), 'bck_tot_header_len': 0, 'bck_tot_packet_len': 0, 'bck_tot_ttl': 0 } assert len(afg.memory_twotup) == 1 assert afg.memory_twotup[(ip_src, ip_dst)].__dict__ == expected # Fourth packet is a SYN ACK response TCP packet with inverted IPs and # Ports packet = capture[3] new_timestamp = datetime(2018, 12, 1, 13, 17, 11, 183932) # SYN flag bck_pkt_flag_counter[1] += 1 # ACK flag bck_pkt_flag_counter[4] += 1 afg._update_twotuplebi(packet) expected = { 'fst_timestamp': timestamp, 'lst_timestamp': new_timestamp, 'fwd_set_src_ports': {src_port}, 'fwd_set_dst_ports': {dst_port}, 'fwd_pkt_flag_counter': fwd_pkt_flag_counter, 'fwd_pkt_protocol_counter': { protocol: 2 }, 'fwd_tot_header_len': hdr_len * 2, 'fwd_tot_packet_len': length * 2, 'fwd_tot_ttl': ttl * 2, 'bck_set_src_ports': {dst_port}, 'bck_set_dst_ports': {src_port}, 'bck_pkt_flag_counter': bck_pkt_flag_counter, 'bck_pkt_protocol_counter': { protocol: 1 }, 'bck_tot_header_len': hdr_len, 'bck_tot_packet_len': length, 'bck_tot_ttl': 64 } assert len(afg.memory_twotup) == 1 assert afg.memory_twotup[(ip_src, ip_dst)].__dict__ == expected