1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
|
#!/usr/bin/env python3
# pip3 install -U scikit-learn scipy matplotlib
import os
import sklearn
import sklearn.ensemble
import sys
sys.path.append(os.path.dirname(sys.argv[0]) + '/../../dependencies')
sys.path.append(os.path.dirname(sys.argv[0]) + '/../share/nDPId')
sys.path.append(os.path.dirname(sys.argv[0]))
sys.path.append(sys.base_prefix + '/share/nDPId')
import nDPIsrvd
from nDPIsrvd import nDPIsrvdSocket, TermColor
class RFC(sklearn.ensemble.RandomForestClassifier):
def __init__(self, max_samples):
self.max_samples = max_samples
self.samples_x = []
self.samples_y = []
super().__init__(verbose=1, n_estimators=1000, max_samples=max_samples)
def addSample(self, x, y):
self.samples_x += x
self.samples_y += y
def fit(self):
if len(self.samples_x) != self.max_samples or \
len(self.samples_y) != self.max_samples:
return False
super().fit(self.samples_x, self.samples_y)
self.samples_x = []
self.samples_y = []
return True
def onJsonLineRecvd(json_dict, instance, current_flow, global_user_data):
if 'flow_event_name' not in json_dict:
return True
if json_dict['flow_event_name'] != 'analyse':
return True
if 'ndpi' not in json_dict:
return True
if 'proto' not in json_dict['ndpi']:
return True
#print(json_dict)
features = [[]]
features[0] += json_dict['data_analysis']['bins']['c_to_s']
features[0] += json_dict['data_analysis']['bins']['s_to_c']
#print(features)
out = ''
rfc = global_user_data
try:
out += '[Predict: {}]'.format(rfc.predict(features)[0])
except sklearn.exceptions.NotFittedError:
pass
# TLS.DoH_DoT
if json_dict['ndpi']['proto'].startswith('TLS.') is not True and \
json_dict['ndpi']['proto'] != 'TLS':
rfc.addSample(features, [0])
else:
rfc.addSample(features, [1])
if rfc.fit() is True:
out += '*** FIT *** '
out += '[{}]'.format(json_dict['ndpi']['proto'])
print(out)
return True
if __name__ == '__main__':
argparser = nDPIsrvd.defaultArgumentParser()
args = argparser.parse_args()
address = nDPIsrvd.validateAddress(args)
sys.stderr.write('Recv buffer size: {}\n'.format(nDPIsrvd.NETWORK_BUFFER_MAX_SIZE))
sys.stderr.write('Connecting to {} ..\n'.format(address[0]+':'+str(address[1]) if type(address) is tuple else address))
rfc = RFC(10)
nsock = nDPIsrvdSocket()
nsock.connect(address)
nsock.loop(onJsonLineRecvd, None, rfc)
|