from silk import *

myNum = 0
sipList=[]
sip_hash = {}
startDate = "2009/04/20"
endDate = "2009/04/22"
p = 2
##################################

#   TRW con reduccion           #

#      Para Silk's Data Set     #

#################################


def ipConversion(number, position):
    mystr = ''
    ipadd = number.split(".") #Devuelve un arreglo
    #print ipadd
    for i in range(position+1):
        if i == position:
            #print ipadd[i]
            mystr = mystr + ipadd[i]
        else:
           # print ipadd[i]
            mystr = mystr + ipadd[i] + '.'
    return mystr #devuelve los numeros en notacion string


def AnalisisReduciendo(sipList, num):
    sip_hash = {}
    #print sipList
    flow_counter = 0
    for filename in FGlob(classname="all", type="all", start_date=startDate, end_date=endDate, site_config_file="/data/silk.conf", data_rootdir="/data"):
        for rec in silkfile_open(filename, READ):#reading the flow file
            flow_counter += 1
            if (':' in str(rec.sip)) or (num != 0 and ipConversion(str(rec.sip), num-1) not in sipList):#Si en el paso anterior se vio que no
                                                               #tiene el length de puertos requerido, se ignora
		       continue
            else:
                connection = [0] * 2 #Lista para contener los valores de conecciones fallidas y conecciones buenas
                sip = ipConversion(str(rec.sip), num) #Devuelve el ip en notacion punto-decimal
                flags = str(rec.tcpflags)  #array of all tcp flags that are set
                if 'A' in flags: #if the acknowledge flag is set
                    connection[1]=1 #good conections
                else:
                    connection [0] =1 #failed conections
                if sip in sip_hash: #si sip esta en ratioHash => que posA esta en sampleHash
                                            #por lo tanto ya se puede sumar las conecciones al ratio del dip
                    sip_hash[sip][0]+=connection[0]
                    sip_hash[sip][1] += connection[1]
                else: #si sip no esta en ratioHash tampoco
                    sip_hash[sip] = [connection[0], connection[1]]
                #print sip_hash
    #print flow_counter
    return sip_hash


while myNum <4:
      sip_connections_list = AnalisisReduciendo(sipList, myNum)
      sipList = []
      for sip in sip_connections_list:
          if (sip_connections_list[sip][1] != 0) and ((sip_connections_list[sip][0] / sip_connections_list[sip][1])  < 1) : #si la cantidad de succesful
                                #b                #g                    #connections es mas que failed connections
                      #not scanner, ignore
                      continue
          elif (sip_connections_list[sip][1] != 0) and ((sip_connections_list[sip][0] / sip_connections_list[sip][1])  < p): #mas failed que succesful, pero no llega al threshold
                      #not scanner, ignore
                      continue                          #se debe tener en cuenta que es suspicious pero no taaanto
          elif (sip_connections_list[sip][1] == 0 and sip_connections_list[sip][0] > 10): #el ratio de failed a succesful llega al threshold pautado
                            #scanner, oh oh
                    sipList.append(sip)
          else:
                            #scanner, oh oh
                    sipList.append(sip)
      #print sipList

      #print myNum
      myNum += 1
#print len(sipList)