Source Code for network and port scanner, TRW algorithm, and reduction method implementations.

fedora_code_trw.py 2.8KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061
  1. ##################################
  2. # TRW sin reduccion #
  3. # Para Silk's Data Set #
  4. ################################
  5. from silk import *
  6. startDate = "2018/08/14"
  7. endDate = "2018/08/15"
  8. p = 2
  9. def Analisis():
  10. counter = 0 # borrar luego
  11. sampleHash={} #hash para contener los dip con el numero de conecciones y failed coneccciones
  12. flow_counter = 0
  13. for filename in FGlob(classname="all", type="all", start_date=startDate, end_date=endDate, site_config_file="/etc/silk/conf-v9/silk.conf", data_rootdir="/home/scratch/flow/rwflowpack/"):
  14. for rec in silkfile_open(filename, READ):#reading the flow file
  15. flow_counter += 1
  16. if (':' in str(rec.sip)):
  17. continue
  18. else:
  19. connection = [0] * 2 #Lista para contener los valores de conecciones failed y conecciones buenas
  20. sip = str(rec.sip) #Devuelve el ip en notacion punto-decimal
  21. flags = str(rec.tcpflags)
  22. #print sip, flags
  23. #counter +=1
  24. if 'A' in flags: ####arreglar
  25. connection[1]=1 #good conections
  26. else:
  27. connection [0] =1 #failed conections
  28. if sip in sampleHash:
  29. sampleHash[sip][0]+= connection[0]
  30. sampleHash[sip][1]+= connection[1]
  31. else:
  32. sampleHash[sip] = [connection[0], connection[1]]
  33. #print sampleHash
  34. #print flow_counter
  35. return sampleHash
  36. sip_connections_list = Analisis()
  37. #print sip_connections_list
  38. sipList = {"sipList":[]}
  39. for sip in sip_connections_list:
  40. if (sip_connections_list[sip][1] != 0) and ((sip_connections_list[sip][0] / sip_connections_list[sip][1]) < 1) : #si la cantidad de succesful
  41. #b #g #connections es mas que failed connections
  42. #not scanner, ignore
  43. continue
  44. elif (sip_connections_list[sip][1] != 0) and ((sip_connections_list[sip][0] / sip_connections_list[sip][1]) < p): #mas failed que succesful, pero no llega al threshold
  45. #not scanner, ignore
  46. continue #se debe tener en cuenta que es suspicious pero no taaanto
  47. elif (sip_connections_list[sip][1] == 0 and sip_connections_list[sip][0] > 10): #el ratio de failed a succesful llega al threshold pautado
  48. #scanner, oh oh
  49. hash = {sip:sip_connections_list[sip]}
  50. sipList["sipList"].append(hash)
  51. else:
  52. #scanner, oh oh
  53. hash = {sip:sip_connections_list[sip]}
  54. sipList["sipList"].append(hash)
  55. print sipList