├── README.md ├── ftp-big ├── after_training.png ├── test-pkg5 │ ├── .python_filtered.txt.kak.7GWzYZ │ └── rates.txt ├── test-pkt1 │ └── rates.txt └── test-pkt5-differences │ ├── difference_num_packets.txt │ ├── not_seen.txt │ └── rates.txt ├── ftp-small ├── after_training.png └── test │ ├── daysdiff.txt │ └── rates.txt ├── paper.pdf └── program.p4 /README.md: -------------------------------------------------------------------------------- 1 | # Filtering DDoS traffic using the P4 programming language 2 | 3 | This repository contains the results used in writing the attached paper. 4 | 5 | The content is as follows: 6 | 7 | ``` 8 | ftp-big # The big dataset as described in the paper 9 | ├── after_training.png # Result of the training phase 10 | ├── test-pkt1 # Test with packet threshold=1 and Days threshold = 1 11 | │   └── rates.txt # Rates as described in the paper 12 | ├── test-pkt5 # Test with packet threshold=5 and Days threshold = 1 13 | │   └── rates.txt # Rates as described in the paper 14 | └── test-pkt5-differences # Test with packet threshold=5 and Days threshold = 1 including differences between python and P4 15 | ├── difference_num_packets.txt # Difference in number of packets 16 | ├── not_seen.txt # IP addresses that were seen by P4 but not by python 17 | └── rates.txt # Rates as described in the paper 18 | ftp-small # The small dataset as described in the paper 19 | ├── after_training.png # Result of the training phase 20 | └── test # Test with packet threshold=5 and Days threshold = 1 21 |    ├── daysdiff.txt # Difference in number of days between Python and P4 22 |    └── rates.txt # Rates as described in the paper 23 | program.p4 # The P4 implemenation of History-Based IP Filtering (HIF) 24 | paper.pdf # The paper 25 | ``` 26 | -------------------------------------------------------------------------------- /ftp-big/after_training.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JJK96/P4-filtering/b9c206234ed0f42e6e88e52a3b2eae5da71815ba/ftp-big/after_training.png -------------------------------------------------------------------------------- /ftp-big/test-pkg5/.python_filtered.txt.kak.7GWzYZ: -------------------------------------------------------------------------------- 1 | { 2 | "131.243.1.10": [ 3 | 28841 4 | ], 5 | "212.180.60.96": [ 6 | 872 7 | ], 8 | "131.243.2.12": [ 9 | 30448 10 | ], 11 | "111.52.163.66": [ 12 | 92 13 | ], 14 | "14.34.59.96": [ 15 | 32 16 | ], 17 | "197.105.135.7": [ 18 | 1744 19 | ], 20 | "111.125.4.196": [ 21 | 15 22 | ], 23 | "193.27.244.141": [ 24 | 15 25 | ], 26 | "109.103.64.27": [ 27 | 35 28 | ], 29 | "62.159.77.154": [ 30 | 32 31 | ], 32 | "131.227.26.153": [ 33 | 1 34 | ], 35 | "131.201.66.31": [ 36 | 630 37 | ], 38 | "71.228.26.214": [ 39 | 1 40 | ], 41 | "242.70.74.100": [ 42 | 527 43 | ], 44 | "90.227.190.180": [ 45 | 952 46 | ], 47 | "72.181.178.3": [ 48 | 52 49 | ], 50 | "20.105.218.163": [ 51 | 198 52 | ], 53 | "128.3.12.44": [ 54 | 1202 55 | ], 56 | "84.68.192.198": [ 57 | 131 58 | ], 59 | "237.28.193.71": [ 60 | 832 61 | ], 62 | "128.3.28.48": [ 63 | 9432 64 | ], 65 | "116.233.10.27": [ 66 | 18 67 | ], 68 | "82.143.24.12": [ 69 | 1511 70 | ], 71 | "131.243.193.93": [ 72 | 268 73 | ], 74 | "230.101.18.175": [ 75 | 144 76 | ], 77 | "116.177.87.124": [ 78 | 8 79 | ], 80 | "203.174.5.11": [ 81 | 2900 82 | ], 83 | "231.212.135.11": [ 84 | 107 85 | ], 86 | "97.0.158.29": [ 87 | 32 88 | ], 89 | "121.77.46.153": [ 90 | 16 91 | ], 92 | "5.20.102.84": [ 93 | 993 94 | ], 95 | "173.112.82.221": [ 96 | 278 97 | ], 98 | "121.204.82.134": [ 99 | 3476 100 | ], 101 | "142.141.91.149": [ 102 | 574 103 | ], 104 | "89.42.124.234": [ 105 | 740 106 | ], 107 | "165.252.43.195": [ 108 | 1838 109 | ], 110 | "173.218.67.133": [ 111 | 26 112 | ], 113 | "73.231.82.55": [ 114 | 2 115 | ], 116 | "217.207.38.45": [ 117 | 18 118 | ], 119 | "137.89.200.240": [ 120 | 17 121 | ], 122 | "156.139.170.126": [ 123 | 54 124 | ], 125 | "76.152.197.160": [ 126 | 145 127 | ], 128 | "108.97.140.165": [ 129 | 36 130 | ], 131 | "40.86.60.56": [ 132 | 19 133 | ], 134 | "44.76.136.98": [ 135 | 19 136 | ], 137 | "189.246.241.212": [ 138 | 2 139 | ], 140 | "123.47.104.102": [ 141 | 2 142 | ], 143 | "48.248.244.161": [ 144 | 2 145 | ], 146 | "136.107.80.219": [ 147 | 2 148 | ], 149 | "228.136.177.100": [ 150 | 2 151 | ], 152 | "141.35.20.31": [ 153 | 2 154 | ], 155 | "25.136.123.20": [ 156 | 5 157 | ], 158 | "210.156.123.248": [ 159 | 2 160 | ], 161 | "51.208.235.171": [ 162 | 2 163 | ], 164 | "8.181.179.18": [ 165 | 2 166 | ], 167 | "109.155.185.241": [ 168 | 2 169 | ], 170 | "38.67.154.111": [ 171 | 17 172 | ], 173 | "117.21.117.233": [ 174 | 16 175 | ], 176 | "216.43.247.103": [ 177 | 85 178 | ], 179 | "130.145.94.188": [ 180 | 16 181 | ], 182 | "131.243.1.83": [ 183 | 983 184 | ], 185 | "132.35.151.202": [ 186 | 42 187 | ], 188 | "78.56.58.89": [ 189 | 24 190 | ], 191 | "155.127.0.177": [ 192 | 2224 193 | ], 194 | "45.7.36.127": [ 195 | 1866 196 | ], 197 | "92.0.137.12": [ 198 | 14 199 | ], 200 | "154.125.41.198": [ 201 | 36 202 | ], 203 | "125.253.42.25": [ 204 | 1637 205 | ], 206 | "47.125.91.135": [ 207 | 50 208 | ], 209 | "227.11.247.195": [ 210 | 78 211 | ], 212 | "157.231.148.18": [ 213 | 1395 214 | ], 215 | "64.37.1.243": [ 216 | 617 217 | ], 218 | "83.1.240.233": [ 219 | 1868 220 | ], 221 | "114.207.221.113": [ 222 | 36 223 | ], 224 | "246.94.203.142": [ 225 | 3120 226 | ], 227 | "128.150.176.248": [ 228 | 40 229 | ], 230 | "114.95.13.30": [ 231 | 32 232 | ], 233 | "116.106.109.148": [ 234 | 83 235 | ], 236 | "94.115.110.217": [ 237 | 16 238 | ], 239 | "229.28.59.196": [ 240 | 14 241 | ], 242 | "127.115.69.174": [ 243 | 14 244 | ], 245 | "66.79.113.47": [ 246 | 15 247 | ], 248 | "119.168.174.248": [ 249 | 19 250 | ], 251 | "188.179.92.114": [ 252 | 201 253 | ], 254 | "208.220.212.205": [ 255 | 43 256 | ], 257 | "154.195.234.248": [ 258 | 50 259 | ], 260 | "96.88.100.70": [ 261 | 95 262 | ], 263 | "143.156.1.2": [ 264 | 5217 265 | ], 266 | "84.155.130.23": [ 267 | 135 268 | ], 269 | "214.153.191.211": [ 270 | 13 271 | ], 272 | "192.13.94.36": [ 273 | 105 274 | ], 275 | "233.54.231.144": [ 276 | 19 277 | ], 278 | "134.224.127.138": [ 279 | 57 280 | ], 281 | "104.32.244.70": [ 282 | 39 283 | ], 284 | "65.240.185.205": [ 285 | 1243 286 | ], 287 | "45.199.28.220": [ 288 | 28 289 | ], 290 | "110.112.122.22": [ 291 | 567 292 | ], 293 | "30.52.123.142": [ 294 | 19 295 | ], 296 | "109.115.171.214": [ 297 | 42 298 | ], 299 | "115.112.177.179": [ 300 | 16 301 | ], 302 | "51.124.71.132": [ 303 | 17 304 | ], 305 | "142.122.251.111": [ 306 | 623 307 | ], 308 | "47.190.32.70": [ 309 | 648 310 | ], 311 | "84.5.207.11": [ 312 | 62 313 | ], 314 | "38.5.158.54": [ 315 | 6695 316 | ], 317 | "228.108.41.13": [ 318 | 18 319 | ], 320 | "149.134.10.246": [ 321 | 48 322 | ], 323 | "5.61.52.210": [ 324 | 59 325 | ], 326 | "4.251.189.14": [ 327 | 18 328 | ], 329 | "67.180.178.34": [ 330 | 15 331 | ], 332 | "148.111.20.136": [ 333 | 18 334 | ], 335 | "120.198.119.152": [ 336 | 18 337 | ], 338 | "176.87.117.123": [ 339 | 57 340 | ], 341 | "31.23.81.252": [ 342 | 39 343 | ], 344 | "106.181.116.15": [ 345 | 36 346 | ], 347 | "65.100.203.248": [ 348 | 8 349 | ], 350 | "136.118.224.122": [ 351 | 1023 352 | ], 353 | "70.139.194.5": [ 354 | 3016 355 | ], 356 | "33.217.35.11": [ 357 | 290 358 | ], 359 | "236.71.170.81": [ 360 | 46 361 | ], 362 | "1.193.39.28": [ 363 | 33 364 | ], 365 | "223.218.252.131": [ 366 | 34 367 | ], 368 | "97.0.56.144": [ 369 | 45 370 | ], 371 | "66.150.59.108": [ 372 | 17 373 | ], 374 | "168.254.152.132": [ 375 | 744 376 | ], 377 | "211.57.73.255": [ 378 | 1477 379 | ], 380 | "194.28.213.86": [ 381 | 15 382 | ], 383 | "106.77.240.9": [ 384 | 41 385 | ], 386 | "161.248.223.152": [ 387 | 589 388 | ], 389 | "131.243.3.49": [ 390 | 51 391 | ], 392 | "227.144.164.216": [ 393 | 604 394 | ], 395 | "213.230.14.206": [ 396 | 20 397 | ], 398 | "73.6.91.115": [ 399 | 833 400 | ], 401 | "42.30.77.233": [ 402 | 517 403 | ], 404 | "40.226.158.89": [ 405 | 18 406 | ], 407 | "169.92.87.70": [ 408 | 1753 409 | ], 410 | "155.217.155.141": [ 411 | 210 412 | ], 413 | "89.124.219.32": [ 414 | 638 415 | ], 416 | "79.176.121.114": [ 417 | 13 418 | ], 419 | "217.148.52.180": [ 420 | 1240 421 | ], 422 | "175.111.96.67": [ 423 | 22 424 | ], 425 | "150.70.97.75": [ 426 | 19 427 | ], 428 | "195.110.227.236": [ 429 | 16 430 | ], 431 | "75.237.201.198": [ 432 | 29 433 | ], 434 | "123.125.239.10": [ 435 | 48 436 | ], 437 | "149.63.43.106": [ 438 | 45 439 | ], 440 | "213.82.145.63": [ 441 | 159 442 | ], 443 | "149.32.2.17": [ 444 | 298 445 | ], 446 | "246.109.155.46": [ 447 | 22 448 | ], 449 | "75.9.46.213": [ 450 | 75 451 | ], 452 | "192.232.226.84": [ 453 | 20 454 | ], 455 | "165.2.238.121": [ 456 | 16 457 | ], 458 | "132.124.136.127": [ 459 | 28 460 | ], 461 | "234.147.130.114": [ 462 | 12 463 | ], 464 | "60.36.91.126": [ 465 | 443 466 | ], 467 | "221.55.239.170": [ 468 | 612 469 | ], 470 | "38.93.253.216": [ 471 | 1858 472 | ], 473 | "16.69.134.221": [ 474 | 2757 475 | ], 476 | "52.23.39.95": [ 477 | 856 478 | ], 479 | "115.246.177.42": [ 480 | 39 481 | ], 482 | "164.158.41.160": [ 483 | 14 484 | ], 485 | "34.175.214.0": [ 486 | 216 487 | ], 488 | "148.75.24.53": [ 489 | 14 490 | ], 491 | "128.3.32.63": [ 492 | 19 493 | ], 494 | "215.156.189.72": [ 495 | 62 496 | ], 497 | "59.143.84.169": [ 498 | 1790 499 | ], 500 | "150.38.165.44": [ 501 | 42 502 | ], 503 | "69.157.45.176": [ 504 | 485 505 | ], 506 | "242.12.126.114": [ 507 | 13 508 | ], 509 | "107.56.251.89": [ 510 | 15 511 | ], 512 | "175.26.11.101": [ 513 | 15 514 | ], 515 | "142.179.211.195": [ 516 | 15 517 | ], 518 | "18.26.181.1": [ 519 | 15 520 | ], 521 | "249.123.7.161": [ 522 | 35 523 | ], 524 | "64.37.211.186": [ 525 | 22 526 | ], 527 | "108.100.156.170": [ 528 | 18 529 | ], 530 | "86.110.60.6": [ 531 | 19 532 | ], 533 | "109.30.24.222": [ 534 | 48 535 | ], 536 | "150.102.117.46": [ 537 | 17 538 | ], 539 | "248.38.9.24": [ 540 | 10 541 | ], 542 | "52.253.115.82": [ 543 | 13 544 | ], 545 | "90.231.71.195": [ 546 | 22 547 | ], 548 | "178.176.4.195": [ 549 | 16 550 | ], 551 | "189.30.8.121": [ 552 | 12 553 | ], 554 | "226.253.22.106": [ 555 | 36 556 | ], 557 | "11.107.146.119": [ 558 | 18 559 | ] 560 | } 561 | -------------------------------------------------------------------------------- /ftp-big/test-pkg5/rates.txt: -------------------------------------------------------------------------------- 1 | true_drop: 99.87228245444742 2 | false_drop: 10.186175368817345 3 | false_pass: 0.12771754555259124 4 | true_pass: 89.81382463118265 5 | -------------------------------------------------------------------------------- /ftp-big/test-pkt1/rates.txt: -------------------------------------------------------------------------------- 1 | true_drop: 99.86921670651104 2 | false_drop: 10.070934996636703 3 | false_pass: 0.13078329348896076 4 | true_pass: 89.92906500336329 5 | -------------------------------------------------------------------------------- /ftp-big/test-pkt5-differences/difference_num_packets.txt: -------------------------------------------------------------------------------- 1 | num_packets: 538924 2 | P4: num_packets: 539509 3 | num_packets: 268353 4 | P4: num_packets: 268373 5 | num_packets: 137678 6 | P4: num_packets: 138802 7 | num_packets: 66716 8 | P4: num_packets: 66744 9 | num_packets: 55757 10 | P4: num_packets: 55816 11 | num_packets: 55259 12 | P4: num_packets: 55270 13 | num_packets: 39682 14 | P4: num_packets: 39725 15 | num_packets: 38025 16 | P4: num_packets: 38092 17 | num_packets: 35705 18 | P4: num_packets: 35745 19 | num_packets: 34688 20 | P4: num_packets: 34722 21 | num_packets: 34075 22 | P4: num_packets: 34137 23 | num_packets: 32881 24 | P4: num_packets: 32967 25 | num_packets: 32866 26 | P4: num_packets: 32873 27 | num_packets: 30925 28 | P4: num_packets: 30931 29 | num_packets: 30576 30 | P4: num_packets: 30662 31 | num_packets: 28023 32 | P4: num_packets: 28027 33 | num_packets: 27539 34 | P4: num_packets: 27594 35 | num_packets: 27432 36 | P4: num_packets: 27475 37 | num_packets: 24830 38 | P4: num_packets: 25034 39 | num_packets: 24533 40 | P4: num_packets: 24563 41 | num_packets: 24430 42 | P4: num_packets: 24432 43 | num_packets: 22341 44 | P4: num_packets: 22380 45 | num_packets: 20313 46 | P4: num_packets: 20347 47 | num_packets: 20233 48 | P4: num_packets: 20235 49 | num_packets: 20129 50 | P4: num_packets: 20131 51 | num_packets: 19304 52 | P4: num_packets: 19377 53 | num_packets: 15184 54 | P4: num_packets: 15454 55 | num_packets: 14673 56 | P4: num_packets: 14680 57 | num_packets: 14318 58 | P4: num_packets: 14371 59 | num_packets: 13802 60 | P4: num_packets: 13887 61 | num_packets: 13801 62 | P4: num_packets: 13806 63 | num_packets: 13454 64 | P4: num_packets: 13461 65 | num_packets: 10998 66 | P4: num_packets: 11026 67 | num_packets: 8685 68 | P4: num_packets: 8688 69 | num_packets: 8657 70 | P4: num_packets: 8661 71 | num_packets: 8595 72 | P4: num_packets: 8597 73 | num_packets: 8571 74 | P4: num_packets: 8573 75 | num_packets: 7729 76 | P4: num_packets: 7750 77 | num_packets: 7632 78 | P4: num_packets: 7690 79 | num_packets: 6825 80 | P4: num_packets: 6857 81 | num_packets: 5708 82 | P4: num_packets: 5711 83 | num_packets: 5624 84 | P4: num_packets: 5626 85 | num_packets: 5432 86 | P4: num_packets: 5738 87 | num_packets: 5196 88 | P4: num_packets: 5295 89 | num_packets: 3344 90 | P4: num_packets: 3751 91 | num_packets: 3269 92 | P4: num_packets: 3278 93 | num_packets: 2968 94 | P4: num_packets: 2980 95 | num_packets: 2751 96 | P4: num_packets: 2761 97 | num_packets: 2710 98 | P4: num_packets: 2729 99 | num_packets: 2085 100 | P4: num_packets: 2265 101 | num_packets: 1337 102 | P4: num_packets: 1368 103 | num_packets: 1034 104 | P4: num_packets: 1051 105 | num_packets: 591 106 | P4: num_packets: 594 107 | num_packets: 568 108 | P4: num_packets: 606 109 | num_packets: 477 110 | P4: num_packets: 486 111 | num_packets: 416 112 | P4: num_packets: 417 113 | num_packets: 152 114 | P4: num_packets: 154 115 | num_packets: 81 116 | P4: num_packets: 92 117 | num_packets: 70 118 | P4: num_packets: 72 119 | num_packets: 59 120 | P4: num_packets: 60 121 | num_packets: 50 122 | P4: num_packets: 62 123 | num_days: 1 124 | P4: num_days: 2 125 | num_packets: 45 126 | P4: num_packets: 74 127 | num_packets: 45 128 | P4: num_packets: 74 129 | num_packets: 38 130 | P4: num_packets: 89 131 | num_packets: 20 132 | P4: num_packets: 23 133 | num_days: 1 134 | P4: num_days: 2 135 | num_packets: 16 136 | P4: num_packets: 54 137 | num_packets: 15 138 | P4: num_packets: 23 139 | total_packets: 2632722 140 | total_packets_P4: 2637377 141 | -------------------------------------------------------------------------------- /ftp-big/test-pkt5-differences/not_seen.txt: -------------------------------------------------------------------------------- 1 | Python: ip: 185.86.15.200 not seen 2 | P4: packets: 28 3 | P4: days: 1 4 | 5 | Python: ip: 190.104.155.38 not seen 6 | P4: packets: 65 7 | P4: days: 1 8 | 9 | Python: ip: 203.130.23.238 not seen 10 | P4: packets: 8688 11 | P4: days: 9 12 | 13 | Python: ip: 190.210.222.104 not seen 14 | P4: packets: 12 15 | P4: days: 1 16 | 17 | Python: ip: 46.152.126.198 not seen 18 | P4: packets: 191 19 | P4: days: 1 20 | 21 | Python: ip: 185.120.37.197 not seen 22 | P4: packets: 23 23 | P4: days: 1 24 | 25 | Python: ip: 43.230.105.35 not seen 26 | P4: packets: 15 27 | P4: days: 1 28 | 29 | Python: ip: 185.104.239.255 not seen 30 | P4: packets: 82 31 | P4: days: 1 32 | 33 | Python: ip: 46.0.203.68 not seen 34 | P4: packets: 30 35 | P4: days: 1 36 | 37 | Python: ip: 167.250.103.133 not seen 38 | P4: packets: 40 39 | P4: days: 1 40 | 41 | Python: ip: 40.133.0.76 not seen 42 | P4: packets: 30 43 | P4: days: 1 44 | 45 | Python: ip: 184.191.189.10 not seen 46 | P4: packets: 32 47 | P4: days: 1 48 | 49 | Python: ip: 46.39.66.2 not seen 50 | P4: packets: 14 51 | P4: days: 1 52 | 53 | Python: ip: 185.104.115.125 not seen 54 | P4: packets: 12 55 | P4: days: 1 56 | 57 | Python: ip: 188.191.28.115 not seen 58 | P4: packets: 6 59 | P4: days: 1 60 | 61 | Python: ip: 185.54.237.47 not seen 62 | P4: packets: 38 63 | P4: days: 2 64 | 65 | Python: ip: 95.170.205.210 not seen 66 | P4: packets: 12 67 | P4: days: 1 68 | 69 | Python: ip: 181.51.187.2 not seen 70 | P4: packets: 30 71 | P4: days: 1 72 | 73 | Python: ip: 79.121.25.102 not seen 74 | P4: packets: 24 75 | P4: days: 1 76 | 77 | Python: ip: 91.228.35.106 not seen 78 | P4: packets: 14 79 | P4: days: 1 80 | 81 | Python: ip: 220.240.74.225 not seen 82 | P4: packets: 29 83 | P4: days: 1 84 | 85 | Python: ip: 76.21.153.233 not seen 86 | P4: packets: 42 87 | P4: days: 1 88 | 89 | Python: ip: 186.65.132.14 not seen 90 | P4: packets: 74 91 | P4: days: 1 92 | 93 | Python: ip: 186.233.196.248 not seen 94 | P4: packets: 81 95 | P4: days: 1 96 | 97 | Python: ip: 68.85.231.94 not seen 98 | P4: packets: 16 99 | P4: days: 1 100 | 101 | Python: ip: 31.8.201.129 not seen 102 | P4: packets: 14 103 | P4: days: 1 104 | 105 | Python: ip: 178.45.248.237 not seen 106 | P4: packets: 54 107 | P4: days: 1 108 | 109 | Python: ip: 66.112.8.173 not seen 110 | P4: packets: 13 111 | P4: days: 1 112 | 113 | Python: ip: 4.28.92.149 not seen 114 | P4: packets: 67 115 | P4: days: 1 116 | 117 | Python: ip: 185.48.8.251 not seen 118 | P4: packets: 191 119 | P4: days: 4 120 | 121 | Python: ip: 120.209.236.1 not seen 122 | P4: packets: 73 123 | P4: days: 2 124 | 125 | Python: ip: 40.133.0.76 not seen 126 | P4: packets: 30 127 | P4: days: 1 128 | 129 | Python: ip: 190.210.222.104 not seen 130 | P4: packets: 12 131 | P4: days: 1 132 | 133 | Python: ip: 156.155.230.185 not seen 134 | P4: packets: 30 135 | P4: days: 1 136 | 137 | Python: ip: 125.209.88.124 not seen 138 | P4: packets: 28 139 | P4: days: 2 140 | 141 | Python: ip: 189.39.121.34 not seen 142 | P4: packets: 26 143 | P4: days: 1 144 | 145 | Python: ip: 193.186.9.187 not seen 146 | P4: packets: 47 147 | P4: days: 1 148 | 149 | Python: ip: 116.58.127.237 not seen 150 | P4: packets: 20 151 | P4: days: 1 152 | 153 | Python: ip: 46.39.66.2 not seen 154 | P4: packets: 14 155 | P4: days: 1 156 | 157 | Python: ip: 46.200.74.182 not seen 158 | P4: packets: 11 159 | P4: days: 1 160 | 161 | Python: ip: 181.51.187.2 not seen 162 | P4: packets: 30 163 | P4: days: 1 164 | 165 | Python: ip: 193.108.249.120 not seen 166 | P4: packets: 14 167 | P4: days: 1 168 | 169 | Python: ip: 167.250.103.133 not seen 170 | P4: packets: 40 171 | P4: days: 1 172 | 173 | Python: ip: 104.178.53.108 not seen 174 | P4: packets: 13 175 | P4: days: 1 176 | 177 | Python: ip: 113.61.111.194 not seen 178 | P4: packets: 12 179 | P4: days: 1 180 | 181 | Python: ip: 76.21.153.233 not seen 182 | P4: packets: 42 183 | P4: days: 1 184 | 185 | Python: ip: 191.103.84.226 not seen 186 | P4: packets: 41 187 | P4: days: 1 188 | 189 | Python: ip: 60.251.149.45 not seen 190 | P4: packets: 18 191 | P4: days: 1 192 | 193 | Python: ip: 185.51.92.77 not seen 194 | P4: packets: 14 195 | P4: days: 1 196 | 197 | Python: ip: 77.243.151.109 not seen 198 | P4: packets: 10 199 | P4: days: 1 200 | 201 | Python: ip: 217.168.134.238 not seen 202 | P4: packets: 12 203 | P4: days: 1 204 | 205 | Python: ip: 195.46.6.194 not seen 206 | P4: packets: 97 207 | P4: days: 1 208 | 209 | Python: ip: 206.150.65.10 not seen 210 | P4: packets: 12 211 | P4: days: 1 212 | 213 | Python: ip: 91.105.203.45 not seen 214 | P4: packets: 66 215 | P4: days: 1 216 | 217 | Python: ip: 177.20.225.89 not seen 218 | P4: packets: 38 219 | P4: days: 1 220 | 221 | Python: ip: 171.106.7.57 not seen 222 | P4: packets: 14 223 | P4: days: 1 224 | 225 | Python: ip: 154.127.32.2 not seen 226 | P4: packets: 38 227 | P4: days: 1 228 | 229 | Python: ip: 103.84.130.163 not seen 230 | P4: packets: 89 231 | P4: days: 1 232 | 233 | Python: ip: 31.202.36.30 not seen 234 | P4: packets: 56 235 | P4: days: 1 236 | 237 | Python: ip: 103.51.112.140 not seen 238 | P4: packets: 14 239 | P4: days: 1 240 | 241 | Python: ip: 89.201.6.115 not seen 242 | P4: packets: 100 243 | P4: days: 2 244 | 245 | Python: ip: 58.59.243.171 not seen 246 | P4: packets: 37 247 | P4: days: 1 248 | 249 | Python: ip: 14.102.71.106 not seen 250 | P4: packets: 25 251 | P4: days: 1 252 | 253 | Python: ip: 190.186.147.115 not seen 254 | P4: packets: 15 255 | P4: days: 1 256 | 257 | Python: ip: 181.112.49.62 not seen 258 | P4: packets: 15 259 | P4: days: 1 260 | 261 | Python: ip: 79.1.104.144 not seen 262 | P4: packets: 51 263 | P4: days: 1 264 | 265 | Python: ip: 193.186.9.187 not seen 266 | P4: packets: 47 267 | P4: days: 1 268 | 269 | Python: ip: 27.37.229.255 not seen 270 | P4: packets: 12 271 | P4: days: 1 272 | 273 | Python: ip: 180.139.143.202 not seen 274 | P4: packets: 16 275 | P4: days: 1 276 | 277 | Python: ip: 113.16.48.194 not seen 278 | P4: packets: 40 279 | P4: days: 1 280 | 281 | Python: ip: 182.255.57.209 not seen 282 | P4: packets: 22 283 | P4: days: 1 284 | 285 | Python: ip: 191.15.93.157 not seen 286 | P4: packets: 32 287 | P4: days: 1 288 | 289 | Python: ip: 177.184.144.10 not seen 290 | P4: packets: 4505 291 | P4: days: 10 292 | 293 | Python: ip: 206.80.246.137 not seen 294 | P4: packets: 28 295 | P4: days: 1 296 | 297 | Python: ip: 112.109.210.26 not seen 298 | P4: packets: 56 299 | P4: days: 1 300 | 301 | Python: ip: 205.234.125.83 not seen 302 | P4: packets: 32 303 | P4: days: 1 304 | 305 | Python: ip: 112.188.172.114 not seen 306 | P4: packets: 58 307 | P4: days: 1 308 | 309 | Python: ip: 85.238.104.193 not seen 310 | P4: packets: 26 311 | P4: days: 1 312 | 313 | Python: ip: 217.69.203.57 not seen 314 | P4: packets: 12 315 | P4: days: 1 316 | 317 | Python: ip: 188.191.28.115 not seen 318 | P4: packets: 6 319 | P4: days: 1 320 | 321 | Python: ip: 103.51.112.140 not seen 322 | P4: packets: 14 323 | P4: days: 1 324 | 325 | Python: ip: 168.90.140.9 not seen 326 | P4: packets: 52 327 | P4: days: 1 328 | 329 | Python: ip: 211.138.126.93 not seen 330 | P4: packets: 18 331 | P4: days: 1 332 | 333 | Python: ip: 164.215.125.130 not seen 334 | P4: packets: 137 335 | P4: days: 1 336 | 337 | Python: ip: 175.45.187.193 not seen 338 | P4: packets: 18 339 | P4: days: 1 340 | 341 | Python: ip: 185.51.92.77 not seen 342 | P4: packets: 14 343 | P4: days: 1 344 | 345 | Python: ip: 206.150.65.10 not seen 346 | P4: packets: 12 347 | P4: days: 1 348 | 349 | Python: ip: 195.46.6.194 not seen 350 | P4: packets: 97 351 | P4: days: 1 352 | 353 | Python: ip: 212.72.149.134 not seen 354 | P4: packets: 92 355 | P4: days: 1 356 | 357 | Python: ip: 80.95.103.140 not seen 358 | P4: packets: 221 359 | P4: days: 1 360 | 361 | Python: ip: 14.102.71.106 not seen 362 | P4: packets: 25 363 | P4: days: 1 364 | 365 | Python: ip: 200.142.176.25 not seen 366 | P4: packets: 12 367 | P4: days: 1 368 | 369 | Python: ip: 47.206.2.20 not seen 370 | P4: packets: 19 371 | P4: days: 1 372 | -------------------------------------------------------------------------------- /ftp-big/test-pkt5-differences/rates.txt: -------------------------------------------------------------------------------- 1 | true_drop: 99.86913941577082 2 | false_drop: 10.13779041028176 3 | false_pass: 0.13086058422918895 4 | true_pass: 89.86220958971823 5 | -------------------------------------------------------------------------------- /ftp-small/after_training.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JJK96/P4-filtering/b9c206234ed0f42e6e88e52a3b2eae5da71815ba/ftp-small/after_training.png -------------------------------------------------------------------------------- /ftp-small/test/daysdiff.txt: -------------------------------------------------------------------------------- 1 | Python: num_days: 21 2 | P4: num_days: 25 3 | 4 | Python: num_days: 26 5 | P4: num_days: 27 6 | 7 | Python: num_days: 9 8 | P4: num_days: 10 9 | 10 | Python: num_days: 5 11 | P4: num_days: 6 12 | 13 | Python: num_days: 3 14 | P4: num_days: 4 15 | 16 | Python: num_days: 4 17 | P4: num_days: 5 18 | 19 | Python: num_days: 23 20 | P4: num_days: 19 21 | 22 | Python: num_days: 8 23 | P4: num_days: 7 24 | 25 | Python: num_days: 6 26 | P4: num_days: 7 27 | 28 | Python: num_days: 4 29 | P4: num_days: 3 30 | 31 | Python: num_days: 4 32 | P4: num_days: 3 33 | 34 | Python: num_days: 4 35 | P4: num_days: 3 36 | 37 | Python: num_days: 20 38 | P4: num_days: 19 39 | 40 | Python: num_days: 4 41 | P4: num_days: 5 42 | 43 | Python: num_days: 2 44 | P4: num_days: 1 45 | 46 | Python: num_days: 1 47 | P4: num_days: 2 48 | 49 | Python: num_days: 2 50 | P4: num_days: 1 51 | 52 | Python: num_days: 2 53 | P4: num_days: 1 54 | 55 | Python: num_days: 2 56 | P4: num_days: 1 57 | 58 | Python: num_days: 2 59 | P4: num_days: 1 60 | 61 | Python: num_days: 1 62 | P4: num_days: 2 63 | 64 | Python: num_days: 1 65 | P4: num_days: 2 66 | 67 | Python: num_days: 2 68 | P4: num_days: 1 69 | 70 | Python: num_days: 2 71 | P4: num_days: 1 72 | -------------------------------------------------------------------------------- /ftp-small/test/rates.txt: -------------------------------------------------------------------------------- 1 | true_drop: 99.9859847794705 2 | false_drop: 24.087396504139836 3 | false_pass: 0.014015220529495031 4 | true_pass: 75.91260349586017 5 | -------------------------------------------------------------------------------- /paper.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JJK96/P4-filtering/b9c206234ed0f42e6e88e52a3b2eae5da71815ba/paper.pdf -------------------------------------------------------------------------------- /program.p4: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright 2018 Jan-Jaap Korpershoek 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), 4 | * to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, 5 | * and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: 6 | 7 | * The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. 8 | 9 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 10 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, 11 | * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 12 | */ 13 | #include 14 | #include 15 | 16 | #define OUT_PORT 2 17 | #define MAX_ADDRESS 32w4194304 18 | #define PKT_THRESHOLD 32w5 19 | #define DAY_THRESHOLD 32w1 20 | 21 | // Two weeks 22 | #define TIMEOUT 48w1209600000000 23 | #define DAY 48w86400000000 24 | 25 | const bit<16> TYPE_IPV4 = 0x800; 26 | 27 | register>(MAX_ADDRESS) pkt; 28 | register>(MAX_ADDRESS) timestamp; 29 | register>(MAX_ADDRESS) days; 30 | // First timestamp of the day 31 | register>(32w1) day_start; 32 | register>(32w1) attack; // Indicates whether an attack is happening or not 33 | 34 | // Headers 35 | 36 | typedef bit<9> egressSpec_t; 37 | typedef bit<48> macAddr_t; 38 | typedef bit<32> ip4Addr_t; 39 | 40 | header ethernet_t { 41 | macAddr_t dstAddr; 42 | macAddr_t srcAddr; 43 | bit<16> etherType; 44 | } 45 | 46 | header ipv4_t { 47 | bit<4> version; 48 | bit<4> ihl; 49 | bit<8> diffserv; 50 | bit<16> totalLen; 51 | bit<16> identification; 52 | bit<3> flags; 53 | bit<13> fragOffset; 54 | bit<8> ttl; 55 | bit<8> protocol; 56 | bit<16> hdrChecksum; 57 | ip4Addr_t srcAddr; 58 | ip4Addr_t dstAddr; 59 | } 60 | 61 | header tcp_t { 62 | bit<16> srcPort; 63 | bit<16> dstPort; 64 | bit<32> seqNo; 65 | bit<32> ackNo; 66 | bit<4> dataOffset; 67 | bit<4> res; 68 | bit<8> flags; 69 | bit<16> window; 70 | bit<16> checksum; 71 | bit<16> urgentPtr; 72 | } 73 | 74 | struct metadata { 75 | /* empty */ 76 | } 77 | 78 | struct headers { 79 | ethernet_t ethernet; 80 | ipv4_t ipv4; 81 | tcp_t tcp; 82 | } 83 | 84 | // Parser 85 | 86 | parser MyParser(packet_in packet, 87 | out headers hdr, 88 | inout metadata meta, 89 | inout standard_metadata_t standard_metadata) { 90 | 91 | state start { 92 | transition parse_ethernet; 93 | } 94 | 95 | state parse_ethernet { 96 | packet.extract(hdr.ethernet); 97 | transition select(hdr.ethernet.etherType) { 98 | TYPE_IPV4: parse_ipv4; 99 | default: accept; 100 | } 101 | } 102 | 103 | state parse_ipv4 { 104 | packet.extract(hdr.ipv4); 105 | transition select(hdr.ipv4.protocol) { 106 | 8w0x6: parse_tcp; 107 | default: accept; 108 | } 109 | } 110 | 111 | state parse_tcp { 112 | packet.extract(hdr.tcp); 113 | transition accept; 114 | } 115 | } 116 | 117 | // Checksum verification 118 | 119 | control MyVerifyChecksum(inout headers hdr, inout metadata meta) { 120 | apply { } 121 | } 122 | 123 | // Ingress pipeline 124 | 125 | control MyIngress(inout headers hdr, 126 | inout metadata meta, 127 | inout standard_metadata_t standard_metadata) { 128 | 129 | action drop() { 130 | mark_to_drop(); 131 | } 132 | 133 | action get_data(inout bit<32> address ,inout bit<32> num_packets, inout bit<48> ts, inout bit<32> num_days) { 134 | hash(address, 135 | HashAlgorithm.crc32, 136 | 32w0, 137 | { hdr.ipv4.srcAddr }, 138 | MAX_ADDRESS); 139 | // Read the files in the registers 140 | pkt.read(num_packets, address); 141 | timestamp.read(ts, address); 142 | days.read(num_days, address); 143 | } 144 | 145 | action sliding_window(inout bit<32> num_packets, in bit<48> ts, inout bit<32> num_days) { 146 | // Sliding window 147 | if (standard_metadata.ingress_global_timestamp - ts > TIMEOUT) { 148 | num_packets = 0; 149 | num_days = 0; 150 | } 151 | } 152 | 153 | action update_hashtable(inout bit<32> address, inout bit<32> num_packets, inout bit<48> ts, inout bit<32> num_days) { 154 | bit<48> cur_time = standard_metadata.ingress_global_timestamp; 155 | bit<48> ds; // Start of the day 156 | day_start.read(ds, 32w0); 157 | if (ts < ds || ts == 0) { // Last seen was before today or not seen before 158 | num_days = num_days + 1; 159 | } 160 | num_packets = num_packets + 1; 161 | 162 | // Write new values to the registers 163 | pkt.write(address, num_packets); 164 | timestamp.write(address, cur_time); 165 | days.write(address, num_days); 166 | } 167 | 168 | apply { 169 | standard_metadata.egress_spec = OUT_PORT; // Forward all packets to h2 170 | // Set initial day 171 | bit<48> ds; 172 | day_start.read(ds,32w0); 173 | if (ds == 0) { 174 | ds = standard_metadata.ingress_global_timestamp; 175 | day_start.write(32w0,standard_metadata.ingress_global_timestamp); 176 | } 177 | bit<1> flag; 178 | bit<32> num_packets = 0; 179 | bit<48> ts = 0; // Time stamp 180 | bit<32> num_days = 0; 181 | bit<32> address = 0; 182 | get_data(address, num_packets,ts,num_days); 183 | attack.read(flag, 0); 184 | // Check if under attack 185 | if (flag == 1w1) { 186 | // Sliding_window(num_packets, ts, num_days); 187 | if (num_packets < PKT_THRESHOLD || num_days < DAY_THRESHOLD) { 188 | drop(); 189 | } 190 | } else { 191 | update_hashtable(address, num_packets,ts,num_days); 192 | } 193 | // Update start of the day 194 | if (standard_metadata.ingress_global_timestamp - ds > DAY) { // One day 195 | day_start.write(32w0,standard_metadata.ingress_global_timestamp); // A new day has started 196 | } 197 | } 198 | 199 | } 200 | 201 | // Egress pipeline 202 | 203 | control MyEgress(inout headers hdr, 204 | inout metadata meta, 205 | inout standard_metadata_t standard_metadata) { 206 | apply { 207 | hdr.ethernet.etherType = TYPE_IPV4; 208 | } 209 | } 210 | 211 | // Checksum computation 212 | 213 | control MyComputeChecksum(inout headers hdr, inout metadata meta) { 214 | apply { 215 | update_checksum( 216 | hdr.ipv4.isValid(), 217 | { hdr.ipv4.version, 218 | hdr.ipv4.ihl, 219 | hdr.ipv4.diffserv, 220 | hdr.ipv4.totalLen, 221 | hdr.ipv4.identification, 222 | hdr.ipv4.flags, 223 | hdr.ipv4.fragOffset, 224 | hdr.ipv4.ttl, 225 | hdr.ipv4.protocol, 226 | hdr.ipv4.srcAddr, 227 | hdr.ipv4.dstAddr }, 228 | hdr.ipv4.hdrChecksum, 229 | HashAlgorithm.csum16); 230 | } 231 | } 232 | 233 | // Deparser 234 | 235 | control MyDeparser(packet_out packet, in headers hdr) { 236 | apply { 237 | packet.emit(hdr.ethernet); 238 | packet.emit(hdr.ipv4); 239 | packet.emit(hdr.tcp); 240 | } 241 | } 242 | 243 | // Switch 244 | 245 | V1Switch( 246 | MyParser(), 247 | MyVerifyChecksum(), 248 | MyIngress(), 249 | MyEgress(), 250 | MyComputeChecksum(), 251 | MyDeparser() 252 | ) main; 253 | --------------------------------------------------------------------------------