, Anomaly_Score}
45 |
46 |
47 | sourceIP:sourcePort => destinationIP:destinationPort, clusterID, points(X,Y), percentage
48 | 173.194.70.94:173.194.70.94=>10.0.2.16:10.0.2.16, clusterID:1, data(954,478932), 22%
49 | 10.0.2.16:10.0.2.16=>195.169.125.228:195.169.125.228, clusterID:2, data(141,7144), 55%
50 | X.X.X.X,Z.Z.Z.Z -> 5 (73445,48),288,118644,0.242743%
51 |
52 |
53 | If precentage is low, the pair(srcIP,srcPort->dstIP,dstPort) could be anomaly.
54 |
55 | 6.Procedure 1: extracting flow vector {, X, Y}
56 |
57 | Container: typedef concurrent_hash_map
58 |
59 |
60 |
61 | Main loop:
62 | pthread_create(&master, NULL, (void*)master_func, (void*)&targ[0]);
63 | for (i = 1; i < thread_num; ++i) {
64 | targ[i].id = i;
65 | pthread_create(&worker[i],NULL,(void*)worker_func,(void*)&targ[i]); }
66 | for (i = 1; i < thread_num; ++i)
67 | pthread_join(worker[i], NULL);
68 |
69 |
70 | 7.Procedure 2: calculating anomaly score {, Anomaly_Score}
71 |
72 | Main loop (K-Means):
73 | tbb::parallel_for(
74 | tbb::blocked_range(0,n),
75 | [=,&tls,&global]( tbb::blocked_range r ) {
76 | view& v = tls.local();
77 | for( size_t i=r.begin(); i!=r.end(); ++i ) {
78 | cluster_id j = calc_shortest_index(centroid, k , points[i]);
79 | if( j!=id[i] ) {
80 | id[i] = j;
81 | ++v.change;
82 | }
83 | v.array[j].tally(points[i]);
84 | }
85 | }
86 |
87 |
88 | 8. Processing time: about 30 minutes for about 400,000,000 packets
89 |
90 |
91 | 2022-01-11
92 | libpcap and libtins are required.
93 |
94 |
95 | # apt install libpcap-dev
96 | # git clone https://github.com/mfontanini/libtins.git
97 | # cd libtins/
98 | # apt-get install libpcap-dev libssl-dev cmake
99 | # mkdir build
100 | # cd build/
101 | # cmake ../ -DLIBTINS_ENABLE_CXX11=1
102 | # make install
103 | # ldconfig
104 |
105 |
--------------------------------------------------------------------------------
/test_kmeans.cpp:
--------------------------------------------------------------------------------
1 | #include "kmeans.h"
2 | #include
3 | #include
4 | #include
5 | #include
6 |
7 | #include
8 | #include
9 | #include
10 | #include
11 | #include
12 | #include
13 | #include
14 | #include
15 | #include
16 | #include
17 | #include "timer.h"
18 |
19 | #include
20 |
21 | #include
22 | #include
23 | #include
24 | #include
25 | #include
26 | #include
27 | #include
28 | #include
29 | #include
30 | #include
31 | #include
32 | #include
33 | #include
34 |
35 | #include