flowUniAttr.h

Go to the documentation of this file.

 
#pragma once
 
#include <vector>
#include <unordered_map>
#include <functional>
#include <sstream>
#include "TcpLayer.h"
#include <UdpLayer.h>
#include "IPv4Layer.h"
#include "PayloadLayer.h"
#include "PacketUtils.h"
#include "SystemUtils.h"
#include <ctime>
#include<fstream> 
#include <headers/unifiedPacketAttr.h>

#define MAX_SIZE_PAC_LEN 100

struct flowUniAttr
{
    // 流标识信息
    uint32_t hash_val;          
    std::string src_ip;         
    std::string dst_ip;         
    uint16_t protocol;          
    uint16_t src_port;          
    uint16_t dst_port;          
    size_t packet_count = 0;    
    
    // 通用包属性（按包到达顺序排列的序列）
    std::vector<uint32_t> packet_len;   
    std::vector<uint32_t> tv_sec;       
    std::vector<uint32_t> tv_nsec;      
    
    // IPv4层属性
    std::vector<uint16_t> ttl;          
    std::vector<uint16_t> tos;          
    std::vector<uint16_t> id;           
    std::vector<uint16_t> offset;       
    std::vector<uint16_t> protocol_ip;  
    
    // 传输层通用属性
    std::vector<uint16_t> len_load;     
    std::vector<uint32_t> ack_num;      
    std::vector<uint32_t> seq_num;      
    
    // TCP特定属性
    std::vector<uint16_t> flag;         
    std::vector<uint16_t> window;       
    
    // UDP特定属性
    std::vector<uint16_t> len_udp;      
    
    // ICMP特定属性
    std::vector<uint16_t> icmp_type;    
    std::vector<uint16_t> icmp_code;    

    void clear()
    {
        // TODO: 实现清空所有向量并重置计数器
    }

    void resize()
    {
        // TODO: 截断长度超过MAX_SIZE_PAC_LEN的数组并用零填充
    }
};

template<typename T>
void sequence_to_csv(const std::vector<T>& seq, std::ofstream& outputF) {
    for (const auto& val : seq) {
        outputF << val << ',';
    }
}

class operator_UniAttr
{   
    private:
        std::unordered_map<uint32_t, flowUniAttr> m_FlowTable;
        
    public:
        long long packet_count = 0;
        
        void handle_packet(pcpp::Packet* packet)
        {
            // 根据包的五元组计算会话ID
            packet_count++;
            unifiedPacketAttr packet_attr(packet);  // 解析包以获取统一属性
 
            uint32_t hashVal = packet_attr.hash_val;
            if (m_FlowTable.find(hashVal) == m_FlowTable.end())   // 新会话 - 流的第一个包
            {   
                m_FlowTable[hashVal].clear();
 
                // 用五元组信息初始化流
                m_FlowTable[hashVal].hash_val = hashVal;
                m_FlowTable[hashVal].src_ip = packet_attr.src_ip ;
                m_FlowTable[hashVal].dst_ip = packet_attr.dst_ip;
                m_FlowTable[hashVal].src_port = packet_attr.src_port;
                m_FlowTable[hashVal].dst_port = packet_attr.dst_port;
                m_FlowTable[hashVal].protocol = packet_attr.protocol;
            }
            
            // 如果流已达到最大包数，则跳过处理
            if (m_FlowTable[hashVal].packet_count >= MAX_SIZE_PAC_LEN)
            {
                return;
            }
            
            // 用包属性更新流统计信息
            m_FlowTable[hashVal].packet_count++;
 
            m_FlowTable[hashVal].packet_len.push_back(packet_attr.packet_len);
            m_FlowTable[hashVal].tv_sec.push_back(packet_attr.tv_sec);
            m_FlowTable[hashVal].tv_nsec.push_back(packet_attr.tv_nsec);
            m_FlowTable[hashVal].ttl.push_back(packet_attr.ttl);
            m_FlowTable[hashVal].tos.push_back(packet_attr.tos);
            m_FlowTable[hashVal].id.push_back(packet_attr.id);
            m_FlowTable[hashVal].offset.push_back(packet_attr.offset);
            m_FlowTable[hashVal].protocol_ip.push_back(packet_attr.protocol_ip);
            m_FlowTable[hashVal].len_load.push_back(packet_attr.len_load);
            m_FlowTable[hashVal].ack_num.push_back(packet_attr.ack_num);
            m_FlowTable[hashVal].seq_num.push_back(packet_attr.seq_num);
            m_FlowTable[hashVal].flag.push_back(packet_attr.flag);
            m_FlowTable[hashVal].window.push_back(packet_attr.window);
            m_FlowTable[hashVal].len_udp.push_back(packet_attr.len_udp);
            m_FlowTable[hashVal].icmp_type.push_back(packet_attr.icmp_type);
            m_FlowTable[hashVal].icmp_code.push_back(packet_attr.icmp_code);
        }

        void to_csv(std::ofstream& outputFile, const std::string& tag)
        {
            // 收集满足最小包数要求的流
            std::vector<flowUniAttr> attr_l;
 
            for (auto& pair : m_FlowTable) {
                if (pair.second.packet_count >= MAX_SIZE_PAC_LEN) // 过滤掉非常短的流
                {
                    pair.second.resize();
                    attr_l.push_back(pair.second);
                }
            }
            
            // 将每个符合条件的流写入CSV
            for (const auto& item : attr_l) {
                // 写入哈希值和五元组
                outputFile << item.hash_val << ',';
                outputFile << item.src_ip << ',';
                outputFile << item.dst_ip << ',';
                outputFile << item.src_port << ',';
                outputFile << item.dst_port << ',';
                outputFile << item.protocol << ',';
                
                // 写入所有属性序列
                sequence_to_csv(item.packet_len, outputFile);
                sequence_to_csv(item.tv_sec, outputFile);
                sequence_to_csv(item.tv_nsec, outputFile);
                sequence_to_csv(item.ttl, outputFile);
                sequence_to_csv(item.tos, outputFile);
                sequence_to_csv(item.id, outputFile);
                sequence_to_csv(item.offset, outputFile);
                sequence_to_csv(item.protocol_ip, outputFile);
                sequence_to_csv(item.len_load, outputFile);
                sequence_to_csv(item.ack_num, outputFile);
                sequence_to_csv(item.seq_num, outputFile);
                sequence_to_csv(item.flag, outputFile);
                sequence_to_csv(item.window, outputFile);
                sequence_to_csv(item.len_udp, outputFile);
                sequence_to_csv(item.icmp_type, outputFile);
                sequence_to_csv(item.icmp_code, outputFile);
                outputFile << tag << '\n'; // 每行以标签和换行符结束
            }
        }
};