DOCSEARCHbyAlgolia
Submit Docs

CICFlowMeter

repository·master·Indexed 19 days ago

https://github.com/ahlashkari/cicflowmeter

An open-source network traffic flow generator that extracts statistical features and generates bidirectional flows (Biflows) from PCAP files. It utilizes the jnetpcap library for packet capture and processing, supporting custom feature addition, flow timeout configuration, and traffic characterization.

Tokens
3.7K
Snippets
6
Records
8
Agent score
72%

What's inside CICFlowMeter

  1. Overview of CICFlowMeter

    master

    CICFlowMeter is an open-source network traffic flow generator that processes .pcap files to generate bidirectional flows (Biflows). It extracts statistical features from these flows, allowing for separate calculations of time-related features in both the forward (source to destination) and backward (destination to source) directions.

    Key capabilities include:

    • Generating bidirectional flows based on the first packet's direction.
    • Selecting specific features from the existing feature set.
    • Adding new custom features.
    • Controlling flow timeout durations.

    Note on flow termination:

    • TCP flows: Typically terminated upon connection teardown (e.g., via a FIN packet).
    • UDP flows: Terminated by a flow timeout (which can be configured arbitrarily, e.g., 600 seconds).

  2. Build a distribution package

    master

    You can package the project into a distributable format using either Gradle or Maven, depending on your IDE setup.

    Using IntelliJ IDEA (Gradle)

    Open the IDE terminal and run:

    • Linux: ./gradlew distZip
    • Windows: gradlew distZip

    The resulting ZIP file will be located in: pathtoproject/CICFlowMeter/build/distributions

    Using Eclipse (Maven)

    Run the following command at the project root: mvn package

    The resulting JAR file will be located in: pathtoproject/CICFlowMeter/target

    # Gradle (IntelliJ)
./gradlew distZip

# Maven (Eclipse)
mvn package

  3. Run CICFlowMeter using Eclipse

    master

    To run the project in Eclipse, you must ensure the application can find the native jnetpcap libraries by setting the java.library.path VM argument.

    1. Right-click App.java -> Run As -> Run Configurations.
    2. Navigate to the Arguments tab.
    3. In the VM arguments field, add: -Djava.library.path="pathtoproject/jnetpcap/linux/jnetpcap-1.4.r1425" (adjust path for Windows if necessary).
    4. Click Run.
    5. Alternatively, right-click App.java -> Run As -> Java Application (Note: This may require running Eclipse itself with sudo on Linux).

  4. Install jnetpcap local repository

    master

    To use CICFlowMeter, you must install the jnetpcap JAR file into your local Maven repository.

    Prerequisites:

    • On Linux, sudo privileges are required.

    File Locations:

    • Linux: pathtoproject/jnetpcap/linux/jnetpcap-1.4.r1425
    • Windows: pathtoproject/jnetpcap/win/jnetpcap-1.4.r1425

    Run the following command from the directory containing the jnetpcap.jar file to install it:

    mvn install:install-file -Dfile=jnetpcap.jar -DgroupId=org.jnetpcap -DartifactId=jnetpcap -Dversion=1.4.1 -Dpackaging=jar

  5. Run CICFlowMeter using IntelliJ IDEA

    master

    To run the project in IntelliJ IDEA, open the built-in Terminal and execute the Gradle wrapper command based on your operating system.

    Linux: Requires sudo permissions.

    Windows:

    # Linux
$ sudo bash
$ ./gradlew execute

# Windows
$ gradlew execute

  6. Reference of extracted CICFlowMeter features

    master

    CICFlowMeter extracts a wide range of statistical features from network flows. Below is the complete list of feature names and their descriptions used for traffic characterization.

    Feature Name			Description
Flow duration			Duration of the flow in Microsecond
total Fwd Packet		Total packets in the forward direction
total Bwd packets		Total packets in the backward direction
total Length of Fwd Packet	Total size of packet in forward direction
total Length of Bwd Packet	Total size of packet in backward direction
Fwd Packet Length Min 		Minimum size of packet in forward direction
Fwd Packet Length Max 		Maximum size of packet in forward direction
Fwd Packet Length Mean		Mean size of packet in forward direction
Fwd Packet Length Std		Standard deviation size of packet in forward direction
Bwd Packet Length Min 		Minimum size of packet in backward direction
Bwd Packet Length Max 		Maximum size of packet in backward direction
Bwd Packet Length Mean		Mean size of packet in backward direction
Bwd Packet Length Std		Standard deviation size of packet in backward direction
Flow Bytes/s			Number of flow bytes per second
Flow Packets/s			Number of flow packets per second 
Flow IAT Mean			Mean time between two packets sent in the flow
Flow IAT Std			Standard deviation time between two packets sent in the flow
Flow IAT Max			Maximum time between two packets sent in the flow
Flow IAT Min			Minimum time between two packets sent in the flow
Fwd IAT Min			Minimum time between two packets sent in the forward direction
Fwd IAT Max			Maximum time between two packets sent in the forward direction
Fwd IAT Mean			Mean time between two packets sent in the forward direction
Fwd IAT Std			Standard deviation time between two packets sent in the forward direction
Fwd IAT Total			Total time between two packets sent in the forward direction
Bwd IAT Min			Minimum time between two packets sent in the backward direction
Bwd IAT Max			Maximum time between two packets sent in the backward direction
Bwd IAT Mean			Mean time between two packets sent in the backward direction
Bwd IAT Std			Standard deviation time between two packets sent in the backward direction
Bwd IAT Total			Total time between two packets sent in the backward direction
Fwd PSH flags			Number of times the PSH flag was set in packets travelling in the forward direction (0 for UDP)
Bwd PSH Flags			Number of times the PSH flag was set in packets travelling in the backward direction (0 for UDP)
Fwd URG Flags			Number of times the URG flag was set in packets travelling in the forward direction (0 for UDP)
Bwd URG Flags			Number of times the URG flag was set in packets travelling in the backward direction (0 for UDP)
Fwd Header Length		Total bytes used for headers in the forward direction
Bwd Header Length		Total bytes used for headers in the backward direction
FWD Packets/s			Number of forward packets per second
Bwd Packets/s			Number of backward packets per second
Packet Length Min 		Minimum length of a packet
Packet Length Max 		Maximum length of a packet
Packet Length Mean 		Mean length of a packet
Packet Length Std 		Standard deviation length of a packet
Packet Length Variance 	Variance length of a packet
FIN Flag Count 			Number of packets with FIN
SYN Flag Count 			Number of packets with SYN
RST Flag Count 			Number of packets with RST
PSH Flag Count 			Number of packets with PUSH
ACK Flag Count 			Number of packets with ACK
URG Flag Count 			Number of packets with URG
CWR Flag Count 			Number of packets with CWR
ECE Flag Count 			Number of packets with ECE
down/Up Ratio			Download and upload ratio
Average Packet Size 	Average size of packet
Fwd Segment Size Avg 	Average size observed in the forward direction
Bwd Segment Size Avg 	Average size observed in the backward direction
Fwd Bytes/Bulk Avg		Average number of bytes bulk rate in the forward direction
Fwd Packet/Bulk Avg 	Average number of packets bulk rate in the forward direction
Fwd Bulk Rate Avg 		Average number of bulk rate in the forward direction
Bwd Bytes/Bulk Avg		Average number of bytes bulk rate in the backward direction
Bwd Packet/Bulk Avg 	Average number of packets bulk rate in the backward direction
Bwd Bulk Rate Avg 		Average number of bulk rate in the backward direction
Subflow Fwd Packets		The average number of packets in a sub flow in the forward direction
Subflow Fwd Bytes		The average number of bytes in a sub flow in the forward direction
Subflow Bwd Packets		The average number of packets in a sub flow in the backward direction
Subflow Bwd Bytes		The average number of bytes in a sub flow in the backward direction
Fwd Init Win bytes		The total number of bytes sent in initial window in the forward direction
Bwd Init Win bytes		The total number of bytes sent in initial window in the backward direction
Fwd Act Data Pkts		Count of packets with at least 1 byte of TCP data payload in the forward direction
Fwd Seg Size Min		Minimum segment size observed in the forward direction
Active Min			Minimum time a flow was active before becoming idle
Active Mean			Mean time a flow was active before becoming idle
Active Max			Maximum time a flow was active before becoming idle
Active Std			Standard deviation time a flow was active before becoming idle
Idle Min				Minimum time a flow was idle before becoming active
Idle Mean				Mean time a flow was idle before becoming active
Idle Max				Maximum time a flow was idle before becoming active
Idle Std				Standard deviation time a flow was idle before becoming active

  7. Start the CICFlowMeter application

    master

    The App class serves as the main entrypoint for the CICFlowMeter application. To launch the application, execute the main method. This process initializes the core managers (FlowMgr and GuavaMgr) and launches the graphical user interface via MainFrame on the Event Dispatch Thread (EDT) using EventQueue.invokeLater.

    // To launch the application via code:
cic.cs.unb.ca.ifm.App.main(new String[]{});

  8. Initialize CICFlowMeter core components

    master

    The init() method in the App class performs the necessary setup for the application's internal managers. It calls init() on both FlowMgr.getInstance() and GuavaMgr.getInstance(). This should be called before attempting to use flow management or Guava-related utilities.

    public static void init() {
    FlowMgr.getInstance().init();
    GuavaMgr.getInstance().init();
}