Skip to content

Commit 512a903

Browse files
consuelitaconsuelita
committed
Bug Fixes For Processing Existing Data
1 parent fb7a1e2 commit 512a903

5 files changed

Lines changed: 178 additions & 27 deletions

File tree

‎AdversaryLabSwift.xcodeproj/project.xcworkspace/xcuserdata/Lita.xcuserdatad/UserInterfaceState.xcuserstate‎

-449 Bytes
Binary file not shown.

‎AdversaryLabSwift.xcodeproj/xcuserdata/Lita.xcuserdatad/xcdebugger/Breakpoints_v2.xcbkptlist‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -21,21 +21,5 @@
2121
continueAfterRunningActions = "No">
2222
</BreakpointContent>
2323
</BreakpointProxy>
24-
<BreakpointProxy
25-
BreakpointExtensionID = "Xcode.Breakpoint.FileBreakpoint">
26-
<BreakpointContent
27-
shouldBeEnabled = "No"
28-
ignoreCount = "0"
29-
continueAfterRunningActions = "No"
30-
filePath = "AdversaryLabSwift/Features/Timing.swift"
31-
timestampString = "543459914.6254441"
32-
startingColumnNumber = "9223372036854775807"
33-
endingColumnNumber = "9223372036854775807"
34-
startingLineNumber = "33"
35-
endingLineNumber = "33"
36-
landmarkName = "processTiming(forConnection:)"
37-
landmarkType = "9">
38-
</BreakpointContent>
39-
</BreakpointProxy>
4024
</Breakpoints>
4125
</Bucket>

‎AdversaryLabSwift/Controllers/ConnectionInspector.swift‎

Lines changed: 88 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,8 @@ class ConnectionInspector
1616
analysisQueue.async
1717
{
1818
// Allowed Connections
19-
if removePackets {
19+
if removePackets
20+
{
2021
NSLog("Analyzed packets and removing")
2122
let allowedConnectionList: RList<String> = RList(key: allowedConnectionsKey)
2223
while allowedConnectionList.count != 0
@@ -63,13 +64,95 @@ class ConnectionInspector
6364

6465
self.analyze(connection: blockedConnection, enableSequenceAnalysis: enableSequenceAnalysis, enableTLSAnalysis: enableTLSAnalysis)
6566
}
66-
} else {
67+
}
68+
else
69+
{
6770
NSLog("Analyzed packets and retaining")
6871
let packetsAnalyzedDictionary: RMap<String, Int> = RMap(key: packetStatsKey)
69-
packetsAnalyzedDictionary[allowedPacketsAnalyzedKey]=0
70-
packetsAnalyzedDictionary[blockedPacketsAnalyzedKey]=0
72+
packetsAnalyzedDictionary[allowedPacketsAnalyzedKey] = 0
73+
packetsAnalyzedDictionary[blockedPacketsAnalyzedKey] = 0
74+
75+
// Delete all current scores
76+
let incomingRequiredLengths: RSortedSet<Int> = RSortedSet(key: incomingRequiredLengthsKey)
77+
incomingRequiredLengths.delete()
78+
let incomingForbiddenLengths: RSortedSet<Int> = RSortedSet(key: incomingForbiddenLengthsKey)
79+
incomingForbiddenLengths.delete()
80+
let outgoingRequiredLengths: RSortedSet<Int> = RSortedSet(key: outgoingRequiredLengthsKey)
81+
outgoingRequiredLengths.delete()
82+
let outgoingForbiddenLengths: RSortedSet<Int> = RSortedSet(key: outgoingForbiddenLengthsKey)
83+
outgoingForbiddenLengths.delete()
84+
let allowedOutLengthsSet: RSortedSet<Int> = RSortedSet(key: allowedOutgoingLengthsKey)
85+
allowedOutLengthsSet.delete()
86+
let allowedInLengthsSet: RSortedSet<Int> = RSortedSet(key: allowedIncomingLengthsKey)
87+
allowedInLengthsSet.delete()
88+
let blockedOutLengthsSet: RSortedSet<Int> = RSortedSet(key: blockedOutgoingLengthsKey)
89+
blockedOutLengthsSet.delete()
90+
let blockedInLengthsSet: RSortedSet<Int> = RSortedSet(key: blockedIncomingLengthsKey)
91+
blockedInLengthsSet.delete()
92+
93+
let incomingRequiredSequences: RSortedSet<Data> = RSortedSet(key: incomingRequiredSequencesKey)
94+
incomingRequiredSequences.delete()
95+
let incomingForbiddenSequences: RSortedSet<Data> = RSortedSet(key: incomingForbiddenSequencesKey)
96+
incomingForbiddenSequences.delete()
97+
let outgoingRequiredSequences: RSortedSet<Data> = RSortedSet(key: outgoingRequiredSequencesKey)
98+
outgoingRequiredSequences.delete()
99+
let outgoingForbiddenSequences: RSortedSet<Data> = RSortedSet(key: outgoingForbiddenSequencesKey)
100+
outgoingForbiddenSequences.delete()
101+
let allowedInSequencesSet: RSortedSet<Data> = RSortedSet(key: allowedIncomingFloatingSequencesKey)
102+
allowedInSequencesSet.delete()
103+
let blockedInSequencesSet: RSortedSet<Data> = RSortedSet(key: blockedIncomingFloatingSequencesKey)
104+
blockedInSequencesSet.delete()
105+
let allowedOutSequencesSet: RSortedSet<Data> = RSortedSet(key: allowedOutgoingFloatingSequencesKey)
106+
allowedOutSequencesSet.delete()
107+
let blockedOutSequencesSet: RSortedSet<Data> = RSortedSet(key: blockedOutgoingFloatingSequencesKey)
108+
blockedOutSequencesSet.delete()
109+
110+
let incomingRequiredEntropy: RSortedSet<Int> = RSortedSet(key: incomingRequiredEntropyKey)
111+
incomingRequiredEntropy.delete()
112+
let incomingForbiddenEntropy: RSortedSet<Int> = RSortedSet(key: incomingForbiddenEntropyKey)
113+
incomingForbiddenEntropy.delete()
114+
let outgoingRequiredEntropy: RSortedSet<Int> = RSortedSet(key: outgoingRequiredEntropyKey)
115+
outgoingRequiredEntropy.delete()
116+
let outgoingForbiddenEntropy: RSortedSet<Int> = RSortedSet(key: outgoingForbiddenEntropyKey)
117+
outgoingForbiddenEntropy.delete()
118+
let allowedInEntropyList: RList<Double> = RList(key: allowedIncomingEntropyKey)
119+
allowedInEntropyList.delete()
120+
let allowedOutEntropyList: RList<Double> = RList(key: allowedOutgoingEntropyKey)
121+
allowedOutEntropyList.delete()
122+
let blockedInEntropyList: RList<Double> = RList(key: blockedIncomingEntropyKey)
123+
blockedInEntropyList.delete()
124+
let blockedOutEntropyList: RList<Double> = RList(key: blockedOutgoingEntropyKey)
125+
blockedOutEntropyList.delete()
126+
let allowedInEntropyBinsRSet: RSortedSet<Int> = RSortedSet(key: allowedIncomingEntropyBinsKey)
127+
allowedInEntropyBinsRSet.delete()
128+
let allowedOutEntropyBinsRSet: RSortedSet<Int> = RSortedSet(key: allowedOutgoingEntropyBinsKey)
129+
allowedOutEntropyBinsRSet.delete()
130+
let blockedInEntropyBinsRSet: RSortedSet<Int> = RSortedSet(key: blockedIncomingEntropyBinsKey)
131+
blockedInEntropyBinsRSet.delete()
132+
let blockedOutEntropyBinsRSet: RSortedSet<Int> = RSortedSet(key: blockedOutgoingEntropyBinsKey)
133+
blockedOutEntropyBinsRSet.delete()
134+
135+
let requiredTimeDiff: RSortedSet<Int> = RSortedSet(key: requiredTimeDiffKey)
136+
requiredTimeDiff.delete()
137+
let forbiddenTimeDiff: RSortedSet<Int> = RSortedSet(key: forbiddenTimeDiffKey)
138+
forbiddenTimeDiff.delete()
139+
let allowedTimeDifferenceList: RList<Double> = RList(key: allowedConnectionsTimeDiffKey)
140+
allowedTimeDifferenceList.delete()
141+
let blockedTimeDifferenceList: RList<Double> = RList(key: blockedConnectionsTimeDiffKey)
142+
blockedTimeDifferenceList.delete()
143+
let allowedTimeDifferenceBinsRSet: RSortedSet<Int> = RSortedSet(key: allowedConnectionsTimeDiffBinsKey)
144+
allowedTimeDifferenceBinsRSet.delete()
145+
let blockedTimeDifferenceBinsRSet: RSortedSet<Int> = RSortedSet(key: blockedConnectionsTimeDiffBinsKey)
146+
blockedTimeDifferenceBinsRSet.delete()
147+
148+
let allowedTlsCommonNames: RSortedSet<String> = RSortedSet(key: allowedTlsCommonNameKey)
149+
allowedTlsCommonNames.delete()
150+
let blockedTlsCommonNames: RSortedSet<String> = RSortedSet(key: blockedTlsCommonNameKey)
151+
blockedTlsCommonNames.delete()
152+
71153
NotificationCenter.default.post(name: .updateStats, object: nil)
72154

155+
// Allowed Connections
73156
let allowedConnectionList: RList<String> = RList(key: allowedConnectionsKey)
74157
print("Analyzing allowed connections \(allowedConnectionList.count)")
75158
for index in 0..<allowedConnectionList.count
@@ -99,7 +182,7 @@ class ConnectionInspector
99182
print("Analyzing blocked connections \(blockedConnectionList.count)")
100183
for index in 0..<blockedConnectionList.count
101184
{
102-
print("Analyzing a blocked connection async. \(index)/\(allowedConnectionList.count)")
185+
print("Analyzing a blocked connection async. \(index)/\(blockedConnectionList.count)")
103186
// Get the first connection ID from the list
104187
guard let blockedConnectionID = blockedConnectionList[index]
105188
else

‎AdversaryLabSwift/Features/Entropy.swift‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ func scoreEntropy(allowedEntropyKey: String, allowedEntropyBinsKey: String, bloc
108108
/// A is the sorted set of Entropy for the Allowed traffic
109109
let allowedEntropyList: RList<Double> = RList(key: allowedEntropyKey)
110110
let allowedEntropyBinsRSet: RSortedSet<Int> = RSortedSet(key: allowedEntropyBinsKey)
111-
//let allowedEntropySet = newDoubletSet(from: [allowedEntropyRSet])
111+
112112
//Sort into bins
113113
for entropyIndex in 0 ..< allowedEntropyList.count
114114
{
@@ -139,7 +139,7 @@ func scoreEntropy(allowedEntropyKey: String, allowedEntropyBinsKey: String, bloc
139139
/// B is the sorted set of Entropy for the Blocked traffic
140140
let blockedEntropyList: RList<Double> = RList(key: blockedEntropyKey)
141141
let blockedEntropyBinsRSet: RSortedSet<Int> = RSortedSet(key: blockedEntropyBinsKey)
142-
//let blockedEntropySet = newDoubletSet(from: [blockedEntropyRSet])
142+
143143
//Sort into bins
144144
for entropyIndex in 0 ..< blockedEntropyList.count
145145
{

‎AdversaryLabSwift/ViewController.swift‎

Lines changed: 88 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -172,25 +172,25 @@ class ViewController: NSViewController
172172
let packetStatsDict: RMap<String, Int> = RMap(key: packetStatsKey)
173173

174174
// Allowed Packets Seen
175-
if let allowedPacketsSeenValue: Int = packetStatsDict[allowedPacketsSeenKey], allowedPacketsSeenValue != 0
175+
if let allowedPacketsSeenValue: Int = packetStatsDict[allowedPacketsSeenKey]
176176
{
177177
self.allowedPacketsSeen = "\(allowedPacketsSeenValue)"
178178
}
179179

180180
// Allowed Packets Analyzed
181-
if let allowedPacketsAnalyzedValue: Int = packetStatsDict[allowedPacketsAnalyzedKey], allowedPacketsAnalyzedValue != 0
181+
if let allowedPacketsAnalyzedValue: Int = packetStatsDict[allowedPacketsAnalyzedKey]
182182
{
183183
self.allowedPacketsAnalyzed = "\(allowedPacketsAnalyzedValue)"
184184
}
185185

186186
// Blocked Packets Seen
187-
if let blockedPacketsSeenValue: Int = packetStatsDict[blockedPacketsSeenKey], blockedPacketsSeenValue != 0
187+
if let blockedPacketsSeenValue: Int = packetStatsDict[blockedPacketsSeenKey]
188188
{
189189
self.blockedPacketsSeen = "\(blockedPacketsSeenValue)"
190190
}
191191

192192
// Blocked Packets Analyzed
193-
if let blockedPacketsAnalyzedValue: Int = packetStatsDict[blockedPacketsAnalyzedKey], blockedPacketsAnalyzedValue != 0
193+
if let blockedPacketsAnalyzedValue: Int = packetStatsDict[blockedPacketsAnalyzedKey]
194194
{
195195
self.blockedPacketsAnalyzed = "\(blockedPacketsAnalyzedValue)"
196196
}
@@ -204,13 +204,23 @@ class ViewController: NSViewController
204204
self.requiredTiming = "\(rtMember) ms"
205205
self.requiredTimeAcc = "\(rtScore)"
206206
}
207+
else
208+
{
209+
self.requiredTiming = "--"
210+
self.requiredTimeAcc = "--"
211+
}
207212

208213
let forbiddenTimingSet: RSortedSet<Int> = RSortedSet(key: forbiddenTimeDiffKey)
209214
if let (ftMember, ftScore) = forbiddenTimingSet.last
210215
{
211216
self.forbiddenTiming = "\(ftMember) ms"
212217
self.forbiddenTimingAcc = "\(ftScore)"
213218
}
219+
else
220+
{
221+
self.forbiddenTiming = "--"
222+
self.forbiddenTimingAcc = "--"
223+
}
214224

215225
// TLS Common Names
216226

@@ -220,13 +230,23 @@ class ViewController: NSViewController
220230
self.requiredTLSName = rTLSMember
221231
self.requiredTLSNameAcc = "\(rTLSScore)"
222232
}
233+
else
234+
{
235+
self.requiredTLSName = "--"
236+
self.requiredTLSNameAcc = "--"
237+
}
223238

224239
let forbiddenTLSNamesSet: RSortedSet<String> = RSortedSet(key: blockedTlsCommonNameKey)
225240
if let (fTLSMember, fTLSScore) = forbiddenTLSNamesSet.last
226241
{
227242
self.forbiddenTLSName = fTLSMember
228243
self.forbiddenTLSNameAcc = "\(fTLSScore)"
229244
}
245+
else
246+
{
247+
self.forbiddenTLSName = "--"
248+
self.forbiddenTLSNameAcc = "--"
249+
}
230250

231251
// Lengths
232252
let requiredOutLengthSet: RSortedSet<Int> = RSortedSet(key: outgoingRequiredLengthsKey)
@@ -235,27 +255,47 @@ class ViewController: NSViewController
235255
self.requiredOutLength = "\(rolMember)"
236256
self.requiredOutLengthAcc = "\(rolScore)"
237257
}
258+
else
259+
{
260+
self.requiredOutLength = "--"
261+
self.requiredOutLengthAcc = "--"
262+
}
238263

239264
let forbiddenOutLengthSet: RSortedSet<Int> = RSortedSet(key: outgoingForbiddenLengthsKey)
240265
if let (folMember, folScore) = forbiddenOutLengthSet.last
241266
{
242267
self.forbiddenOutLength = "\(folMember)"
243268
self.forbiddenOutLengthAcc = "\(folScore)"
244269
}
270+
else
271+
{
272+
self.forbiddenOutLength = "--"
273+
self.forbiddenOutLengthAcc = "--"
274+
}
245275

246276
let requiredInLengthSet: RSortedSet<Int> = RSortedSet(key: incomingRequiredLengthsKey)
247277
if let (rilMember, rilScore) = requiredInLengthSet.last
248278
{
249279
self.requiredInLength = "\(rilMember)"
250280
self.requiredInLengthAcc = "\(rilScore)"
251281
}
282+
else
283+
{
284+
self.requiredInLength = "--"
285+
self.requiredInLengthAcc = "--"
286+
}
252287

253288
let forbiddenInLengthSet: RSortedSet<Int> = RSortedSet(key: incomingForbiddenLengthsKey)
254289
if let (filMember, filScore) = forbiddenInLengthSet.last
255290
{
256291
self.forbiddenInLength = "\(filMember)"
257292
self.forbiddenInLengthAcc = "\(filScore)"
258293
}
294+
else
295+
{
296+
self.forbiddenInLength = "--"
297+
self.forbiddenInLengthAcc = "--"
298+
}
259299

260300
// Entropy
261301
let requiredOutEntropySet: RSortedSet<Int> = RSortedSet(key: outgoingRequiredEntropyKey)
@@ -264,27 +304,47 @@ class ViewController: NSViewController
264304
self.requiredOutEntropy = "\(roeMember)"
265305
self.requiredOutEntropyAcc = "\(roeScore)"
266306
}
307+
else
308+
{
309+
self.requiredOutEntropy = "--"
310+
self.requiredOutEntropyAcc = "--"
311+
}
267312

268313
let forbiddenOutEntropySet: RSortedSet<Int> = RSortedSet(key: outgoingForbiddenEntropyKey)
269314
if let (foeMember, foeScore) = forbiddenOutEntropySet.last
270315
{
271316
self.forbiddenOutEntropy = "\(foeMember)"
272317
self.forbiddenOutEntropyAcc = "\(foeScore)"
273318
}
319+
else
320+
{
321+
self.forbiddenOutEntropy = "--"
322+
self.forbiddenOutEntropyAcc = "--"
323+
}
274324

275325
let requiredInEntropySet: RSortedSet<Int> = RSortedSet(key: incomingRequiredEntropyKey)
276326
if let (rieMember, rieScore) = requiredInEntropySet.last
277327
{
278328
self.requiredInEntropy = "\(rieMember)"
279329
self.requiredInEntropyAcc = "\(rieScore)"
280330
}
331+
else
332+
{
333+
self.requiredInEntropy = "--"
334+
self.requiredInEntropyAcc = "--"
335+
}
281336

282337
let forbiddenInEntropySet: RSortedSet<Int> = RSortedSet(key: incomingForbiddenEntropyKey)
283338
if let (fieMember, fieScore) = forbiddenInEntropySet.last
284339
{
285340
self.forbiddenInEntropy = "\(fieMember)"
286341
self.forbiddenInEntropyAcc = "\(fieScore)"
287342
}
343+
else
344+
{
345+
self.forbiddenInEntropy = "--"
346+
self.forbiddenInEntropyAcc = "--"
347+
}
288348

289349
// Subsequences
290350
let requiredOutSequenceSet: RSortedSet<Data> = RSortedSet(key: outgoingRequiredSequencesKey)
@@ -294,6 +354,12 @@ class ViewController: NSViewController
294354
self.requiredOutSequenceCount = "\(rosMember)"
295355
self.requiredOutSequenceAcc = "\(rosScore)"
296356
}
357+
else
358+
{
359+
self.requiredOutSequence = "--"
360+
self.requiredOutSequenceCount = "--"
361+
self.requiredOutSequenceAcc = "--"
362+
}
297363

298364
let forbiddenOutSequenceSet: RSortedSet<Data> = RSortedSet(key: outgoingForbiddenSequencesKey)
299365
if let (fosMember, fosScore) = forbiddenOutSequenceSet.last
@@ -302,6 +368,12 @@ class ViewController: NSViewController
302368
self.forbiddenOutSequenceCount = "\(fosMember)"
303369
self.forbiddenOutSequenceAcc = "\(fosScore)"
304370
}
371+
else
372+
{
373+
self.forbiddenOutSequence = "--"
374+
self.forbiddenOutSequenceCount = "--"
375+
self.forbiddenOutSequenceAcc = "--"
376+
}
305377

306378
let requiredInSequenceSet: RSortedSet<Data> = RSortedSet(key: incomingRequiredSequencesKey)
307379
if let (risMemeber, risScore) = requiredInSequenceSet.last
@@ -310,6 +382,12 @@ class ViewController: NSViewController
310382
self.requiredInSequenceCount = "\(risMemeber)"
311383
self.requiredInSequenceAcc = "\(risScore)"
312384
}
385+
else
386+
{
387+
self.requiredInSequence = "--"
388+
self.requiredInSequenceCount = "--"
389+
self.requiredInSequenceAcc = "--"
390+
}
313391

314392
let forbiddenInSequenceSet: RSortedSet<Data> = RSortedSet(key: incomingForbiddenSequencesKey)
315393
if let (fisMember, fisScore) = forbiddenInSequenceSet.last
@@ -318,6 +396,12 @@ class ViewController: NSViewController
318396
self.forbiddenInSequenceCount = "\(fisMember)"
319397
self.forbiddenInSequenceAcc = "\(fisScore)"
320398
}
399+
else
400+
{
401+
self.forbiddenInSequence = "--"
402+
self.forbiddenInSequenceCount = "--"
403+
self.forbiddenInSequenceAcc = "--"
404+
}
321405

322406
}
323407
}

0 commit comments

Comments
 (0)