annids.h~

一个入侵检测小程序,用C编写,linux环境

//annids.h
#ifndef __ANNIDS_H__
#define __ANNIDS_H__


/*INCLUDE*/


#include<stdio.h>
#include<time.h>
#include<sys/types.h>
#include<errno.h>

//mode:S_ISUID...
#include<sys/stat.h>

//getopt()
#include<unistd.h>

//signal()
#include<signal.h>

//void exit(),malloc()
#include<stdlib.h>

//void bzero(),bcopy()...
#include<strings.h>

//strncat(),strncpy,memcpy,memset...
#include<string.h>

//inet_addr(),inet_aton(),inet_ntoa()
#include<arpa/inet.h>

#include<pcap/pcap.h>

//ntoh(),hton(),struct sockaddr_in,connetc()...
#include<netinet/in.h>

//the struct of ether arp
#include<netinet/if_ether.h>

//the struct of head of protocal
#include<net/ethernet.h>
#include<netinet/ip.h>
#include<netinet/tcp.h>
#include<netinet/udp.h>
#include<netinet/ip_icmp.h>
#include<netinet/igmp.h>


#include"neural.h"
#include"find.h"


/*DEFIEN*/
#define BUF_SIZE 256
//s1:the quantity of members of  input vector
#define S1 230 
//s2:the quantity of neurals
#define S2 3
//value of vigilance
#define RO 0.6
//value of study rule
#define ZETA 225
//the max number of input vector,after study 1000 packet if not over it wiil be stop by force
#define M_IN 1000
//the max number of no change of w21,how many times does the weight matrix have not changed
#define M_EQU 3
//the threshold value for detect,used in art_detect()
#define AS2 150
//the path of w21 w12 and intrusion record
#define WIR "/neural"

//#define DEBUG4
//





/*VAR*/

int ctrl_c;//whether quit

char neural_w21[BUF_SIZE];//the path of w21[]
char intru_file[BUF_SIZE];//the path of the intrusion record file
int study_detect;//practice neural or detect intrusion 
int con_stu;//whether continue study
int over_for;//study over or force quit
char *s_time;



//for neural
int w21[S1][S2];
float w12[S2][S1];
int i1,i2;//i1:the var of s1;i2:the var of s2
int equ_sum;//how many times w21 does not change
int input_sum;//for how many packet have been study

int pp[230];

//for file operation
char p_w21[BUF_SIZE];
char p_w12[BUF_SIZE];
char p_equsum[BUF_SIZE];
char p_intru[BUF_SIZE];
FILE *f_w21;
FILE *f_w12;
FILE *f_equsum;
FILE *f_intru;
char str_fscan[BUF_SIZE];



//for pcap
char *dev;
pcap_t *hand;
char errbuf[BUF_SIZE];
struct bpf_program filter;
bpf_u_int32 mask,net;
pcap_handler handler;
int datalink;




/*FUNCTION*/
int Order(int ,char **);
void InitWeight();
int PcapLoop();
int ShowHelp();
void TermSig(int);

#endif