tcpdump49bitservicemap.java

基于人工免疫原理的入侵检测系统框架

/*=================
 * Copyright (C) 2001  Todd Kaplan
 *
 * Lisys is a program that monitors TCP SYN packets to detect network
 * traffic anomalies.
 *
 * Licensed under the GNU General Public License (GPL), version 2 or
 * higher.  Please see the COPYING and PATENT files included with the 
 * Lisys distribution, which can be found at:
 *
 *   http://www.cs.unm.edu/~judd/lisys/
 *
 * Also, the current text of the GPL can be found at: 
 *
 *   http://www.gnu.org/copyleft/gpl.html
 * 
 * Note that Lisys has NO WARRANTY!
 *=================*/

package edu.unm.cs.lisys.detection.bip;

import edu.unm.cs.lisys.debug.*;
import java.util.*;

/**==========
 * TCPDump49BitServiceMap.java
 *   Used by TCPDump49BitBIP.
 *
 * The service type is mapped from its category to a number from 0 to
 * 255. All non-assigned privileged ports are represented by a single
 * number, and all non-assigned non-privileged ports are represented
 * by a different single number.  See page 46 of Hofmeyer dissertation
 * for a complete breakdown of the mapping.
 *
 * Here are the people who have worked on this code in the order they
 * have worked on it:
 *   @author Todd Kaplan <[e-mail]>
 *   @author Justin Balthrop <[e-mail]>
 *==========*/

public class TCPDump49BitServiceMap {
    
    private static Hashtable mapHash;
    
    public static void main(String[] args)
    {
	System.out.println("mapping for port #178: " + get(6060));
    }
    
    public static byte get(int i)
    {
	Integer fx = (Integer) mapHash.get(new Integer(i));
	if (fx == null) {
	    if (i <= 1023) // privileged ports
		fx = new Integer(67);
	    else if ((i >= 6000) && (i <= 6063))
		fx = new Integer(69);
	    else if (i >= 1024)
		fx = new Integer(68);
	}
	return (byte) fx.intValue();
    }

    static
    {
	mapHash = new Hashtable();
	mapHash.put(new Integer(1), new Integer(0));
	mapHash.put(new Integer(7), new Integer(1));
	mapHash.put(new Integer(9), new Integer(2));
	mapHash.put(new Integer(11), new Integer(3));
	mapHash.put(new Integer(13), new Integer(4));
	mapHash.put(new Integer(19), new Integer(5));
	mapHash.put(new Integer(20), new Integer(6));
	mapHash.put(new Integer(21), new Integer(7));
	mapHash.put(new Integer(22), new Integer(8));
	mapHash.put(new Integer(23), new Integer(9));
	mapHash.put(new Integer(25), new Integer(10));
	mapHash.put(new Integer(37), new Integer(11));
	mapHash.put(new Integer(38), new Integer(12));
	mapHash.put(new Integer(42), new Integer(13));
	mapHash.put(new Integer(43), new Integer(14));
	mapHash.put(new Integer(53), new Integer(15));
	mapHash.put(new Integer(68), new Integer(16));
	mapHash.put(new Integer(70), new Integer(17));
	mapHash.put(new Integer(79), new Integer(18));
	mapHash.put(new Integer(80), new Integer(19));
	mapHash.put(new Integer(87), new Integer(20));
	mapHash.put(new Integer(94), new Integer(21));
	mapHash.put(new Integer(95), new Integer(22));
	mapHash.put(new Integer(109), new Integer(23));
	mapHash.put(new Integer(110), new Integer(24));
	mapHash.put(new Integer(111), new Integer(25));
	mapHash.put(new Integer(113), new Integer(26));
	mapHash.put(new Integer(119), new Integer(27));
	mapHash.put(new Integer(123), new Integer(28));
	mapHash.put(new Integer(130), new Integer(29));
	mapHash.put(new Integer(131), new Integer(30));
	mapHash.put(new Integer(132), new Integer(31));
	mapHash.put(new Integer(137), new Integer(32));
	mapHash.put(new Integer(138), new Integer(33));
	mapHash.put(new Integer(139), new Integer(34));
	mapHash.put(new Integer(143), new Integer(35));
	mapHash.put(new Integer(156), new Integer(36));
	mapHash.put(new Integer(161), new Integer(37));
	mapHash.put(new Integer(162), new Integer(38));
	mapHash.put(new Integer(177), new Integer(39));
	mapHash.put(new Integer(178), new Integer(40));
	mapHash.put(new Integer(194), new Integer(41));	
	mapHash.put(new Integer(199), new Integer(42));
	mapHash.put(new Integer(200), new Integer(43));
	mapHash.put(new Integer(201), new Integer(44));
	mapHash.put(new Integer(202), new Integer(45));
	mapHash.put(new Integer(203), new Integer(46));
	mapHash.put(new Integer(204), new Integer(47));
	mapHash.put(new Integer(205), new Integer(48));
	mapHash.put(new Integer(206), new Integer(49));
	mapHash.put(new Integer(207), new Integer(50));
	mapHash.put(new Integer(208), new Integer(51));
	mapHash.put(new Integer(210), new Integer(52));
	mapHash.put(new Integer(213), new Integer(53));
	mapHash.put(new Integer(220), new Integer(54));
	mapHash.put(new Integer(372), new Integer(55));
	mapHash.put(new Integer(387), new Integer(56));
	mapHash.put(new Integer(396), new Integer(57));
	mapHash.put(new Integer(411), new Integer(58));
	mapHash.put(new Integer(443), new Integer(59));
	mapHash.put(new Integer(512), new Integer(60));
	mapHash.put(new Integer(513), new Integer(61));
	mapHash.put(new Integer(514), new Integer(62));
	mapHash.put(new Integer(515), new Integer(63));
	mapHash.put(new Integer(523), new Integer(64));
	mapHash.put(new Integer(540), new Integer(65));
	mapHash.put(new Integer(566), new Integer(66));
    }

}