contiguousmatchesmatchrule.java

基于人工免疫原理的入侵检测系统框架

/*=================
 * Copyright (C) 2001  Todd Kaplan
 *
 * Lisys is a program that monitors TCP SYN packets to detect network
 * traffic anomalies.
 *
 * Licensed under the GNU General Public License (GPL), version 2 or
 * higher.  Please see the COPYING and PATENT files included with the 
 * Lisys distribution, which can be found at:
 *
 *   http://www.cs.unm.edu/~judd/lisys/
 *
 * Also, the current text of the GPL can be found at: 
 *
 *   http://www.gnu.org/copyleft/gpl.html
 * 
 * Note that Lisys has NO WARRANTY!
 *=================*/

package edu.unm.cs.lisys.detection.matchrule;

import edu.unm.cs.lisys.debug.*;
import edu.unm.cs.lisys.util.*;
import edu.unm.cs.lisys.detection.bip.*;
import java.util.*;
import java.io.*;

/**========== 
 * ContiguousMatchesMatchRule.java
 *
 * Here are the people who have worked on this code, starting with 
 * the most recent:
 *   @author Justin Balthrop <[e-mail]>
 *   @author Todd Kaplan <[e-mail]>
 *
 * Contiguous bits rule (number of bits in a row).
 * The result will depend on the permutation mask.
 *==========*/

public class ContiguousMatchesMatchRule implements MatchRule, Serializable
{
    public static void main(String[] args) 
    {
	KnuthRandom random = new KnuthRandom(100);

	for (int i = 0; i < 5; i++) {
	    BinaryInputPattern bip1 = new TCPDump49BitBIP();
	    bip1.constructBinaryString(random);
	    Debug.verbose(bip1.toString());
	    
	    BinaryInputPattern bip2 = new TCPDump49BitBIP();
	    bip2.constructBinaryString(random);
	    Debug.verbose(bip2.toString());

	    MatchRule mr = new ContiguousMatchesMatchRule();
	    int length = mr.match(bip1, bip2);
	    Debug.verbose("length of match = " + length);
	}
    }

    /**==========
     * match:
     *   Looks for the r most contiguous bits to match between two
     *   BIPs 
     *==========*/
    public int match(BinaryInputPattern first, BinaryInputPattern second)
    {
		BitSet bits1 = (BitSet) first.getBinaryString().clone();
		BitSet bits2 = (BitSet) second.getBinaryString().clone();
		bits1.xor(bits2);
	
		/* now, search for the longest streak of xored bits set to 1 */
		int longestMatch = 0;
		int currentMatches = 0;

		for (int i = 0; i < first.getLength(); i++)
		{
	    	boolean bit = bits1.get(i);
	    	if (bit != true)
			{
				currentMatches++;
				if (currentMatches > longestMatch)
				{
		    		longestMatch = currentMatches;
				}
	    	}
	    	else
			{
				currentMatches = 0;
	    	}
		}

		return longestMatch;
    }
}