diff options
| author | EnricoGuccii <partyka.003@proton.me> | 2026-01-10 22:43:36 +0100 |
|---|---|---|
| committer | EnricoGuccii <partyka.003@proton.me> | 2026-01-10 22:43:36 +0100 |
| commit | 6d7410e286ce0fde31f89185c095fe90e85597f3 (patch) | |
| tree | 5092c99d353382a71f00d8fe18d53b8073cf3f58 /src/streamml | |
| parent | c2f5fbe7fb93ce420caf23c5c0e06144cf953bb8 (diff) | |
bloat removed
Diffstat (limited to 'src/streamml')
23 files changed, 1358 insertions, 0 deletions
diff --git a/src/streamml/__init__.py b/src/streamml/__init__.py new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/src/streamml/__init__.py diff --git a/src/streamml/__pycache__/__init__.cpython-312.pyc b/src/streamml/__pycache__/__init__.cpython-312.pyc Binary files differnew file mode 100644 index 0000000..49f5c58 --- /dev/null +++ b/src/streamml/__pycache__/__init__.cpython-312.pyc diff --git a/src/streamml/__pycache__/app.cpython-312.pyc b/src/streamml/__pycache__/app.cpython-312.pyc Binary files differnew file mode 100644 index 0000000..3dcd3e1 --- /dev/null +++ b/src/streamml/__pycache__/app.cpython-312.pyc diff --git a/src/streamml/app.py b/src/streamml/app.py new file mode 100644 index 0000000..4c7d1aa --- /dev/null +++ b/src/streamml/app.py @@ -0,0 +1,60 @@ +from textual.app import App, ComposeResult +from textual.widgets import TabbedContent, TabPane +from textual.theme import Theme + +from pathlib import Path +import os + +from .front.detector_tab import DetectorTab +from .front.detector_profiles_tab import DetectorProfilesTab +from .front.options_tab import OptionsTab + +from .back.detector_profiles_manager import DetectorProfilesManager + + +XDG_DATA_HOME = Path(os.environ.get("XDG_DATA_HOME", Path.home() / ".local/share")) + +theme = Theme( + name="pastel_blue_theme", + primary="#82A6F2", + secondary="#778899", + accent="#E0FFFF", + # background="#1a1b26", + surface="#1e1e20", + error="#ffb3ba", + success="#baffc9", + warning="#ffffba", +) + +class Streamml(App): + CSS_PATH = "styles/styles.css" + + def __init__(self): + super().__init__() + self.detector_profiles_manager = DetectorProfilesManager(profiles_file=f"{XDG_DATA_HOME}/netmonitor/objects/detector_profiles_objects") + + def compose(self) -> ComposeResult: + with TabbedContent(): + with TabPane(title="Detector", id="detector", classes="detector-theme"): + with TabbedContent(): + with TabPane(title="Models"): + yield DetectorTab(self.manager.detector_profiles_manager) + with TabPane(title="Profiles"): + yield DetectorProfilesTab(self.manager.detector_profiles_manager) + + with TabPane(title="Options", id="options", classes="options-theme"): + yield OptionsTab(self.detector_profiles_manager) + + def on_mount(self): + self.register_theme(theme) + self.theme = "pastel_blue_theme" + + @property + def manager(self): + return self + +def main(): + Streamml().run() + +if __name__ == "__main__": + main() diff --git a/src/streamml/back/__pycache__/detector_profile_HST.cpython-312.pyc b/src/streamml/back/__pycache__/detector_profile_HST.cpython-312.pyc Binary files differnew file mode 100644 index 0000000..72054e8 --- /dev/null +++ b/src/streamml/back/__pycache__/detector_profile_HST.cpython-312.pyc diff --git a/src/streamml/back/__pycache__/detector_profiles_manager.cpython-312.pyc b/src/streamml/back/__pycache__/detector_profiles_manager.cpython-312.pyc Binary files differnew file mode 100644 index 0000000..598bd22 --- /dev/null +++ b/src/streamml/back/__pycache__/detector_profiles_manager.cpython-312.pyc diff --git a/src/streamml/back/__pycache__/notification_service.cpython-312.pyc b/src/streamml/back/__pycache__/notification_service.cpython-312.pyc Binary files differnew file mode 100644 index 0000000..d19dcaa --- /dev/null +++ b/src/streamml/back/__pycache__/notification_service.cpython-312.pyc diff --git a/src/streamml/back/__pycache__/window.cpython-312.pyc b/src/streamml/back/__pycache__/window.cpython-312.pyc Binary files differnew file mode 100644 index 0000000..49f5f63 --- /dev/null +++ b/src/streamml/back/__pycache__/window.cpython-312.pyc diff --git a/src/streamml/back/detector_profile_HST.py b/src/streamml/back/detector_profile_HST.py new file mode 100644 index 0000000..6583769 --- /dev/null +++ b/src/streamml/back/detector_profile_HST.py @@ -0,0 +1,215 @@ +import threading +import queue +import time +import os +from pathlib import Path +from scapy.all import wrpcap, AsyncSniffer + +from river.anomaly import HalfSpaceTrees +from tinydb import TinyDB +from tinydb.table import Document + +from .window import Window +from .notification_service import notification_service + +XDG_DATA_HOME = Path(os.environ.get("XDG_DATA_HOME", Path.home() / ".local/share")) +LOGS_PATH = f"{XDG_DATA_HOME}/netmonitor/detector/profiles_logs" +PCAP_PATH = f"{XDG_DATA_HOME}/netmonitor/detector/profiles_pcaps" + + +class DetectorProfileHST: + + def __init__( + self, + profile_name: str, + input_data: dict + ): + self.profile_name = profile_name + self.features = input_data.get("features", []) + self.params = input_data.get("params", {}) + self.n_trees = int(self.params.get("trees", 10)) + self.height = int(self.params.get("height", 8)) + self.window_size = int(self.params.get("window", 250)) + self.seed = int(self.params.get("seed", 42)) + self.threshold = float(self.params.get("threshold", 0.7)) + self.window_duration = float(self.params.get("window_duration", 10.0)) + self.bpf_filter = self.params.get("bpf_filter", "") + self.interface = self.params.get("interface", None) + self.queue_size = int(self.params.get("queue_size", 10000)) + self.logs_path = f"{LOGS_PATH}/{profile_name}.json" + os.makedirs(os.path.dirname(self.logs_path), exist_ok=True) + + self.is_active = False + + self.notify_enabled = False + self._init_runtime_objects() + + + def _init_runtime_objects(self): + self.queue = queue.Queue(maxsize=self.queue_size) + + os.makedirs(f"{LOGS_PATH}", exist_ok=True) + self.db = TinyDB(f"{LOGS_PATH}/{self.profile_name}.json") + + self.model = HalfSpaceTrees( + n_trees=self.n_trees, + height=self.height, + window_size=self.window_size, + seed=self.seed + ) + + self.window = Window( + window_duration=self.window_duration, + enabled_features=self.features + ) + + self.processor_thread = None + + self.packets_read = 0 + self.windows_analyzed = 0 + + if not hasattr(self, 'plot_data'): + self.plot_data = [] + + + def __getstate__(self): + state = self.__dict__.copy() + cols_to_remove = ['sniffer_thread', 'processor_thread', 'queue', 'db', 'window'] + for col in cols_to_remove: + if col in state: + del state[col] + return state + + def __setstate__(self, state): + self.__dict__.update(state) + self._init_runtime_objects() + self.is_active = False + + def __repr__(self): + return f"<DetectorProfileHST profile_name={self.profile_name!r}, active={self.is_active}>" + + def turn_on(self): + if self.is_active: + return + + self.is_active = True + os.makedirs(os.path.dirname(self.logs_path), exist_ok=True) + self.window.window_duration = self.window_duration + self.window.window_start = time.time() + + self.sniffer = AsyncSniffer( + iface=self.interface, + filter=self.bpf_filter, + store=False, + prn=self._add_to_queue + ) + self.sniffer.start() + + self.processor_thread = threading.Thread(target=self._process_thread, daemon=True) + + self.processor_thread.start() + + def turn_off(self): + self.is_active = False + if self.sniffer: + self.sniffer.stop() + + time.sleep(0.2) + + def _add_to_queue(self, pkt): + if self.queue: + try: + self.queue.put_nowait(pkt) + self.packets_read += 1 + except queue.Full: + pass + + def _process_thread(self): + while self.is_active: + try: + pkt = self.queue.get(timeout=1) + except queue.Empty: + continue + + result = self.window.add_packet(pkt) + + if result is None: + continue + + features, raw_packets = result + self.windows_analyzed += 1 + + if not features: + continue + + sample = {feat: 0.0 for feat in self.features} + for k, v in features.items(): + if k in sample: + sample[k] = float(v) + + score = self.model.score_one(sample) + self.model.learn_one(sample) + + self.plot_data.append(score) + if len(self.plot_data) > 30: + self.plot_data.pop(0) + + if score > self.threshold: + self._handle_anomaly(score, sample, raw_packets) + + def _handle_anomaly(self, score: float, features: dict, raw_packets: list): + timestamp = time.strftime("%Y-%m-%d_%H-%M-%S") + + os.makedirs(os.path.dirname(f"{PCAP_PATH}/{self.profile_name}"), exist_ok=True) + filename = f"{PCAP_PATH}/{self.profile_name}/anom_{timestamp}.pcap" + + if raw_packets: + try: + wrpcap(filename, raw_packets) + except Exception as e: + print(f"Error saving pcap: {e}") + + if self.notify_enabled: + msg = f"*Anomaly detected: {self.profile_name}*\nScore: `{score:.4f}`\nSaved: `{filename}`" + notification_service.send_message(message=msg) + + if self.db: + self.db.insert( + Document({ + "ts": time.time(), + "timestamp": timestamp, + "profile": self.profile_name, + "score": float(score), + "pcap": filename, + "pkt_rate": features.get("pkt_rate", 0), + "proto_info": f"TCP:{features.get('proto_tcp_ratio',0):.2f} UDP:{features.get('proto_udp_ratio',0):.2f}", + }, doc_id=None) + ) + + def to_dict(self): + return { + "profile name": self.profile_name, + "logs_path": self.logs_path, + "pcap_path": f"{PCAP_PATH}/{self.profile_name}", + "params": self.params, + "features": self.features, + } + + def get_logs(self): + if self.db: + return self.db.all() + return [] + + def clear_logs(self): + if self.db: + self.db.truncate() + + def get_runtime_stats(self): + return { + "is_active": self.is_active, + "notify_enabled": self.notify_enabled, + "packets_sniffed": getattr(self, "packets_read", 0), + "queue_size": self.queue.qsize() if hasattr(self, "queue") and self.queue else 0, + "windows_processed": getattr(self, "windows_analyzed", 0), + "window_duration": self.window_duration + } diff --git a/src/streamml/back/detector_profiles_manager.py b/src/streamml/back/detector_profiles_manager.py new file mode 100644 index 0000000..2f1543c --- /dev/null +++ b/src/streamml/back/detector_profiles_manager.py @@ -0,0 +1,153 @@ +import re +from pathlib import Path +from typing import Callable, Literal +import pickle +from streamml.back.detector_profile_HST import DetectorProfileHST + + +SeverityLevel = Literal["information", "warning", "error"] +VALID_NAME_REGEX = r"^[a-zA-Z0-9_-]+$" + +class DetectorProfilesManager: + def __init__(self, profiles_file: str): + self.profiles_file = Path(profiles_file) + self.profiles: list[DetectorProfileHST] = [] + + self.on_message: Callable[[str, str, str], None] | None = None + self.on_refresh: Callable[[], None] | None = None + + self.load_profiles() + + + def _notify(self, msg: str, title: str = "Profile Manager", level: SeverityLevel = "information"): + if self.on_message: + self.on_message(msg, title, level) + + + def _refresh_front(self): + if self.on_refresh: + self.on_refresh() + + + def _fail(self, msg: str, level: SeverityLevel = "error", notify: bool = True) -> bool: + if notify: + self._notify(msg, level=level) + return False + + + def _ok(self, msg: str | None = None, level: SeverityLevel = "information", notify: bool = True) -> bool: + if msg and notify: + self._notify(msg, level=level) + return True + + + def try_save_profiles(self, notify: bool = True) -> bool: + try: + self.profiles_file.parent.mkdir(parents=True, exist_ok=True) + + with open(self.profiles_file, "wb") as f: + pickle.dump(self.profiles, f, protocol=pickle.HIGHEST_PROTOCOL) + + return self._ok("Profiles saved successfully.", notify=notify) + except Exception as e: + import traceback + traceback.print_exc() + return self._fail(f"Error saving profiles: {e}", notify=notify) + + + def load_profiles(self, notify: bool = True) -> bool: + if not self.profiles_file.exists(): + if notify: + self._notify("Profiles file not found. Creating a new one.", level="warning") + if not self.try_save_profiles(notify=False): + return self._fail("Failed to create profiles file!", notify=notify) + return self._ok("New profiles file created.", notify=notify) + + try: + with open(self.profiles_file, "rb") as f: + self.profiles = pickle.load(f) + self._refresh_front() + return self._ok(f"Loaded {len(self.profiles)} profiles.", notify=notify) + except Exception as e: + return self._fail(f"Error loading profiles: {e}", notify=notify) + + + def add_profile(self, profile_name: str, input_data: dict, notify: bool = True) -> bool: + if not profile_name: + return self._fail("Name can't be blank.", "error", notify) + + if not re.match(VALID_NAME_REGEX, profile_name): + return self._fail(f"Bad input '{profile_name}'. Use only letters, numbers, '_' and '-'.", "error", notify) + + if any(p.profile_name == profile_name for p in self.profiles): + return self._fail(f"Profile {profile_name} already exists.", "warning", notify) + + new_profile = DetectorProfileHST(profile_name=profile_name, input_data = input_data) + self.profiles.append(new_profile) + + if not self.try_save_profiles(notify=False): + self.profiles.remove(new_profile) + return self._fail(f"Failed to save profile {profile_name}.", notify=notify) + + self._refresh_front() + return self._ok(f"Added profile {profile_name}.", notify=notify) + + + def delete_profile(self, profile_name: str, notify: bool = True) -> bool: + before = len(self.profiles) + self.profiles = [p for p in self.profiles if p.profile_name != profile_name] + + if len(self.profiles) == before: + return self._fail(f"Profile {profile_name} not found.", "warning", notify) + + if not self.try_save_profiles(notify=False): + return self._fail(f"Failed to save changes after deleting {profile_name}.", notify=notify) + + self._refresh_front() + return self._ok(f"Deleted profile {profile_name}.", notify=notify) + + + def get_profile(self, profile_name: str) -> DetectorProfileHST | None: + return next((p for p in self.profiles if p.profile_name == profile_name), None) + + + def update_profile(self, profile_name: str, field: str, value, notify: bool = True) -> bool: + p = self.get_profile(profile_name) + if not p: + return self._fail(f"Profile {profile_name} does not exist.", notify=notify) + + setattr(p, field, value) + if self.try_save_profiles(notify=False): + return self._ok(f"Updated profile {profile_name}.", notify=notify) + else: + return self._fail(f"Failed to save updated profile {profile_name}.", notify=notify) + + + def turn_on_profile(self, profile_name: str, app=None, notify: bool = True) -> bool: + p = self.get_profile(profile_name) + if not p: + return self._fail(f"Profile {profile_name} not found.", notify=notify) + try: + p.turn_on() + return self._ok(f"Profile {profile_name} activated.", notify=notify) + except Exception as e: + return self._fail(f"Error activating profile: {e}", notify=notify) + + + def turn_off_profile(self, profile_name: str, notify: bool = True) -> bool: + p = self.get_profile(profile_name) + if not p: + return self._fail(f"Profile {profile_name} not found.", notify=notify) + try: + p.turn_off() + return self._ok(f"Profile {profile_name} deactivated.", notify=notify) + except Exception as e: + return self._fail(f"Error deactivating profile: {e}", notify=notify) + + + def get_profile_logs(self, profile_name: str, notify: bool = True): + p = self.get_profile(profile_name) + if not p: + self._fail(f"Profile {profile_name} not found.", "error", notify) + return None + return p.get_logs() diff --git a/src/streamml/back/notification_service.py b/src/streamml/back/notification_service.py new file mode 100644 index 0000000..e347faf --- /dev/null +++ b/src/streamml/back/notification_service.py @@ -0,0 +1,49 @@ +import json +import requests +from pathlib import Path + +CONFIG_FILE = Path("data/global_config.json") + +class NotificationService: + def __init__(self): + self.webhook_url = "" + self.load_config() + + def load_config(self): + if CONFIG_FILE.exists(): + try: + with open(CONFIG_FILE, "r") as f: + data = json.load(f) + self.webhook_url = data.get("discord_webhook_url", "") + except Exception as e: + print(f"Error loading notification config: {e}") + + def save_config(self, webhook_url: str): + self.webhook_url = webhook_url + + CONFIG_FILE.parent.mkdir(parents=True, exist_ok=True) + try: + with open(CONFIG_FILE, "w") as f: + json.dump({ + "discord_webhook_url": self.webhook_url + }, f, indent=4) + return True + except Exception as e: + print(f"Error saving config: {e}") + return False + + def send_message(self, message: str) -> bool: + if not self.webhook_url: + return False + + payload = { + "content": message + } + try: + response = requests.post(self.webhook_url, json=payload, timeout=5) + return response.status_code in [200, 204] + except Exception as e: + print(f"Discord send error: {e}") + return False + +notification_service = NotificationService() diff --git a/src/streamml/back/window.py b/src/streamml/back/window.py new file mode 100644 index 0000000..dfa8e7d --- /dev/null +++ b/src/streamml/back/window.py @@ -0,0 +1,251 @@ +import time +from collections import defaultdict +from statistics import mean, pstdev +import math + +from scapy.all import IP, IPv6, TCP, UDP, ICMP + +class Window: + def __init__(self, window_duration: float, enabled_features: list[str]): + + self.window_duration = float(window_duration) + self.enabled = set(enabled_features) + + self.window_start = time.time() + + self.raw_packets_buffer = [] + + self.flows = defaultdict(lambda: { + "pkt_count": 0, + "byte_count": 0, + "dst_ports": defaultdict(int), + "src_ports": defaultdict(int), + "tcp_flags": { + "syn": 0, "fin": 0, "rst": 0, "ack": 0, + "psh": 0, "urg": 0, "xmas": 0, "null": 0, + }, + "sizes": [], + "start_ts": None, + "end_ts": None, + "tcp_pkts": 0, + "udp_pkts": 0, + "icmp_pkts": 0, + }) + + def add_packet(self, pkt): + now = time.time() + + if now - self.window_start >= self.window_duration: + features = self._finish_window() + + self.window_start = now + + raw = list(self.raw_packets_buffer) + + self.raw_packets_buffer.clear() + self.flows.clear() + + self._process_single_packet(pkt) + + return features, raw + + self._process_single_packet(pkt) + return None + + def _process_single_packet(self, pkt): + self.raw_packets_buffer.append(pkt) + + proto = None + if IP in pkt: + src = pkt[IP].src + dst = pkt[IP].dst + proto = pkt[IP].proto + elif IPv6 in pkt: + src = pkt[IPv6].src + dst = pkt[IPv6].dst + proto = pkt[IPv6].nh + else: + return + + key = (src, dst, proto) + f = self.flows[key] + + now = time.time() + if f["start_ts"] is None: + f["start_ts"] = now + f["end_ts"] = now + + size = len(pkt) + f["pkt_count"] += 1 + f["byte_count"] += size + f["sizes"].append(size) + + if TCP in pkt: + f["tcp_pkts"] += 1 + dport = pkt[TCP].dport + sport = pkt[TCP].sport + f["dst_ports"][dport] += 1 + f["src_ports"][sport] += 1 + + flags = pkt[TCP].flags + if flags & 0x02: f["tcp_flags"]["syn"] += 1 + if flags & 0x01: f["tcp_flags"]["fin"] += 1 + if flags & 0x04: f["tcp_flags"]["rst"] += 1 + if flags & 0x10: f["tcp_flags"]["ack"] += 1 + if flags & 0x08: f["tcp_flags"]["psh"] += 1 + if flags & 0x20: f["tcp_flags"]["urg"] += 1 + + if flags in [0x29, 0x3F, 0x3B]: + f["tcp_flags"]["xmas"] += 1 + if flags == 0: + f["tcp_flags"]["null"] += 1 + + elif UDP in pkt: + f["udp_pkts"] += 1 + dport = pkt[UDP].dport + sport = pkt[UDP].sport + f["dst_ports"][dport] += 1 + f["src_ports"][sport] += 1 + + elif ICMP in pkt: + f["icmp_pkts"] += 1 + + def _finish_window(self): + if not self.flows: + return {} + + total_flows = len(self.flows) + total_packets = 0 + total_bytes = 0 + + tcp_flags_global = { + "syn": 0, "fin": 0, "rst": 0, "ack": 0, + "psh": 0, "urg": 0, "xmas": 0, "null": 0 + } + + all_sizes = [] + proto_tcp = 0 + proto_udp = 0 + proto_icmp = 0 + + dst_port_counts = defaultdict(int) + src_port_counts = defaultdict(int) + + for f in self.flows.values(): + total_packets += f["pkt_count"] + total_bytes += f["byte_count"] + + for p, c in f["dst_ports"].items(): + dst_port_counts[p] += c + for p, c in f["src_ports"].items(): + src_port_counts[p] += c + + for k in tcp_flags_global: + tcp_flags_global[k] += f["tcp_flags"][k] + + all_sizes.extend(f["sizes"]) + proto_tcp += f["tcp_pkts"] + proto_udp += f["udp_pkts"] + proto_icmp += f["icmp_pkts"] + + window_len = self.window_duration + total_pkts = total_packets if total_packets > 0 else 1 + + feat = {} + + if "flow_count" in self.enabled: feat["flow_count"] = total_flows + if "total_packets" in self.enabled: feat["total_packets"] = total_packets + if "total_bytes" in self.enabled: feat["total_bytes"] = total_bytes + if "avg_bytes_per_flow" in self.enabled: feat["avg_bytes_per_flow"] = total_bytes / total_flows if total_flows else 0 + if "pkt_rate" in self.enabled: feat["pkt_rate"] = total_packets / window_len + if "byte_rate" in self.enabled: feat["byte_rate"] = total_bytes / window_len + + if "syn_count" in self.enabled: feat["syn_count"] = tcp_flags_global["syn"] + if "fin_count" in self.enabled: feat["fin_count"] = tcp_flags_global["fin"] + if "rst_count" in self.enabled: feat["rst_count"] = tcp_flags_global["rst"] + if "ack_count" in self.enabled: feat["ack_count"] = tcp_flags_global["ack"] + if "psh_count" in self.enabled: feat["psh_count"] = tcp_flags_global["psh"] + if "urg_count" in self.enabled: feat["urg_count"] = tcp_flags_global["urg"] + + if "syn_ratio" in self.enabled: feat["syn_ratio"] = tcp_flags_global["syn"] / total_pkts + if "fin_ratio" in self.enabled: feat["fin_ratio"] = tcp_flags_global["fin"] / total_pkts + if "xmas_total" in self.enabled: feat["xmas_total"] = tcp_flags_global["xmas"] + if "null_scan_total" in self.enabled: feat["null_scan_total"] = tcp_flags_global["null"] + + if "unique_dst_ports" in self.enabled: feat["unique_dst_ports"] = len(dst_port_counts) + if "unique_src_ports" in self.enabled: feat["unique_src_ports"] = len(src_port_counts) + if "port_entropy_dst" in self.enabled: feat["port_entropy_dst"] = entropy(dst_port_counts) + if "port_entropy_src" in self.enabled: feat["port_entropy_src"] = entropy(src_port_counts) + + if all_sizes: + if "avg_pkt_size" in self.enabled: feat["avg_pkt_size"] = mean(all_sizes) + if "min_pkt_size" in self.enabled: feat["min_pkt_size"] = min(all_sizes) + if "max_pkt_size" in self.enabled: feat["max_pkt_size"] = max(all_sizes) + if "std_pkt_size" in self.enabled: feat["std_pkt_size"] = pstdev(all_sizes) + else: + for k in ["avg_pkt_size", "min_pkt_size", "max_pkt_size", "std_pkt_size"]: + if k in self.enabled: feat[k] = 0 + + if "avg_packets_per_flow" in self.enabled: + feat["avg_packets_per_flow"] = total_packets / total_flows if total_flows else 0 + if "avg_bytes_per_packet" in self.enabled: + feat["avg_bytes_per_packet"] = total_bytes / total_pkts + + if "proto_tcp_ratio" in self.enabled: feat["proto_tcp_ratio"] = proto_tcp / total_pkts + if "proto_udp_ratio" in self.enabled: feat["proto_udp_ratio"] = proto_udp / total_pkts + if "proto_icmp_ratio" in self.enabled: feat["proto_icmp_ratio"] = proto_icmp / total_pkts + + return feat + + +FEATURE_LIST = [ + "flow_count", + "total_packets", + "total_bytes", + "avg_bytes_per_flow", + "pkt_rate", + "byte_rate", + + "syn_count", + "fin_count", + "rst_count", + "ack_count", + "psh_count", + "urg_count", + "syn_ratio", + "fin_ratio", + "xmas_total", + "null_scan_total", + + "unique_dst_ports", + "unique_src_ports", + "port_entropy_dst", + "port_entropy_src", + + "avg_pkt_size", + "min_pkt_size", + "max_pkt_size", + "std_pkt_size", + + "avg_packets_per_flow", + "avg_bytes_per_packet", + "proto_tcp_ratio", + "proto_udp_ratio", + "proto_icmp_ratio", +] + + +def entropy(values): + if not values: + return 0.0 + + total = sum(values.values()) + if total == 0: + return 0.0 + + entropy_val = 0.0 + for count in values.values(): + p = count / total + entropy_val -= p * math.log2(p) + + return entropy_val diff --git a/src/streamml/front/__pycache__/detector_profiles_tab.cpython-312.pyc b/src/streamml/front/__pycache__/detector_profiles_tab.cpython-312.pyc Binary files differnew file mode 100644 index 0000000..3e3957b --- /dev/null +++ b/src/streamml/front/__pycache__/detector_profiles_tab.cpython-312.pyc diff --git a/src/streamml/front/__pycache__/detector_profiles_tab_pushscreens.cpython-312.pyc b/src/streamml/front/__pycache__/detector_profiles_tab_pushscreens.cpython-312.pyc Binary files differnew file mode 100644 index 0000000..d812190 --- /dev/null +++ b/src/streamml/front/__pycache__/detector_profiles_tab_pushscreens.cpython-312.pyc diff --git a/src/streamml/front/__pycache__/detector_tab.cpython-312.pyc b/src/streamml/front/__pycache__/detector_tab.cpython-312.pyc Binary files differnew file mode 100644 index 0000000..ea78d4d --- /dev/null +++ b/src/streamml/front/__pycache__/detector_tab.cpython-312.pyc diff --git a/src/streamml/front/__pycache__/detector_tab_pushscreens.cpython-312.pyc b/src/streamml/front/__pycache__/detector_tab_pushscreens.cpython-312.pyc Binary files differnew file mode 100644 index 0000000..798edff --- /dev/null +++ b/src/streamml/front/__pycache__/detector_tab_pushscreens.cpython-312.pyc diff --git a/src/streamml/front/__pycache__/options_tab.cpython-312.pyc b/src/streamml/front/__pycache__/options_tab.cpython-312.pyc Binary files differnew file mode 100644 index 0000000..a8a75aa --- /dev/null +++ b/src/streamml/front/__pycache__/options_tab.cpython-312.pyc diff --git a/src/streamml/front/detector_profiles_tab.py b/src/streamml/front/detector_profiles_tab.py new file mode 100644 index 0000000..7860e16 --- /dev/null +++ b/src/streamml/front/detector_profiles_tab.py @@ -0,0 +1,77 @@ +from textual import on +from textual.app import ComposeResult +from textual.widgets import Button, Label, Switch +from textual.containers import Vertical, Horizontal, VerticalScroll + +from ..back.detector_profiles_manager import DetectorProfilesManager +from .detector_profiles_tab_pushscreens import ConfirmDeletePushScreen, ShowLogsPushScreen, ShowProfilePushScreen, SetDetectorNotificationPushScreen + +class DetectorProfilesTab(Vertical): + def __init__(self, manager: DetectorProfilesManager, *args, **kwargs): + super().__init__(*args, **kwargs) + self.manager = manager + self.manager.on_refresh = self.refresh_profiles + self.manager.on_message = self.on_manager_message + + def compose(self) -> ComposeResult: + yield VerticalScroll(id="profiles-list") + + def on_mount(self) -> None: + self.refresh_profiles() + + def refresh_profiles(self) -> None: + profiles_list = self.query_one("#profiles-list", VerticalScroll) + profiles_list.remove_children() + + if not self.manager.profiles: + return + + for profile in self.manager.profiles: + row = Horizontal( + Switch(id=f"activate-profile-switch-{profile.profile_name}", value=profile.is_active), + Label(f"{profile.profile_name}", classes="profile-profile_name"), + Button("Show logs", id=f"show-logs-button-{profile.profile_name}", classes="profile-action", variant="primary"), + Button("Show Profile", id=f"show-profile-button-{profile.profile_name}", classes="profile-action", variant="default"), + Button("Notifications", id=f"set-notifications-button-{profile.profile_name}", classes="profile-action", variant="default"), + Button("Delete", id=f"delete-{profile.profile_name}", classes="profile-action button-delete", variant="error"), + classes="profile-row" + ) + profiles_list.mount(row) + + @on(Switch.Changed) + def any_switch_changed(self, event: Switch.Changed) -> None: + switch_id = event.switch.id + if not switch_id: + return + elif switch_id.startswith("activate-profile-switch"): + profile_name = switch_id.removeprefix("activate-profile-switch-") + + if event.switch.value: + is_turned_on = self.manager.turn_on_profile(profile_name) + if not is_turned_on: + event.switch.value = False + else: + is_turned_off = self.manager.turn_off_profile(profile_name) + if not is_turned_off: + event.switch.value = False + + @on(Button.Pressed) + def on_any_button_pressed(self, event: Button.Pressed) -> None: + button_id = event.button.id + if not button_id: + return + elif button_id.startswith("show-profile-button-"): + profile_name = button_id.removeprefix("show-profile-button-") + self.app.push_screen(ShowProfilePushScreen(self.manager, profile_name)) + elif button_id.startswith("set-notifications-button-"): + profile_name = button_id.removeprefix("set-notifications-button-") + self.app.push_screen(SetDetectorNotificationPushScreen(self.manager, profile_name)) + elif button_id.startswith("show-logs-button-"): + profile_name = button_id.removeprefix("show-logs-button-") + self.app.push_screen(ShowLogsPushScreen(self.manager, profile_name)) + elif button_id.startswith("delete-"): + profile_name = button_id.removeprefix("delete-") + self.app.push_screen(ConfirmDeletePushScreen(self.manager, profile_name)) + + def on_manager_message(self, msg: str, title: str, severity): + self.app.notify(message=msg, title=title, severity=severity) diff --git a/src/streamml/front/detector_profiles_tab_pushscreens.py b/src/streamml/front/detector_profiles_tab_pushscreens.py new file mode 100644 index 0000000..fc5b731 --- /dev/null +++ b/src/streamml/front/detector_profiles_tab_pushscreens.py @@ -0,0 +1,187 @@ +from textual import on +from textual.app import ComposeResult +from textual.screen import ModalScreen +from textual.widgets import Button, Label, Pretty, DataTable, Switch +from textual.containers import Vertical, Horizontal, VerticalScroll, Container +from textual_plotext import PlotextPlot + +from datetime import datetime + +from ..back.detector_profiles_manager import DetectorProfilesManager +from ..back.detector_profile_HST import DetectorProfileHST + +class PlotTab(Container): + def __init__(self, profile: DetectorProfileHST, *args, **kwargs): + super().__init__(*args, **kwargs) + self.profile = profile + self.classes = "plot-card" + + def compose(self): + yield PlotextPlot() + + def on_mount(self): + self.set_interval(1, self.update_plot) + + def update_plot(self): + plot_widget = self.query_one(PlotextPlot) + plt = plot_widget.plt + + y = list(getattr(self.profile, "plot_data", [])) + + plt.clear_figure() + plt.theme("dark") + + plt.plot(y, marker="dot", color="green") + plt.title("Anomaly Score") + plt.ylabel("last 30 windows") + plt.ylim(0, 1) + + threshold = self.profile.params.get("threshold", 0.7) + if threshold is not None: + plt.horizontal_line(float(threshold), color="red") + + + plot_widget.refresh() + + +class ShowProfilePushScreen(ModalScreen[str]): + def __init__(self, manager, profile_name: str, *args, **kwargs): + super().__init__(*args, **kwargs) + self.manager = manager + self.profile_name = profile_name + self.profile = self.manager.get_profile(profile_name) + + def compose(self) -> ComposeResult: + with Container(classes="modal-window large-modal"): + yield Label(f"Profile: {self.profile_name}", classes="modal-header") + + with Horizontal(classes="modal-split-container"): + + with Vertical(classes="left-panel"): + yield PlotTab(self.profile) + + with Vertical(classes="right-panel"): + yield Label("Runtime Stats (Live)", classes="section-header") + with VerticalScroll(classes="info-box", id="stats-box"): + yield Pretty({}, id="runtime-stats-pretty") + + yield Label("Configuration", classes="section-header") + with VerticalScroll(classes="info-box"): + yield Pretty(self.profile.to_dict()) + + with Container(classes="modal-footer"): + yield Button("Close", id="cancel-button", variant="primary") + + def on_mount(self): + self.set_interval(1.0, self.update_stats) + self.update_stats() + + def update_stats(self): + if self.profile: + stats = self.profile.get_runtime_stats() + self.query_one("#runtime-stats-pretty", Pretty).update(stats) + + @on(Button.Pressed) + async def on_button_pressed(self, event: Button.Pressed): + self.dismiss(None) + + +class ShowLogsPushScreen(ModalScreen[str]): + def __init__(self, manager: DetectorProfilesManager, profile_name: str, *args, **kwargs): + super().__init__(*args, **kwargs) + self.manager = manager + self.profile_name = profile_name + + def compose(self) -> ComposeResult: + with Container(classes="modal-window medium-modal"): + yield Label(f"Anomaly Logs: {self.profile_name}", classes="modal-header") + + with Container(classes="table-container"): + yield DataTable(id="logs_table", zebra_stripes=True, cursor_type="row") + + with Horizontal(classes="modal-footer"): + yield Button("Clear History", id="clear-button", variant="warning") + yield Button("Close", id="cancel-button", variant="primary") + + + def on_mount(self): + table = self.query_one("#logs_table", DataTable) + table.add_columns("Timestamp", "Score", "Packets Rate", "Protocol Info", "Verdict") + + logs = self.manager.get_profile_logs(self.profile_name) + + if not logs: + return + + sorted_logs = sorted(logs, key=lambda x: x.get("ts", 0), reverse=True) + + for log in sorted_logs: + dt = datetime.fromtimestamp(log.get("ts", 0)).strftime("%Y-%m-%d %H:%M:%S") + + score = f"{log.get('score', 0):.4f}" + rate = f"{log.get('pkt_rate', 0):.1f}" + proto = str(log.get("proto_info", "-")) + verdict = "ANOMALY" + + table.add_row(dt, score, rate, proto, verdict) + + @on(Button.Pressed) + async def on_button_pressed(self, event: Button.Pressed) -> None: + if event.button.id == "clear-button": + profile = self.manager.get_profile(self.profile_name) + if profile: + profile.clear_logs() + self.query_one("#logs_table", DataTable).clear() + else: + self.dismiss(None) + +class SetDetectorNotificationPushScreen(ModalScreen[str]): + def __init__(self, manager, profile_name: str, *args, **kwargs): + super().__init__(*args, **kwargs) + self.manager = manager + self.profile_name = profile_name + self.profile = self.manager.get_profile(profile_name) + + def compose(self) -> ComposeResult: + current_val = getattr(self.profile, 'notify_enabled', False) + + with Container(classes="modal-window small-modal"): + yield Label(f"Notification: {self.profile_name}", classes="modal-header") + + with Vertical(classes="section-card"): + yield Label("Enable notification (Discord)") + yield Switch(value=current_val, id="switch-anomaly") + + with Horizontal(classes="modal-footer"): + yield Button("Close", id="close-button", variant="primary") + + @on(Switch.Changed) + def on_switch_changed(self, event: Switch.Changed): + if event.switch.id == "switch-anomaly": + self.profile.notify_enabled = event.value + self.manager.try_save_profiles(notify=False) + + @on(Button.Pressed) + async def on_button_pressed(self, event: Button.Pressed): + self.dismiss(None) + +class ConfirmDeletePushScreen(ModalScreen[str]): + def __init__(self, manager: DetectorProfilesManager, profile_name:str, *args, **kwargs): + super().__init__(*args, **kwargs) + self.manager = manager + self.profile_name = profile_name + + def compose(self) -> ComposeResult: + with Container(classes="modal-window small-modal"): + yield Label("Are you sure?",classes="modal-header") + with Horizontal(classes="modal-footer"): + yield Button("Delete", id="confirm-button", variant="error") + yield Button("Cancel", id="cancel-button", variant="default") + + @on(Button.Pressed) + async def on_button_pressed(self, event: Button.Pressed): + if event.button.id == "confirm-button": + self.manager.delete_profile(self.profile_name) + self.dismiss(None) + else: + self.dismiss(None) diff --git a/src/streamml/front/detector_tab.py b/src/streamml/front/detector_tab.py new file mode 100644 index 0000000..f93a8cb --- /dev/null +++ b/src/streamml/front/detector_tab.py @@ -0,0 +1,135 @@ +from textual import on +from textual.app import ComposeResult +from textual.widgets import Input, Select, Button, Label, Checkbox +from textual.containers import Container, Horizontal, VerticalScroll + +import psutil + +from ..back.detector_profiles_manager import DetectorProfilesManager +from ..back.window import FEATURE_LIST +from ..front.detector_tab_pushscreens import SaveProfilePushScreen + +class DetectorTab(Container): + def __init__(self, manager: DetectorProfilesManager, *args, **kwargs): + super().__init__(*args, **kwargs) + self.manager = manager + self.manager.on_message = self.on_manager_message + + def compose(self) -> ComposeResult: + with Horizontal(id="top-config-container"): + + model_section = Container(id="model-section", classes="section-card") + model_section.border_title = "Algorithm: HalfSpaceTrees" + with model_section: + with VerticalScroll(classes="detector-scroll"): + yield Label("Select interface:", classes="label") + try: + ifaces = list(psutil.net_if_addrs().keys()) + except: + ifaces = [] + + yield Select.from_values( + ifaces, + id="interface-select", + allow_blank=False, + classes="input" + ) + + yield Label("Model params:", classes="label") + yield Input(placeholder="Trees number (int, def: 10)", id="param-trees", classes="input") + yield Input(placeholder="Height (int, def: 8)", id="param-height", classes="input") + yield Input(placeholder="Window size (int, def: 250)", id="param-window", classes="input") + yield Input(placeholder="Seed (int, def: 42)", id="param-seed", classes="input") + yield Input(placeholder="Window duration (def: 10 sec )", id="param-window_duration", classes="input") + yield Input(placeholder="Threshold (0.0 - 1.0, def: 0.7)", id="param-threshold", classes="input") + yield Input(placeholder="Queue size (int, def: 10000)", id="param-queue_size", classes="input") + + features_section = Container(id="features-section", classes="section-card") + features_section.border_title = "Flow-based Features" + with features_section: + with VerticalScroll(classes="detector-scroll"): + yield Label("Select features to include in model:", classes="label") + self.feature_checkboxes = {} + for feat in FEATURE_LIST: + cb = Checkbox(feat, value=True, classes="input") + self.feature_checkboxes[feat] = cb + yield cb + + bpf_section = Container(id="bpf-section", classes="section-card") + bpf_section.border_title = "BPF Filter (Optional)" + with bpf_section: + yield Input( + placeholder="BPF Filter (e.g. 'tcp port 80 or udp')", + id="param-bpf_filter", + classes="input full" + ) + with Container(classes="save-button-container"): + yield Button("Save Profile", id="save-button", variant="success") + + def get_inputs(self): + features = [f for f, cb in self.feature_checkboxes.items() if cb.value] + + if not features: + raise ValueError("Select at least one feature.") + + params = {} + + try: + interface = self.query_one("#interface-select", Select).value + if not interface: + raise ValueError("Select interface.") + params["interface"] = interface + except Exception: + raise ValueError("Interface selection error.") + + bpf_input = self.query_one("#param-bpf_filter", Input) + if bpf_input.value.strip(): + params["bpf_filter"] = bpf_input.value.strip() + + defaults = { + "trees": 10, + "height": 8, + "window": 250, + "seed": 42, + "threshold": 0.7, + "window_duration": 10.0, + "queue_size": 10000, + "bpf_filter": "" + } + + model_section = self.query_one("#model-section") + for inp in model_section.query("Input"): + if inp.id and inp.id.startswith("param-"): + key = inp.id.removeprefix("param-") + if key == "bpf_filter": continue + + val_str = inp.value.strip() + + if not val_str: + if key in defaults and defaults[key] is not None: + params[key] = defaults[key] + continue + + try: + if key in ["trees", "height", "window", "seed","queue_size"]: + params[key] = int(val_str) + elif key in ["threshold", "window_duration"]: + params[key] = float(val_str) + except ValueError: + raise ValueError(f"Param '{key}' must be a number.") + + return { + "features": features, + "params": params, + } + + @on(Button.Pressed, "#save-button") + async def handle_save_button(self, event: Button.Pressed): + try: + input_data = self.get_inputs() + self.app.push_screen(SaveProfilePushScreen(self.manager, input_data=input_data)) + except ValueError as e: + self.app.notify(str(e), title="Validation error", severity="error") + + def on_manager_message(self, msg: str, title: str, severity): + self.app.notify(message=msg, title=title, severity=severity) diff --git a/src/streamml/front/detector_tab_pushscreens.py b/src/streamml/front/detector_tab_pushscreens.py new file mode 100644 index 0000000..625921b --- /dev/null +++ b/src/streamml/front/detector_tab_pushscreens.py @@ -0,0 +1,31 @@ +from textual.app import ComposeResult +from textual.widgets import Input, Label, Button +from textual.containers import Vertical, Horizontal +from textual.screen import ModalScreen +from textual import on + +from ..back.detector_profiles_manager import DetectorProfilesManager + +class SaveProfilePushScreen(ModalScreen[str]): + def __init__(self, manager: DetectorProfilesManager, input_data , *args, **kwargs): + super().__init__(*args, **kwargs) + self.manager = manager + self.input_data = input_data + + + def compose(self) -> ComposeResult: + with Vertical(classes="modal-window small-modal"): + yield Label("Save scan profile", classes="modal-header") + yield Input(placeholder="Profile name:", id="profile-name", classes="input") + with Horizontal(id="buttons-row", classes="modal-buttons modal-footer"): + yield Button("Confirm", id="confirm-button", variant="success", classes="button") + yield Button("Cancel", id="cancel-button", variant="error", classes="button") + + @on(Button.Pressed) + async def on_button_pressed(self, event: Button.Pressed): + if event.button.id == "confirm-button": + profile_name = self.query_one("#profile-name", Input).value.strip() + self.manager.add_profile(profile_name,self.input_data) + self.dismiss(None) + else: + self.dismiss(None) diff --git a/src/streamml/front/options_tab.py b/src/streamml/front/options_tab.py new file mode 100644 index 0000000..22bd43a --- /dev/null +++ b/src/streamml/front/options_tab.py @@ -0,0 +1,43 @@ +from textual.app import ComposeResult +from textual.containers import Container, Horizontal +from textual.widgets import Button, Input, Label +from textual import on + +from ..back.notification_service import notification_service + +class OptionsTab(Container): + def __init__(self, detector_manager, *args, **kwargs): + super().__init__(*args, **kwargs) + self.detector_manager = detector_manager + + def compose(self) -> ComposeResult: + notify_section = Container(id="notify-section", classes="section-card") + notify_section.border_title = "Notification config" + with notify_section: + yield Label("Discord Webhook URL:") + yield Input(placeholder="https://discord.com/api/webhooks/...", id="input-webhook-url") + + with Horizontal(classes="modal-footer"): + yield Button("Save config", id="save-config", variant="success") + yield Button("notification test", id="test-notif", variant="primary") + + def on_mount(self): + self.query_one("#input-webhook-url", Input).value = notification_service.webhook_url + + @on(Button.Pressed, "#save-config") + def save_configuration(self): + url = self.query_one("#input-webhook-url", Input).value.strip() + + if notification_service.save_config(url): + self.app.notify("Config saved", severity="information") + else: + self.app.notify("Error during saving", severity="error") + + @on(Button.Pressed, "#test-notif") + def test_notification(self): + success = notification_service.send_message("**Test NetMonitor**\n") + + if success: + self.app.notify("good", severity="information") + else: + self.app.notify("bad", severity="error") diff --git a/src/streamml/styles/styles.css b/src/streamml/styles/styles.css new file mode 100644 index 0000000..25eda16 --- /dev/null +++ b/src/streamml/styles/styles.css @@ -0,0 +1,157 @@ +DetectorTab Button { + content-align: center middle; +} + +DetectorTab Checkbox { + width: 100%; +} + +.save-button-container { + align: center middle; + height: auto; + margin-top: 1; + width: 100%; +} + +.profile-row { + layout: horizontal; + align-vertical: middle; + height: auto; + min-height: 3; + + background: $surface; + border-left: solid $primary; + margin-bottom: 1; + padding: 1; +} + +.profile-row:hover { + background: $surface-lighten-1; + border-left: solid $accent; +} + +.profile-profile_name { + width: 2fr; + text-style: bold; + color: $text; + padding: 1; + content-align: center middle; +} + +.section-card { + padding: 1; + border: round $primary; + height: auto; +} + +.detector-scroll { + scrollbar-color: $primary ; + scrollbar-background: $background; + scrollbar-size-horizontal: 1; +} + + +ModalScreen { + align: center middle; + +} + +.modal-window { + background: $surface; + border: tall $primary; + padding: 1 2; + layout: vertical; +} + +.small-modal { + width: 50; + height: auto; +} + +.medium-modal { + width: 80; + height: 80%; +} + +.large-modal { + width: 95%; + height: 95%; +} + +.modal-header { + width: 100%; + text-align: center; + text-style: bold; + color: $accent; + border-bottom: solid $secondary; + padding-bottom: 1; + margin-bottom: 1; +} + +.modal-footer { + height: auto; + width: 100%; + align: center middle; + padding-top: 1; + dock: bottom; +} + +.modal-footer Button { + margin: 0 1; + min-width: 15; +} + +.modal-split-container { + width: 100%; + height: 1fr; +} + +.left-panel { + width: 65%; + height: 100%; + margin-right: 1; +} + +.right-panel { + width: 35%; + height: 100%; + border-left: solid $secondary; + padding-left: 1; +} + +.plot-card { + height: 1fr; + border: none; + margin-bottom: 1; + background: $surface-lighten-1; +} + +.section-header { + text-align: center; + color: $text-muted; + margin-bottom: 1; +} + +.info-box { + width: 100%; + height: 1fr; + border: tall $surface-lighten-2; + background: $surface-darken-1; + padding: 1; + overflow: auto; + scrollbar-color: $primary ; + scrollbar-background: $background; + scrollbar-size-horizontal: 1; +} + +.table-container { + width: 100%; + height: 1fr; + border: solid $secondary; +} + + +.label-muted { + color: $text-muted; + text-align: center; +} |