|
|
||
|---|---|---|
| .. | ||
| c-analysed | ||
| c-captured | ||
| c-collectd | ||
| c-influxd | ||
| c-notifyd | ||
| c-simple | ||
| cxx-graph@68eb1b105d | ||
| js-rt-analyzer@87cb7a0af5 | ||
| js-rt-analyzer-frontend@6806ef7d13 | ||
| py-flow-info | ||
| py-flow-muliprocess | ||
| py-json-stdout | ||
| py-machine-learning | ||
| py-schema-validation | ||
| py-semantic-validation | ||
| rs-simple | ||
| yaml-filebeat | ||
| ndpid_grafana_example.png | ||
| ndpid_install_and_run.gif | ||
| README.md | ||
examples
Some ready-2-use/ready-2-extend examples/utils. All examples are prefixed with their used LANG.
c-analysed
A feature extractor useful for ML/DL use cases.
It generates CSV files from flow "analyse" events.
Used also by tests/run_tests.sh if available.
c-captured
A capture daemon suitable for low-resource devices.
It saves flows that were guessed/undetected/risky/midstream to a PCAP file for manual analysis.
Used also by tests/run_tests.sh if available.
c-collectd
A collecd-exec compatible middleware that gathers statistic values from nDPId.
Used also by tests/run_tests.sh if available.
c-influxd
An InfluxDB push daemon. It aggregates various statistics gathered from nDPId. The results are sent to a specified InfluxDB endpoint.
c-notifyd
A notification daemon that sends information about suspicious flow events to DBUS.
c-simple
Integration example that verifies flow timeouts on SIGUSR1.
cxx-graph
A standalone GLFW/OpenGL application that draws statistical data using ImWeb/ImPlot/ImGui.
js-rt-analyzer
js-rt-analyzer-frontend
py-flow-info
Console friendly, colorful, prettyfied event printer.
Required by tests/run_tests.sh
py-machine-learning
Contains:
- Classification via Random Forests and SciLearn
- Anomaly Detection via Autoencoder and Keras (Work-In-Progress!)
Use sklearn together with CSVs created with c-analysed to train and predict DPI detections.
Try it with: ./examples/py-machine-learning/sklearn_random_forest.py --csv ./ndpi-analysed.csv --proto-class tls.youtube --proto-class tls.github --proto-class tls.spotify --proto-class tls.facebook --proto-class tls.instagram --proto-class tls.doh_dot --proto-class quic --proto-class icmp
This way you should get 9 different classification classes. You may notice that some classes e.g. TLS protocol classifications have a higher false-negative/false-positive rate. Unfortunately, I can not provide any datasets due to some privacy concerns.
But you may use a pre-trained model with --load-model.
py-flow-multiprocess
Simple Python Multiprocess example spawning two worker processes, one connecting to nDPIsrvd and one printing flow id's to STDOUT.
py-json-stdout
Dump received and parsed JSON objects.
py-schema-validation
Validate nDPId JSON messages against pre-defined JSON schema's.
See schema/.
Required by tests/run_tests.sh
py-semantic-validation
Validate nDPId JSON messages against internal event semantics.
Required by tests/run_tests.sh
rs-simple
A straight forward Rust deserialization/parsing example.
yaml-filebeat
An example filebeat configuration to parse and send nDPId JSON messages to Elasticsearch. Allowing long term storage and data visualization with kibana and various other tools that interact with Elasticsearch (No logstash required).