# Network Packet Classifier
Network Packets Classifier as a part of master's thesis is an application of a system that uses tensorflow neural network models for classification of network traffic.

It uses tshark to capture packets on a selected interface and extracts data needed for classification from each packet.
The predictions are written to the database from which the necessary model data is also retrieved.
The application also includes the minor feature of using SNMP to identify known devices on the network and storing the collected data to the database.
The GUI of the application is written specifically for the function of protocol recognition, but if you don't mind the misleading namings, you can use it, like the rest of the code, for any type of classification.


## Requirements
- [Python 3.9](https://www.python.org/downloads/)
- [tshark](https://tshark.dev/setup/install/) (it's also part of [Wireshark](https://www.wireshark.org/download.html))
- [tensorflow](https://www.tensorflow.org/install/) suitable for your device (for intel-tensorflow optimized for Intel CPUs you can use: `pip3 install intel-tensorflow`)
- packages in `requirements.txt` (you can use: `pip3 install -r requirements.txt`)

## Configuration
In `config.json` you can find:
- packets_count - the number of packets models use for prediction
- predict_timeout - specifies the minimum time that must elapse between predictions of same connection
- recycle_period - the period with which the process of old packets removal is triggered; it also specifies the minimum time that must elapse since the last assignment of packet to the connection in order for the packets of the connection to be removed
- path_to_database - the relative/absolute path to the database
- entities_table_name - the name of the models table in the database (the default name is "app_protocols")
- import_pcap_max_bulk_size - maximum size of bulk predictions when importing a PCAP file (0 = unlimited)

## Usage 
- configure the applciation in `config.json`
- run `main.py`: `python3 main.py`

## Repository contents
- `export/` - sample CSV files with exported database tables
- `models/` - protocol models mentioned in the thesis
- `config.json` - application configuration file
- `main.py` - script to run the application
- `NPC_database.db` - SQLite3 database file with sample data
- `README.md` - this README
- `requirements.txt` - Python requirements file
- other `*.py` - just everything application needs to run
