No image

[chriskarydis]

Describe the bug

When i run the command :
chris@chris-VMware-Virtual-Platform:~/Downloads/heiFIP/heiFIP/build$ ./heiFIP -i ~/Desktop/thesis/pcaps/Monday-WorkingHours.pcap -o ~/Desktop/thesis/output/benign_data -t $(nproc) -p NONE -m PacketImage --dim 16 --fill 0

I get the response :
[!] Empty image, cannot save: /home/chris/Desktop/thesis/output/benign_data/heiFIPGeneratedImage

Also when i run the command :
./heiFIP --input ~/Desktop/thesis/pcaps/Friday-WorkingHours.pcap --output ~/Desktop/thesis/output/malicious_flows --threads $(nproc) --processor HEADER --mode PacketImage --dim 16 --min-pkts 3 --max-pkts 100

The command succeeds but the only thing i took as output is only one image and the pcap i have give as an input is 11GB with a lot of packets.

Steps to reproduce

Download these pcaps (https://www.unb.ca//cic/datasets/ids-2017.html) and run the usual commands.

Expected behavior

When I run either the one or the other command I expect a lot of images to be prodused. At PacketImage mode I expect if the pcap file has 1000 packets to produse 1000 images. Also for the FlowImage mode I expect a lot of images to be prodused and not only one.

Environment

• OS: Ubuntu 64 bit in VMware and also in WSL at ubuntu terminal in windows.
• I have 16gb ram, 4gb geforce rtx and 500gb free space so i think my computer specs is not the problem

[chriskarydis]

I would appreciate it if you help me with the issue as i try to make a project based on this tool and i have been stack in the process of converting packets and flows to images. Thank you very much in advance.

[stefanDeveloper]

Thanks for your issue, I'll investigate it.

Did you create the folder /home/chris/Desktop/thesis/output/benign_data/heiFIPGeneratedImage ? Maybe there are some permission issues. So far, we have only tested it on Ubuntu / Debian (non WSL).

[stefanDeveloper]

I found the issue, I will create a pull request soon to fix it.

[stefanDeveloper]

If possible, please try the fix and test it.

[chriskarydis]

i will check it. But no i had not create the folder /home/chris/Desktop/thesis/output/benign_data/heiFIPGeneratedImage. heiFIPGeneratedImage was the name of the one image which was produced.

Checking it also i modified the save_image function in extractor.cpp with the following:

void save_image(const UInt8Matrix& img, const std::string& output_path) {
    if (img.empty()) {
        std::cerr << "[!] Empty image, cannot save: " << output_path << "\n";
        return;
    }

    for (size_t idx = 0; idx < img.size(); ++idx) {
        if (img[idx].empty() || img[idx][0].empty()) continue;

        const auto& grayscale_image = img[idx];
        int height = static_cast<int>(grayscale_image.size());
        int width  = static_cast<int>(grayscale_image[0].size());

        cv::Mat mat(height, width, CV_8UC1);
        for (int i = 0; i < height; ++i) {
            uint8_t* row_ptr = mat.ptr<uint8_t>(i);
            for (int j = 0; j < width; ++j) {
                row_ptr[j] = grayscale_image[i][j];
            }
        }

        std::string numbered_path = output_path + "_" + std::to_string(idx);
        std::filesystem::path outp(numbered_path + ".png");
        std::filesystem::create_directories(outp.parent_path());
        cv::imwrite(outp.string(), mat);
    }
}

After this the result is one image per packet of tha pcap is given.
But i check also yours solution.

[chriskarydis]

i did try your changes together with mine change in the save_image funtion and now it is work as inteded, 1 pcap with 1000 packets produces 1000 images (not only the first image as before).

[stefanDeveloper]

Great, thanks for your feedback. Indeed, I already debugged the issue and could verify that --max-pkts defaulted to 0 which was being passed blindly to init.cpp. Inside init.cpp's verify loop, it expected 0 to mean 0 packets to read, completely aborting packet processing before even looking at the pcap file.

[stefanDeveloper]

In addition, I also updated the build process with vcpkg in #8 . Building procedure was very tedious, vcpkg makes the dependency management cleaner.