parameters: (self, pkt)
docstring: Classify DDoS attacks into the following:
              - SISP (Single IP Single Port)
              - SIMP (Single IP Multiple Port)
              - MISP (Multiple IP Single Port)
              - MIMP (Multiple IP Multiple Port)
  
          Args:
              pkt (scapy_object): Packet to dissect and observe
  
          Raises:
              None
  
          Returns:
              None
docstring_summary: Classify DDoS attacks into the following:
              - SISP (Single IP Single Port)
              - SIMP (Single IP Multiple Port)
              - MISP (Multiple IP Single Port)
              - MIMP (Multiple IP Multiple Port)
docstring_tokens: Classify DDoS attacks into the following : - SISP ( Single IP Single Port ) - SIMP ( Single IP Multiple Port ) - MISP ( Multiple IP Single Port ) - MIMP ( Multiple IP Multiple Port )
function: def classify_ddos(self, pkt):
          """
          Classify DDoS attacks into the following:
              - SISP (Single IP Single Port)
              - SIMP (Single IP Multiple Port)
              - MISP (Multiple IP Single Port)
              - MIMP (Multiple IP Multiple Port)
  
          Args:
              pkt (scapy_object): Packet to dissect and observe
  
          Raises:
              None
  
          Returns:
              None
          """
          if (pkt.haslayer(scapy.IP) and
              pkt.haslayer(scapy.TCP)):
              src_ip = pkt[scapy.IP].src
              dst_port = pkt[scapy.TCP].dport
  
              if self.sisp.get(src_ip) is None:
                  # Packet from a new IP address
                  self.sisp[src_ip] = {
                      "count": 1,
                      "ports": [dst_port],
                      "start_time": int(time.time())
                  }
              else:
                  # Increment count
                  current_count = self.sisp[src_ip]["count"]
                  self.sisp[src_ip]["count"] = current_count + 1
  
                  if (dst_port not in \
                      self.sisp[src_ip]["ports"]):
                      self.sisp[src_ip]["ports"].append(dst_port)
                      # Move to simp dict
                      self.simp[src_ip] = self.sisp[src_ip]
                      del self.sisp[src_ip]
  
          # Detect intrusion
          self.detect_sisp()
          self.detect_simp()
          self.detect_misp()
          self.detect_mimp()
function_tokens: def classify_ddos ( self , pkt ) : if ( pkt . haslayer ( scapy . IP ) and pkt . haslayer ( scapy . TCP ) ) : src_ip = pkt [ scapy . IP ] . src dst_port = pkt [ scapy . TCP ] . dport if self . sisp . get ( src_ip ) is None : # Packet from a new IP address self . sisp [ src_ip ] = { "count" : 1 , "ports" : [ dst_port ] , "start_time" : int ( time . time ( ) ) } else : # Increment count current_count = self . sisp [ src_ip ] [ "count" ] self . sisp [ src_ip ] [ "count" ] = current_count + 1 if ( dst_port not in self . sisp [ src_ip ] [ "ports" ] ) : self . sisp [ src_ip ] [ "ports" ] . append ( dst_port ) # Move to simp dict self . simp [ src_ip ] = self . sisp [ src_ip ] del self . sisp [ src_ip ] # Detect intrusion self . detect_sisp ( ) self . detect_simp ( ) self . detect_misp ( ) self . detect_mimp ( )