|
| 1 | +Module ctfsolver.forensics.manager_dash |
| 2 | +======================================= |
| 3 | +manager_dash.py |
| 4 | + |
| 5 | +Dash-based visualization manager for network packet flows. |
| 6 | + |
| 7 | +This module provides the ManagerDash class, which facilitates the conversion of network packet data (such as from pcap files using scapy) |
| 8 | +into a format suitable for interactive graph visualization using Dash and Cytoscape. It includes utilities for converting packets to graph elements, |
| 9 | +validating element structure, generating example graphs, and running a Dash web application for visual exploration of network flows. |
| 10 | + |
| 11 | +Classes: |
| 12 | + ManagerDash: Manages the conversion of packet data to Cytoscape elements and sets up the Dash visualization interface. |
| 13 | + |
| 14 | +Typical Usage Example: |
| 15 | + manager.elements = manager.example_element_creator() |
| 16 | + |
| 17 | +Dependencies: |
| 18 | + - dash |
| 19 | + - dash_cytoscape |
| 20 | + - scapy |
| 21 | + |
| 22 | +Classes |
| 23 | +------- |
| 24 | + |
| 25 | +`ManagerDash(*args, **kwargs)` |
| 26 | +: ManagerDash provides functionality for converting network packet data into elements suitable for graph visualization, |
| 27 | + validating element structure, and displaying interactive network graphs using Dash and Cytoscape. |
| 28 | + |
| 29 | + Attributes: |
| 30 | + elements (list[dict]): List of elements representing nodes and edges for visualization. |
| 31 | + title (str): Title of the Dash application. |
| 32 | + app: dash.Dash | None # Dash application instance |
| 33 | + |
| 34 | + |
| 35 | + Methods: |
| 36 | + pcap_to_element_converter(packets, save=False): |
| 37 | + Converts a list of scapy Packet objects into visualization elements (nodes and edges) based on IP layer data. |
| 38 | + |
| 39 | + pcap_to_element_converter_timestamp(packets, save=False): |
| 40 | + Converts packets into elements including timestamp nodes, representing temporal flow in the network graph. |
| 41 | + |
| 42 | + elements_checker(elements): |
| 43 | + Validates the structure and content of a list of element dictionaries for compatibility with Cytoscape. |
| 44 | + |
| 45 | + example_element_creator(): |
| 46 | + Generates a sample list of elements representing a simple network graph for demonstration purposes. |
| 47 | + |
| 48 | + setup_dash(): |
| 49 | + Initializes and configures the Dash application layout and callbacks. |
| 50 | + |
| 51 | + setup_dash_layout(): |
| 52 | + Defines the layout of the Dash application, including the Cytoscape graph and output display. |
| 53 | + |
| 54 | + setup_dash_functions(): |
| 55 | + Sets up Dash callback functions for interactive node information display. |
| 56 | + |
| 57 | + run_dash(): |
| 58 | + Validates elements and runs the Dash application for interactive network graph visualization. |
| 59 | + |
| 60 | + Initializes the manager_dash instance. |
| 61 | + |
| 62 | + Args: |
| 63 | + *args: Variable length argument list. |
| 64 | + **kwargs: Arbitrary keyword arguments. |
| 65 | + title (str, optional): The title for the network graph. Defaults to "Interactive Network Graph". |
| 66 | + |
| 67 | + Attributes: |
| 68 | + elements (list): Stores elements related to the manager dashboard. |
| 69 | + title (str): Title of the interactive network graph. |
| 70 | + |
| 71 | + ### Methods |
| 72 | + |
| 73 | + `elements_checker(self, elements: list[dict]) ‑> bool` |
| 74 | + : Description: |
| 75 | + Validates a list of dictionaries to ensure they meet specific structural and content requirements. |
| 76 | + Each dictionary in the list must contain a "data" key with a dictionary value, and the keys within |
| 77 | + the "data" dictionary must adhere to a predefined set of allowed keys. Additionally, certain key |
| 78 | + combinations are required to be present together. |
| 79 | + Args: |
| 80 | + elements (list[dict]): A list of dictionaries to validate. Each dictionary is expected to have |
| 81 | + a "data" key containing another dictionary. |
| 82 | + Returns: |
| 83 | + bool: Returns True if all dictionaries in the list meet the validation criteria, otherwise False. |
| 84 | + |
| 85 | + `example_element_creator(self)` |
| 86 | + : Generates a list of elements representing a network graph in a format compatible with Cytoscape. |
| 87 | + Description: |
| 88 | + This method creates a representation of a network graph based on predefined data. |
| 89 | + Each node (IP address) and edge (connection between IPs) is converted into a dictionary |
| 90 | + format suitable for use with Cytoscape visualizations. |
| 91 | + Args: |
| 92 | + None |
| 93 | + Returns: |
| 94 | + list: A list of dictionaries where each dictionary represents a node or an edge in the graph. |
| 95 | + Example output: |
| 96 | + [ |
| 97 | + {"data": {"id": "192.168.0.2", "label": "192.168.0.2"}}, |
| 98 | + {"data": {"id": "8.8.8.8", "label": "8.8.8.8"}}, |
| 99 | + {"data": {"source": "192.168.0.2", "target": "8.8.8.8"}}, |
| 100 | + {"data": {"id": "192.168.0.3", "label": "192.168.0.3"}}, |
| 101 | + {"data": {"source": "192.168.0.2", "target": "192.168.0.3"}}, |
| 102 | + {"data": {"id": "10.0.0.1", "label": "10.0.0.1"}}, |
| 103 | + {"data": {"source": "192.168.0.3", "target": "10.0.0.1"}} |
| 104 | + ] |
| 105 | + |
| 106 | + `pcap_to_element_converter(self, packets: list[scapy.packet.Packet], save: bool = False) ‑> list[dict]` |
| 107 | + : Converts a list of scapy Packet objects into a list of elements suitable for visualization, |
| 108 | + extracting source and destination IPs and protocol information. |
| 109 | + |
| 110 | + Each packet with an IP layer contributes: |
| 111 | + - Two node elements (for source and destination IPs) |
| 112 | + - One edge element (representing the connection and protocol between source and destination) |
| 113 | + |
| 114 | + Args: |
| 115 | + packets (list[scapy.packet.Packet]): List of scapy Packet objects to process. |
| 116 | + save (bool, optional): If True, returns the generated elements list. If False, assigns it to self.elements. |
| 117 | + |
| 118 | + Returns: |
| 119 | + list[dict]: List of elements representing nodes and edges if save is True; otherwise, None. |
| 120 | + |
| 121 | + `pcap_to_element_converter_timestamp(self, packets: list[scapy.packet.Packet], save: bool = False) ‑> list[dict]` |
| 122 | + : Description: |
| 123 | + Converts a list of scapy Packet objects from a pcap file into a list of elements suitable for graph visualization. |
| 124 | + Each packet's timestamp, source IP, destination IP, and protocol are extracted and represented as nodes and edges. |
| 125 | + Optionally saves the generated elements to the instance. |
| 126 | + |
| 127 | + Args: |
| 128 | + packets (list[scapy.packet.Packet]): List of scapy Packet objects to convert. |
| 129 | + save (bool, optional): If True, returns the elements list; otherwise, assigns it to self.elements. Defaults to False. |
| 130 | + |
| 131 | + Raises: |
| 132 | + AttributeError: If a packet does not have the expected IP layer attributes. |
| 133 | + |
| 134 | + Returns: |
| 135 | + list[dict]: List of dictionaries representing nodes and edges for visualization (only if save=True). |
| 136 | + |
| 137 | + Example: |
| 138 | + elements = pcap_to_element_converter_timestamp(packets, save=True) |
| 139 | + |
| 140 | + `run_dash(self)` |
| 141 | + : Runs the Dash application after validating and setting up required elements. |
| 142 | + This method performs the following steps: |
| 143 | + 1. Checks if `self.elements` is not None or empty. |
| 144 | + 2. Validates the format of `self.elements` using `self.elements_checker`. |
| 145 | + 3. Sets up the Dash application by calling `self.setup_dash`. |
| 146 | + 4. Runs the Dash app with debugging enabled. |
| 147 | + Raises: |
| 148 | + ValueError: If `self.elements` is None or empty. |
| 149 | + ValueError: If `self.elements` does not pass the format check. |
| 150 | + |
| 151 | + `setup_dash(self)` |
| 152 | + : Initializes and configures the Dash application. |
| 153 | + |
| 154 | + This method creates a Dash app instance, sets its title, |
| 155 | + and sets up the layout and callback functions required for the dashboard. |
| 156 | + |
| 157 | + Args: |
| 158 | + None |
| 159 | + |
| 160 | + Returns: |
| 161 | + None |
| 162 | + |
| 163 | + `setup_dash_functions(self)` |
| 164 | + : Sets up Dash callback functions for interactive components in the dashboard. |
| 165 | + This method registers a callback for the Cytoscape graph component to handle node click events. |
| 166 | + When a node is clicked, its information is displayed in the designated output component. |
| 167 | + Callback: |
| 168 | + - Output: Updates the "node-click-output" component's children with node information. |
| 169 | + - Input: Listens for "tapNodeData" events from the "cytoscape-graph" component. |
| 170 | + Returns: |
| 171 | + None |
| 172 | + |
| 173 | + `setup_dash_layout(self)` |
| 174 | + : Sets up the Dash application layout for packet flow visualization. |
| 175 | + This method configures the main layout of the Dash app, including: |
| 176 | + - A header displaying "Packet Flow Visualization". |
| 177 | + - A Cytoscape graph for visualizing packet flows, with nodes and edges styled for clarity. |
| 178 | + - An output div for displaying information when a node is clicked. |
| 179 | + The layout uses a force-directed graph ("cose" layout) and applies custom styles for nodes, edges, and background. |
| 180 | + Returns: |
| 181 | + None |
0 commit comments