path: root/GetSignature_2402.py

#!/usr/bin/evn python
# -*- coding:utf-8 -*-

from datetime import datetime
import subprocess
import codecs
import binascii
from cryptography import x509
from cryptography.hazmat.backends import default_backend

# algorithm_identifier and algorithm_id mapping relationship dictionary
algorithm_identifier_dict = {
    "1.3.14.3.2.2" : "md4WithRSA",
	"1.3.14.3.2.3" : "md5WithRSA",
	"1.3.14.3.2.4" : "md4WithRSAEncryption",
	"1.3.14.3.2.6" : "desECB",
	"1.3.14.3.2.11" : "rsaSignature",
	"1.3.14.3.2.14" : "mdc2WithRSASignature",
	"1.3.14.3.2.15" : "shaWithRSASignature",
	"1.3.14.3.2.16" : "dhWithCommonModulus",
	"1.3.14.3.2.17" : "desEDE",
	"1.3.14.3.2.18" : "sha",
	"1.3.14.3.2.19" : "mdc-2",
	"1.3.14.3.2.20" : "dsaCommon",
	"1.3.14.3.2.21" : "dsaCommonWithSHA",
	"1.3.14.3.2.22" : "rsaKeyTransport",
	"1.3.14.3.2.23" : "keyed-hash-seal",
	"1.3.14.3.2.24" : "md2WithRSASignature",
	"1.3.14.3.2.25" : "md5WithRSASignature",
	"1.3.14.3.2.26" : "SHA-1",
	"1.3.14.3.2.27" : "dsaWithSHA1",
	"1.3.14.3.2.28" : "dsaWithCommonSHA1",
	"1.3.14.3.2.29" : "sha-1WithRSAEncryption",
    "1.2.840.10040.4.1" : "id-dsa",
    "1.2.840.10046.2.1" : "dhpublicnumber",
    "2.16.840.1.101.2.1.1.22" : "id-keyExchangeAlgorithm",
    "1.2.840.10045.2.1" : "id-ecPublicKey",
    "1.3.132.1.12" : "id-ecDH",
    "1.2.840.10045.2.13" : "id-ecMQV",
    "1.2.840.113549.1.1.10" : "id-RSASSA-PSS",
    "1.2.840.113549.1.1.8" : "id-mgf1",
    "1.2.840.10045.1.1" : "prime-field",
	"1.2.840.113549.2.2" : "md2",
	"1.2.840.113549.2.4" : "md4",
	"1.2.840.113549.2.5" : "md5",
	"1.2.840.113549.1.1.1" : "rsaEncryption",
	"1.2.840.113549.1.1.2" : "md2WithRSAEncryption",
	"1.2.840.113549.1.1.3" : "md4WithRSAEncryption",
	"1.2.840.113549.1.1.4" : "md5WithRSAEncryption",
	"1.2.840.113549.1.1.5" : "sha1WithRSAEncryption",
	"1.2.840.113549.1.1.6" : "rsaOAEPEncryptionSET",
	"1.2.840.113549.1.1.11" : "sha256WithRSAEncryption",
	"1.2.840.113549.1.1.12" : "sha384WithRSAEncryption",
	"1.2.840.113549.1.1.13" : "sha512WithRSAEncryption",
	"1.2.840.113549.1.1.14" : "sha224WithRSAEncryption",
	"1.2.840.10045.4.1" : "ecdsa-with-SHA1",
	"1.2.156.10197.1.501" : "SM2-with-SM3",
	"1.2.840.10045.4.3.1" : "ecdsa-with-SHA224",
	"1.2.840.10045.4.3.2" : "ecdsa-with-SHA256",
	"1.2.840.10045.4.3.3" : "ecdsa-with-SHA384",
	"1.2.840.10045.4.3.4" : "ecdsa-with-SHA512",
	"2.16.840.1.101.3.4.3.1" : "id-dsa-with-sha224",
	"2.16.840.1.101.3.4.3.2" : "id-dsa-with-sha256",
    "1.2.840.10045.3.1.1" : "secp192r1",
    "1.3.132.0.1" : "sect163k1",
    "1.3.132.0.15" : "sect163r2",
    "1.3.132.0.33" : "secp224r1",
    "1.3.132.0.26" : "sect233k1",
    "1.3.132.0.27" : "sect233r1",
    "1.2.840.10045.3.1.7" : "secp256r1",
    "1.3.132.0.16" : "sect283k1",
    "1.3.132.0.17" : "sect283r1",
    "1.3.132.0.34" : "secp384r1",
    "1.3.132.0.36" : "sect409k1",
    "1.3.132.0.37" : "sect409r1",
    "1.3.132.0.35" : "secp521r1",
    "1.3.132.0.38" : "sect571k1",
    "1.3.132.0.39" : "sect571r1",
    "1.2.156.10197.1.301" : "sm2",
    "2.16.840.1.101.3.4.2.1" : "sha256" ,
    "2.16.840.1.101.3.4.2.2" : "sha384" ,
    "2.16.840.1.101.3.4.2.3" : "sha512" ,
    "2.16.840.1.101.3.4.2.4" : "sha224" ,
    "1.2.156.10197.1.401" : "sm3",
    "1.3.6.1.4.1.2.267.7.4.4" : "dilithium2" ,
    "1.3.9999.2.7.1" : "p256_dilithium2" ,
    "1.3.9999.2.7.2" : "rsa3072_dilithium2" ,
    "1.3.6.1.4.1.2.267.7.6.5" : "dilithium3" ,
    "1.3.9999.2.7.3" : "p384_dilithium3" ,
    "1.3.6.1.4.1.2.267.7.8.7" : "dilithium5" ,
    "1.3.9999.2.7.4" : "p521_dilithium5" ,
    "1.3.6.1.4.1.2.267.11.4.4" : "dilithium2_aes" ,
    "1.3.9999.2.11.1" : "p256_dilithium2_aes" ,
    "1.3.9999.2.11.2" : "rsa3072_dilithium2_aes" ,
    "1.3.6.1.4.1.2.267.11.6.5" : "dilithium3_aes" ,
    "1.3.9999.2.11.3" : "p384_dilithium3_aes" ,
    "1.3.6.1.4.1.2.267.11.8.7" : "dilithium5_aes" ,
    "1.3.9999.2.11.4" : "p521_dilithium5_aes" ,
    "1.3.9999.3.1" : "falcon512" ,
    "1.3.9999.3.2" : "p256_falcon512" ,
    "1.3.9999.3.3" : "rsa3072_falcon512" ,
    "1.3.9999.3.4" : "falcon1024" ,
    "1.3.9999.3.5" : "p521_falcon1024" ,
    "1.3.6.1.4.1.311.89.2.1.7" : "picnicl1full" ,
    "1.3.6.1.4.1.311.89.2.1.8" : "p256_picnicl1full" ,
    "1.3.6.1.4.1.311.89.2.1.9" : "rsa3072_picnicl1full" ,
    "1.3.6.1.4.1.311.89.2.1.21" : "picnic3l1" ,
    "1.3.6.1.4.1.311.89.2.1.22" : "p256_picnic3l1" ,
    "1.3.6.1.4.1.311.89.2.1.23" : "rsa3072_picnic3l1" ,
    "1.3.9999.5.1.1.1" : "rainbowIclassic" ,
    "1.3.9999.5.1.2.1" : "p256_rainbowIclassic" ,
    "1.3.9999.5.1.3.1" : "rsa3072_rainbowIclassic" ,
    "1.3.9999.5.3.1.1" : "rainbowVclassic" ,
    "1.3.9999.5.3.2.1" : "p521_rainbowVclassic" ,
    "1.3.9999.6.1.1" : "sphincsharaka128frobust" ,
    "1.3.9999.6.1.2" : "p256_sphincsharaka128frobust" ,
    "1.3.9999.6.1.3" : "rsa3072_sphincsharaka128frobust" ,
    "1.3.9999.6.4.1" : "sphincssha256128frobust" ,
    "1.3.9999.6.4.2" : "p256_sphincssha256128frobust" ,
    "1.3.9999.6.4.3" : "rsa3072_sphincssha256128frobust" ,
    "1.3.9999.6.7.1" : "sphincsshake256128frobust" ,
    "1.3.9999.6.7.2" : "p256_sphincsshake256128frobust" ,
    "1.3.9999.6.7.3" : "rsa3072_sphincsshake256128frobust" 
}

# http header parsing
def HexToHttpHeaders(hex_string):
    byte_data = bytes.fromhex(hex_string)
    http_headers_str = byte_data.decode('utf-8')
    lines = http_headers_str.split('\r\n')
    headers = {}
    for line in lines:
        if ': ' in line:
            key, value = line.split(': ', 1)
            headers[key] = value
    return headers

# Other process running commands
def RunCommand(command):
    ret_str = subprocess.run(command, stdout=subprocess.PIPE, shell=True)
    decoded_result = codecs.decode(ret_str.stdout, 'utf-8') 
    list_1 = decoded_result.splitlines()
    list_output = []
    for i in range(0, len(list_1)) :
        list_2 = list_1[i].split("\t")
        list_output.append(list_2)
    return list_output

# Get data stream signature class
class GetStreamSignatureFromTshrak ():
    def __init__(self, pacp_file_path):
        # Define all fields to be output using tshark
        tshark_filter_list = [
            'frame.number' ,
            'frame.time',
            'tcp.stream',
            'udp.stream',
            'ip.src' ,
            'ip.dst' ,
            'ip.proto' ,

            'data' ,
            'udp.srcport' ,
            'udp.dstport' ,
            'udp.payload' ,
            'udp.length' ,

            'tcp.srcport' ,
            'tcp.dstport' ,
            'tcp.payload' ,
            'tcp.len' ,
            'tcp.flags.syn' ,
            'tcp.flags.ack' ,
            'tcp.flags.reset',
            'tcp.flags.fin',
            'tcp.window_size_value',

            'tls.record.content_type',
            'tls.handshake.extensions_server_name' ,
            'tls.handshake.session_id',
            'tls.handshake.type',
            'tls.handshake.ja3' ,
            'tls.handshake.certificate' ,
            'tls.esni.encrypted_sni',
            'x509af.serialNumber' ,
            'x509af.algorithm.id' ,
            'x509ce.dNSName',

            'dns.qry.name' ,

            'http.request',
            'http.response',
            'http.request.full_uri',
            'http.file_data',
            
            'quic'
            ]
        # Piece tshark commands
        tshark_filter_str = ''
        for i in range(len(tshark_filter_list)):
            tshark_filter_str += ' -e ' + tshark_filter_list[i]
        output_list = RunCommand("tshark -r "    + pacp_file_path +    " -T fields " + tshark_filter_str)

        # All tshark output fields are stored in the dictionary
        self._output_dict_list = []
        for i in range(len(output_list)):
            frame_output_dict = {}
            for j in range(len(output_list[i])):
                frame_output_dict[tshark_filter_list[j]] = output_list[i][j]
            self._output_dict_list.append(frame_output_dict)
        return
        
    # Get a list of TCP stream IDs
    def GetTcpStreamIdList(self):
        tcp_stream_ID_list = []
        for i in range(len(self._output_dict_list)):
            if self._output_dict_list[i]['tcp.stream'] != '':
                if self._output_dict_list[i]['tcp.stream'] not in tcp_stream_ID_list:
                    tcp_stream_ID_list.append(self._output_dict_list[i]['tcp.stream'])
        return tcp_stream_ID_list
        
    # Get a list of UDP stream IDs
    def GetUdpStreamIdList(self):
        udp_stream_ID_list = []
        for i in range(len(self._output_dict_list)):
            if self._output_dict_list[i]['udp.stream'] != '':
                if self._output_dict_list[i]['udp.stream'] not in udp_stream_ID_list:
                    udp_stream_ID_list.append(self._output_dict_list[i]['udp.stream'])
        return udp_stream_ID_list
        
    # Get the feature list of all frames in the specified TCP stream
    def GetOneTcpFrameSignatureList(self, frame_ID):
            tcp_frame_signature_list = []
            for i in range(len(self._output_dict_list)):
                    if self._output_dict_list[i]['tcp.stream'] == str(frame_ID):
                            tcp_frame_signature_list.append(self._output_dict_list[i])
            return tcp_frame_signature_list
        
    # Get the feature list of all frames in the specified UDP stream
    def GetOneUdpFrameSignatureList(self, frame_ID):
        udp_frame_signature_list = []
        for i in range(len(self._output_dict_list)):
            if self._output_dict_list[i]['udp.stream'] == str(frame_ID):
                udp_frame_signature_list.append(self._output_dict_list[i])
        return udp_frame_signature_list
        
    # Determine TCP client IP and server IP
    def GetTcpClinetAndServerIP(self, frame_signature_list):
        client_ip = ''
        client_port = ''
        server_ip = ''
        server_port = ''
        # tcp.flags.syn==1 && tcp.flags.ack==0  First Handshake
        # tcp.flags.syn==1 && tcp.flags.ack==1  Second handshake
        # tcp.flags.syn==0 && tcp.flags.ack==1  Third handshake
        # If the first three packets of the TCP stream meet the three-way handshake condition, 
        # it means that the handshake phase of the TCP data stream has been captured.
        if len(frame_signature_list) >= 3:
            if  frame_signature_list[0]['tcp.flags.syn'] == '1' and frame_signature_list[0]['tcp.flags.ack'] == '0' and \
                frame_signature_list[1]['tcp.flags.syn'] == '1' and frame_signature_list[1]['tcp.flags.ack'] == '1' and \
                frame_signature_list[2]['tcp.flags.syn'] == '0' and frame_signature_list[2]['tcp.flags.ack'] == '1' :
                client_ip = frame_signature_list[0]['ip.src']
                client_port = frame_signature_list[0]['tcp.srcport']
                server_ip = frame_signature_list[0]['ip.dst']
                server_port = frame_signature_list[0]['tcp.dstport']
            else:
                if int(frame_signature_list[0]['tcp.srcport']) > 5000:
                    client_ip = frame_signature_list[0]['ip.src']
                    client_port = frame_signature_list[0]['tcp.srcport']
                    server_ip = frame_signature_list[0]['ip.dst']
                    server_port = frame_signature_list[0]['tcp.dstport']
                else:
                    client_ip = frame_signature_list[0]['ip.dst']
                    client_port = frame_signature_list[0]['tcp.dstport']
                    server_ip = frame_signature_list[0]['ip.src']
                    server_port = frame_signature_list[0]['tcp.srcport']
        # If there is no handshake packet, use a port greater than 5000 as the client
        else:
            if int(frame_signature_list[0]['tcp.srcport']) > 5000:
                client_ip = frame_signature_list[0]['ip.src']
                client_port = frame_signature_list[0]['tcp.srcport']
                server_ip = frame_signature_list[0]['ip.dst']
                server_port = frame_signature_list[0]['tcp.dstport']
            else:
                client_ip = frame_signature_list[0]['ip.dst']
                client_port = frame_signature_list[0]['tcp.dstport']
                server_ip = frame_signature_list[0]['ip.src']
                server_port = frame_signature_list[0]['tcp.srcport']
        return [client_ip, client_port, server_ip, server_port]
    
    # Determine UDP client IP and server IP
    def GetUdpClinetAndServerIP(self, frame_signature_list):
        client_ip = ''
        client_port = ''
        server_ip = ''
        server_port = ''
        # The client port is larger than the server port
        if int(frame_signature_list[0]['udp.srcport']) >= int(frame_signature_list[0]['udp.dstport']):
            client_ip = frame_signature_list[0]['ip.src']
            client_port = frame_signature_list[0]['udp.srcport']
            server_ip = frame_signature_list[0]['ip.dst']
            server_port = frame_signature_list[0]['udp.dstport']
        else:
            client_ip = frame_signature_list[0]['ip.dst']
            client_port = frame_signature_list[0]['udp.dstport']
            server_ip = frame_signature_list[0]['ip.src']
            server_port = frame_signature_list[0]['udp.srcport']
        return [client_ip, client_port, server_ip, server_port]
    
    # Get the valid characters in the payload
    def GetValidCharactersFromPayload(self, payload):
        ret_list_all = []
        binary_data = binascii.unhexlify(payload)
        printable_positions = []

        # Iterate over the bytes object to find the positions of consecutive printable characters
        start = None
        end = 0
        for i, byte in enumerate(binary_data):
            char = chr(byte)
            if char.isprintable():
                if start is None:
                    start = i
            else:
                if start is not None:
                    end = i - 1
                    if end - start > 16  and "\\x" not in str(binary_data[start:end+1]) :
                        ret_list = [start, end, payload[start:end+1], binary_data[start:end + 1].decode('utf-8', errors='ignore')]
                        ret_list_all.append(ret_list)
                        printable_positions.append((start, end))
                    start = None

        # Process the last paragraph
        if start is not None:
            if end - start > 16 and "\\x" not in str(binary_data[start:end+1]) :
                ret_list = [start, end, payload[start:end+1], binary_data[start:end + 1].decode('utf-8', errors='ignore')]
                ret_list_all.append(ret_list)
            printable_positions.append((start, len(binary_data) - 1))
        return ret_list_all

    ####################################### ssl ####################################### 
    # sni_absent
    def sni_absent(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            if frame_signature_list[i]['tls.handshake.extensions_server_name'] != '' and frame_signature_list[i]['tls.handshake.extensions_server_name'] not in ret_list:
                ret_list.append(frame_signature_list[i]['tls.handshake.extensions_server_name'])
        if len(ret_list)    == 0:
            return ['Ture']
        else:
            return ['False']
        
    # ssl_ech_enabled tls.handshake.type == 8      
    def ssl_ech_enabled(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            if frame_signature_list[i]['tls.handshake.type'] == '8' :
                ret_list.append(frame_signature_list[i]['tls.handshake.type'])
        if len(ret_list) == 0:
            return ['False']
        else:
            return ['Ture']  

    # ssl_use_session_resumption tls.handshake.session_id 
    def ssl_use_session_resumption(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['tls.handshake.session_id'])
            if frame_signature_list[i]['tls.handshake.session_id'] not in ret_list and frame_signature_list[i]['tls.handshake.session_id'] != '':
                ret_list.append(frame_signature_list[i]['tls.handshake.session_id'])
        if len(ret_list) == 0:
            return ["use_session_resumption"]
        else:
            return ["new_link"]
                
    # ssl_use_selfsigned_certificate    tls.handshake.type == 13 Certificate Request tls.handshake.type == 15 Certificate Verify
    # 自签发证书没有一个由权威证书颁发的证书链，因此 TLS 握手时可能缺少 "Certificate Request" 和 "Certificate Verify" 阶段。
    # 在 "Server Hello Done" 之后，客户端发送的 "Client Key Exchange" 之前，你可以检查是否有 "Certificate Request" 消息，
    # 如果没有，可能是自签发证书。
    def ssl_use_selfsigned_certificate(self, frame_signature_list):
        ret_list = []
        ret_list_temp = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['tls.handshake.type'])
            if frame_signature_list[i]['tls.handshake.type'] != '':
                ret_list_temp.extend(frame_signature_list[i]['tls.handshake.type'].split(','))
        for i in range(len(ret_list_temp)):
            if ret_list_temp[i] not in ret_list:
                ret_list.append(ret_list_temp[i])
        # print(ret_list)
        if '13' in ret_list and '15' in ret_list:
            return ["Authoritative certificate"]
        else:
            return ["use_selfsigned_certificate"] 

    # ssl_ja3 
    def ssl_ja3(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['tls.handshake.ja3'])
            if frame_signature_list[i]['tls.handshake.ja3'] not in ret_list and frame_signature_list[i]['tls.handshake.ja3'] != '':
                ret_list.append(frame_signature_list[i]['tls.handshake.ja3'])
        return ret_list
    
    # ssl_extensions_server_name
    def ssl_extensions_server_name(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            if frame_signature_list[i]['quic'] != '1' and frame_signature_list[i]['tls.handshake.extensions_server_name'] != '' and frame_signature_list[i]['tls.handshake.extensions_server_name'] not in ret_list:
                ret_list.append(frame_signature_list[i]['tls.handshake.extensions_server_name'])
        return ret_list
    
    # ssl_fingerprint tls.handshake.certificate
    def ssl_fingerprint(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['tls.handshake.certificate'])
            if frame_signature_list[i]['tls.handshake.certificate'] not in ret_list and frame_signature_list[i]['tls.handshake.certificate'] != '':
                ret_list.append(frame_signature_list[i]['tls.handshake.certificate'])
        return ret_list
    
    # ssl_serial_number x509af.serialNumber 
    def ssl_serial_number(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['x509af.serialNumber'])
            if frame_signature_list[i]['x509af.serialNumber'] != '' and frame_signature_list[i]['x509af.serialNumber'] not in ret_list:
                ret_list.append(frame_signature_list[i]['x509af.serialNumber'])
        return ret_list
    
    # ssl_issuer_common_name 
    def ssl_issuer_common_name(self, frame_signature_list):
        ret_list = []
        ret_certificate_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['tls.handshake.certificate'])
            if frame_signature_list[i]['tls.handshake.certificate'] != '':
                ret_certificate_list.extend(frame_signature_list[i]['tls.handshake.certificate'].split(','))
        for i in range(len(ret_certificate_list)):
            # 解析证书    bytes.fromhex(hex_string)
            cert = x509.load_der_x509_certificate(bytes.fromhex(ret_certificate_list[i]), default_backend())
            issuer = cert.issuer
            common_name = None
            for attribute in issuer:
                if attribute.oid == x509.NameOID.COMMON_NAME:
                    common_name = attribute.value
            ret_list.append(common_name)
        return ret_list
    
    # ssl_issuer_organization_name    RFC 4519    2.5.4.10
    def ssl_issuer_organization_name(self, frame_signature_list):
        ret_list = []
        ret_certificate_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['tls.handshake.certificate'])
            if frame_signature_list[i]['tls.handshake.certificate'] != '':
                ret_certificate_list.extend(frame_signature_list[i]['tls.handshake.certificate'].split(','))
        for i in range(len(ret_certificate_list)):
            # 解析证书    bytes.fromhex(hex_string)
            cert = x509.load_der_x509_certificate(bytes.fromhex(ret_certificate_list[i]), default_backend())
            issuer = cert.issuer
            common_name = None
            for attribute in issuer:
                if attribute.oid == x509.NameOID.ORGANIZATION_NAME:
                    common_name = attribute.value
            ret_list.append(common_name)
        return ret_list
    
    # ssl_issuer_country_name RFC 4519    2.5.4.6
    def ssl_issuer_country_name(self, frame_signature_list):
        ret_list = []
        ret_certificate_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['tls.handshake.certificate'])
            if frame_signature_list[i]['tls.handshake.certificate'] != '':
                ret_certificate_list.extend(frame_signature_list[i]['tls.handshake.certificate'].split(','))
                break
        for i in range(len(ret_certificate_list)):
            # 解析证书    bytes.fromhex(hex_string)
            cert = x509.load_der_x509_certificate(bytes.fromhex(ret_certificate_list[i]), default_backend())
            issuer = cert.issuer
            common_name = None
            for attribute in issuer:
                if attribute.oid == x509.NameOID.COUNTRY_NAME:
                    common_name = attribute.value
            ret_list.append(common_name)
        return ret_list
    
    # ssl_subject_common_name
    def ssl_subject_common_name(self, frame_signature_list):
        ret_list = []
        ret_certificate_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['tls.handshake.certificate'])
            if frame_signature_list[i]['tls.handshake.certificate'] != '':
                ret_certificate_list.extend(frame_signature_list[i]['tls.handshake.certificate'].split(','))
                break
        for i in range(len(ret_certificate_list)):
            # 解析证书    bytes.fromhex(hex_string)
            cert = x509.load_der_x509_certificate(bytes.fromhex(ret_certificate_list[i]), default_backend())
            subject = cert.subject
            common_name = None
            for attribute in subject:
                if attribute.oid == x509.NameOID.COMMON_NAME:
                    common_name = attribute.value
            ret_list.append(common_name)
        return ret_list
    
    # ssl_subject_organization_name
    def ssl_subject_organization_name(self, frame_signature_list):
        ret_list = []
        ret_certificate_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['tls.handshake.certificate'])
            if frame_signature_list[i]['tls.handshake.certificate'] != '':
                ret_certificate_list.extend(frame_signature_list[i]['tls.handshake.certificate'].split(','))
        for i in range(len(ret_certificate_list)):
            # 解析证书    bytes.fromhex(hex_string)
            cert = x509.load_der_x509_certificate(bytes.fromhex(ret_certificate_list[i]), default_backend())
            subject = cert.subject
            common_name = None
            for attribute in subject:
                if attribute.oid == x509.NameOID.ORGANIZATION_NAME:
                    common_name = attribute.value
            ret_list.append(common_name)
        return ret_list
    
    # ssl_subject_country_name
    def ssl_subject_country_name(self, frame_signature_list):
        ret_list = []
        ret_certificate_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['tls.handshake.certificate'])
            if frame_signature_list[i]['tls.handshake.certificate'] != '':
                ret_certificate_list.extend(frame_signature_list[i]['tls.handshake.certificate'].split(','))
        for i in range(len(ret_certificate_list)):
            # 解析证书    bytes.fromhex(hex_string)
            cert = x509.load_der_x509_certificate(bytes.fromhex(ret_certificate_list[i]), default_backend())
            subject = cert.subject
            common_name = None
            for attribute in subject:
                if attribute.oid == x509.NameOID.COUNTRY_NAME:
                    common_name = attribute.value
            ret_list.append(common_name)
        return ret_list
    
    # ssl_not_valid_before 
    def ssl_not_valid_before(self, frame_signature_list):
        ret_list = []
        ret_certificate_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['tls.handshake.certificate'])
            if frame_signature_list[i]['tls.handshake.certificate'] != '':
                ret_certificate_list.extend(frame_signature_list[i]['tls.handshake.certificate'].split(','))
        for i in range(len(ret_certificate_list)):
            # 解析证书    bytes.fromhex(hex_string)
            cert = x509.load_der_x509_certificate(bytes.fromhex(ret_certificate_list[i]), default_backend())
            # 获取证书的生效日期
            not_valid_before = cert.not_valid_before
            given_datetime = not_valid_before.strftime("%Y-%m-%d %H:%M:%S")
            ret_list.append(given_datetime)
        return ret_list
    
    # ssl_not_valid_after 
    def ssl_not_valid_after(self, frame_signature_list):
        ret_list = []
        ret_certificate_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['tls.handshake.certificate'])
            if frame_signature_list[i]['tls.handshake.certificate'] != '':
                ret_certificate_list.extend(frame_signature_list[i]['tls.handshake.certificate'].split(','))
        for i in range(len(ret_certificate_list)):
            # 解析证书    bytes.fromhex(hex_string)
            cert = x509.load_der_x509_certificate(bytes.fromhex(ret_certificate_list[i]), default_backend())
            # 获取证书的生效日期
            not_valid_after = cert.not_valid_after
            given_datetime = not_valid_after.strftime("%Y-%m-%d %H:%M:%S")
            ret_list.append(given_datetime)
        return ret_list
    
    # ssl_algorithm_id x509af.algorithm.id
    def ssl_algorithm_id(self, frame_signature_list):
        ret_list = []
        ret_list_temp = []
        for i in range(len(frame_signature_list)):
            if frame_signature_list[i]['x509af.algorithm.id'] != '':
                ret_list_temp.extend(frame_signature_list[i]['x509af.algorithm.id'].split(','))
        for i in range(len(ret_list_temp)):
            if ret_list_temp[i] not in ret_list:
                ret_list.append(ret_list_temp[i])
        return ret_list
    
    def ssl_algorithm_identifier(self, frame_signature_list):
        ret_list = []
        ret_list_temp = []
        for i in range(len(frame_signature_list)):
            if frame_signature_list[i]['x509af.algorithm.id'] != '':
                ret_list_temp.extend(frame_signature_list[i]['x509af.algorithm.id'].split(','))
        for i in range(len(ret_list_temp)):
            algorithm_identifier_str = ''
            try:
                algorithm_identifier_str = algorithm_identifier_dict[ret_list_temp[i]]
            except:
                algorithm_identifier_str = 'unknown'
            if algorithm_identifier_str not in ret_list:
                ret_list.append(algorithm_identifier_str)
        return ret_list
    
    # ssl_san 'x509ce.dNSName'
    def ssl_san(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['x509ce.dNSName'])
            if frame_signature_list[i]['x509ce.dNSName'] != '' and frame_signature_list[i]['x509ce.dNSName'] not in ret_list:
                ret_list.append(frame_signature_list[i]['x509ce.dNSName'])
        return ret_list

    # heartbeat_flag
    def heartbeat_flag(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            if frame_signature_list[i]['tls.record.content_type'] == '24':
                ret_list.append(frame_signature_list[i]['frame.number'])
        return ret_list
    
    # tls.esni.encrypted_sni    
    def ssl_analysis_esni_enabled (self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            if frame_signature_list[i]['tls.esni.encrypted_sni'] != '' and frame_signature_list[i]['tls.esni.encrypted_sni'] not in ret_list:
                ret_list.append(frame_signature_list[i]['tls.esni.encrypted_sni'])
        if len(ret_list)    == 0:
            return ['False']
        else:
            return ['Ture']

    ####################################### udp ####################################### 
    # udp_c2s_first_data
    def udp_c2s_first_data(self, frame_signature_list):
        ret_list = self.GetUdpClinetAndServerIP(frame_signature_list)
        client_ip = ret_list[0]
        server_ip = ret_list[2]
        for i in range(len(frame_signature_list)):
            if frame_signature_list[i]['ip.src'] == client_ip:
                return [frame_signature_list[i]['udp.payload']]
        return []
    
    # udp_s2c_first_data
    def udp_s2c_first_data(self, frame_signature_list):
        ret_list = self.GetUdpClinetAndServerIP(frame_signature_list)
        client_ip = ret_list[0]
        server_ip = ret_list[2]
        for i in range(len(frame_signature_list)):
            if frame_signature_list[i]['ip.src'] == server_ip:
                return [frame_signature_list[i]['udp.payload']]
        return []
    
    # udp_c2s_first_data_len
    def udp_c2s_first_data_len(self, frame_signature_list):
        if len(self.udp_c2s_first_data(frame_signature_list)) > 0 :
            return [str(len(self.udp_c2s_first_data(frame_signature_list)[0]))]
        else:
            return ["0"]
                    
    # udp_s2c_first_data_len
    def udp_s2c_first_data_len(self, frame_signature_list):
        if len(self.udp_s2c_first_data(frame_signature_list)) > 0 :
            return [str(len(self.udp_s2c_first_data(frame_signature_list)[0]))]
        else:
            return ["0"]
            
    # udp_get_payload udp.payload
    def udp_get_payload(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['datcp.payloadta'])
            if frame_signature_list[i]['udp.payload'] != '':
                ret_list.append(frame_signature_list[i]['udp.payload'])
        return ret_list 
    
    # udp_srcport
    def udp_srcport(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['udp.srcport'])
            if frame_signature_list[i]['udp.srcport'] not in ret_list:
                ret_list.append(frame_signature_list[i]['udp.srcport'])
        return ret_list
    
    # udp_dstport udp.dstport
    def udp_dstport(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['udp.dstport'])
            if frame_signature_list[i]['udp.dstport'] not in ret_list:
                ret_list.append(frame_signature_list[i]['udp.dstport'])
        return ret_list

    ####################################### tcp ####################################### 
    # tcp_c2s_first_data
    def tcp_c2s_first_data(self, frame_signature_list):
        if len(frame_signature_list) > 3:
            if "create_with_syn" in self.tcp_create_with_syn(frame_signature_list) :
                return [frame_signature_list[3]['tcp.payload']]
            else:
                return ['']
        else:
            return ['']
        
    # tcp_s2c_first_data
    def tcp_s2c_first_data(self, frame_signature_list):
        if len(frame_signature_list) > 4:
            if "create_with_syn" in self.tcp_create_with_syn(frame_signature_list):
                return [frame_signature_list[4]['tcp.payload']]
            else:
                return ['']
        else:
            return ['']
        
    # tcp_c2s_first_data_len
    def tcp_c2s_first_data_len(self, frame_signature_list):
        return [str(len(self.tcp_c2s_first_data(frame_signature_list)[0]))]
    
    # tcp_s2c_first_data_len
    def tcp_s2c_first_data_len(self, frame_signature_list):
        return [str(len(self.tcp_s2c_first_data(frame_signature_list)[0]))]
    
    # tcp_create_with_syn
    def tcp_create_with_syn(self, frame_signature_list):
        if len(frame_signature_list) >= 3:
            if frame_signature_list[0]['tcp.flags.syn'] == '1' and frame_signature_list[0]['tcp.flags.ack'] == '0' and \
                frame_signature_list[1]['tcp.flags.syn'] == '1' and frame_signature_list[1]['tcp.flags.ack'] == '1' and \
                frame_signature_list[2]['tcp.flags.syn'] == '0' and frame_signature_list[2]['tcp.flags.ack'] == '1' :
                return ["create_with_syn"]
            else:
                return ["NO create_with_syn"]
        else:
            return ["TCP NO Create"]
        
    # tcp_get_payload tcp.payload
    def tcp_get_payload(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            if frame_signature_list[i]['tcp.payload'] != '':
                ret_list.append(frame_signature_list[i]['tcp.payload'])
                ret_str = self.GetValidCharactersFromPayload(frame_signature_list[i]['tcp.payload'])
        return ret_list
    
    # tcp_syn_fingerprint tcp.flags.syn
    def tcp_syn_fingerprint(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            if frame_signature_list[i]['tcp.flags.syn'] != '1' and frame_signature_list[i]['tcp.payload'] != '':
                ret_list.append(frame_signature_list[i]['tcp.payload'])
                break
        return ret_list
    
    # tcp_sack_fingerprint tcp.flags.ack
    def tcp_sack_fingerprint(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['datcp.payloadta'])
            if frame_signature_list[i]['tcp.flags.ack'] != '1' and frame_signature_list[i]['tcp.payload'] != '':
                ret_list.append(frame_signature_list[i]['tcp.payload'])
                break
        return ret_list
    
    # tcp_srcport tcp.srcport
    def tcp_srcport(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['tcp.srcport'])
            if frame_signature_list[i]['tcp.srcport'] not in ret_list:
                ret_list.append(frame_signature_list[i]['tcp.srcport'])
        return ret_list
    
    # tcp_dstport tcp.dstport
    def tcp_dstport(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['tcp.dstport'])
            if frame_signature_list[i]['tcp.dstport'] not in ret_list:
                ret_list.append(frame_signature_list[i]['tcp.dstport'])
        return ret_list
    
    # tcp_window tcp.window_size_value
    def tcp_window(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['tcp.window_size_value'])
            ret_list.append(frame_signature_list[i]['tcp.window_size_value'])
        return [ret_list[-1]]

    ####################################### ip ####################################### 
    # ip_payload data
    def ip_payload(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['data'])
            if frame_signature_list[i]['data'] != '':
                ret_list.append(frame_signature_list[i]['data'])
        return ret_list
    
    # ip_src 
    def ip_src(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['ip.src'])
            if frame_signature_list[i]['ip.src'] not in ret_list:
                ret_list.append(frame_signature_list[i]['ip.src'])
        return ret_list
    
    # ip_dst ip.dst
    def ip_dst(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['ip.dst'])
            if frame_signature_list[i]['ip.dst'] not in ret_list:
                ret_list.append(frame_signature_list[i]['ip.dst'])
        return ret_list
    
    # ip_proto ip.proto
    def ip_proto(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['ip.dst'])
            if frame_signature_list[i]['ip.proto'] not in ret_list:
                if frame_signature_list[i]['ip.proto'] == '6':
                    ret_list.append("TCP")
                    break
                elif frame_signature_list[i]['ip.proto'] == '17':
                    ret_list.append("UDP")
                    break
                else:
                    print(frame_signature_list[i]['ip.proto'])
        return ret_list
    
    ####################################### dns ####################################### 
    # dns_qry_name dns.qry.name
    def dns_qry_name(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            # print(frame_signature_list[i]['dns.qry.name'])
            if frame_signature_list[i]['dns.qry.name'] not in ret_list:
                ret_list.append(frame_signature_list[i]['dns.qry.name'])
        return ret_list

    ####################################### http ####################################### 
    # http_request_full_uri http.request.full_uri                   
    def http_request_full_uri(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            if frame_signature_list[i]['http.request.full_uri'] not in ret_list and frame_signature_list[i]['http.request.full_uri']    != '':
                ret_list.append(frame_signature_list[i]['http.request.full_uri'])
        return ret_list

    # http_request_header http.request
    def http_request_header(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            if frame_signature_list[i]['http.request'] == 'True':
                tcp_payload = frame_signature_list[i]['tcp.payload']
                http_file_data = frame_signature_list[i]['http.file_data']
                modified_string = tcp_payload.replace(http_file_data, "")
                headers = HexToHttpHeaders(modified_string)
                ret_list.append(headers)
        return ret_list
    
    # http_response_header http.response
    def http_response_header(self, frame_signature_list):
        ret_list = []
        for i in range(len(frame_signature_list)):
            if frame_signature_list[i]['http.response'] == 'True':
                tcp_payload = frame_signature_list[i]['tcp.payload']
                http_file_data = frame_signature_list[i]['http.file_data']
                modified_string = tcp_payload.replace(http_file_data, "")
                headers = HexToHttpHeaders(modified_string)
                ret_list.append(headers)
        return ret_list

def MonthToNumber(abbreviation):
    months = {
        'Jan': 1,
        'Feb': 2,
        'Mar': 3,
        'Apr': 4,
        'May': 5,
        'Jun': 6,
        'Jul': 7,
        'Aug': 8,
        'Sep': 9,
        'Oct': 10,
        'Nov': 11,
        'Dec': 12
    }
    return months.get(abbreviation.capitalize())

def RemoveAfterLastSpace(input_string):
    last_space_index = input_string.rfind(' ')
    if last_space_index != -1:
        result_string = input_string[:last_space_index]
        return result_string
    else:
        return input_string
    
# Get data flow time
def GetDataFlowTime(feature_list, ):
    # Get the start time of the data stream
    frame_time_first= feature_list[0]['frame.time']
    relative_start_dt_list = RemoveAfterLastSpace(frame_time_first).split()

    year = relative_start_dt_list[2]
    month = str(MonthToNumber(relative_start_dt_list[0]))
    day = relative_start_dt_list[1].split(',')[0]
    time_str = relative_start_dt_list[3][:-3]
    relative_start_dt = year + '-' + month + '-' + day + ' ' + time_str

    # Get the end time of the data stream
    full_time_last = feature_list[-1]['frame.time']
    relative_end_dt_list = RemoveAfterLastSpace(full_time_last).split()
    year = relative_end_dt_list[2]
    month = str(MonthToNumber(relative_end_dt_list[0]))
    day = relative_end_dt_list[1].split(',')[0]
    time_str = relative_end_dt_list[3][:-3]
    relative_end_dt = year + '-' + month + '-' + day + ' ' + time_str

    # Get the duration of a data stream
    datetime_obj1 = datetime.strptime(relative_start_dt, "%Y-%m-%d %H:%M:%S.%f")
    datetime_obj2 = datetime.strptime(relative_end_dt, "%Y-%m-%d %H:%M:%S.%f")
    time_difference = datetime_obj2 - datetime_obj1
    duration_dt = time_difference.total_seconds()

    return relative_start_dt, relative_end_dt, duration_dt

# Get the basic information dictionary of the data stream
def GetBasicInfoDict(stream_type, 
                     stream_ID, 
                     start_tag, 
                     end_tag, 
                     client_iP, 
                     client_port, 
                     server_iP, 
                     server_port, 
                     stream_irection, 
                     s2c_frames_num, 
                     s2c_byte, 
                     c2s_frames_num, 
                     c2s_byte, 
                     total_frames_num, 
                     total_byte, 
                     relative_start_dt, 
                     relative_end_dt, 
                     duration_dt):
    basic_info_dict = {}
    basic_info_dict['StreamType'] = stream_type
    basic_info_dict['StreamID'] = stream_ID
    basic_info_dict['StartTag'] =  start_tag
    basic_info_dict['EndTag'] =  end_tag
    basic_info_dict['ClientIP'] = client_iP
    basic_info_dict['ClientPort'] = client_port
    basic_info_dict['ServerIP'] = server_iP
    basic_info_dict['ServerPort'] = server_port
    basic_info_dict['StreamIrection'] = stream_irection
    basic_info_dict['S2C Num'] = s2c_frames_num
    basic_info_dict['S2C Byte'] = s2c_byte
    basic_info_dict['C2S Num'] = c2s_frames_num
    basic_info_dict['C2S Byte'] = c2s_byte
    basic_info_dict['TotalNum'] = total_frames_num
    basic_info_dict['TotalByte'] = total_byte
    basic_info_dict['Start'] = relative_start_dt
    basic_info_dict['End'] = relative_end_dt
    basic_info_dict['Duration'] = duration_dt
    return basic_info_dict

# Define basic information about data flow


# get TCP Basic information
def GetTCPStreamBaseInfo(all_frame_signature_dict_list):
    # Extract TCP stream ID list
    tcp_stream_basic_info_list = []
    tcp_stream_ID_list = []
    for i in range(len(all_frame_signature_dict_list)):
        if all_frame_signature_dict_list[i]['tcp.stream'] != '':
            if all_frame_signature_dict_list[i]['tcp.stream'] not in tcp_stream_ID_list:
                tcp_stream_ID_list.append(all_frame_signature_dict_list[i]['tcp.stream'])

    # Extract basic information of TCP data stream
    for i in range(len(tcp_stream_ID_list)):
        tcp_feature_list = []
        for j in range(len(all_frame_signature_dict_list)):
                if all_frame_signature_dict_list[j]['tcp.stream'] == tcp_stream_ID_list[i]:
                        tcp_feature_list.append(all_frame_signature_dict_list[j])
        stream_type = "TCP"
        stream_ID = tcp_stream_ID_list[i]

        # tcp.flags.syn==1 && tcp.flags.ack==0    
        # tcp.flags.syn==1 && tcp.flags.ack==1    
        # tcp.flags.syn==0 && tcp.flags.ack==1    
        if len(tcp_feature_list) >= 3:
            if tcp_feature_list[0]['tcp.flags.syn'] == '1' and tcp_feature_list[0]['tcp.flags.ack'] == '0' and \
                tcp_feature_list[1]['tcp.flags.syn'] == '1' and tcp_feature_list[1]['tcp.flags.ack'] == '1' and \
                tcp_feature_list[2]['tcp.flags.syn'] == '0' and tcp_feature_list[2]['tcp.flags.ack'] == '1' :
                start_tag = 'Normal Handshake'
            else:
                start_tag = 'No Handshake'
        else:
                start_tag = 'frame_num < 3'

        # tcp.flags.fin==0 && tcp.flags.ack==1    
        # tcp.flags.fin==1 && tcp.flags.ack==1    
        # tcp.flags.fin==0 && tcp.flags.ack==1    
        # tcp.flags.fin==1 && tcp.flags.ack==0    
        # Four times wave conditions
        if len(tcp_feature_list) >= 4:
            if tcp_feature_list[-1]['tcp.flags.reset'] == '1' :
                end_tag = 'By Reset'
            elif tcp_feature_list[-1]['tcp.flags.fin'] == '0' and tcp_feature_list[-1]['tcp.flags.ack'] == '1' and \
                tcp_feature_list[-2]['tcp.flags.fin'] == '1' and tcp_feature_list[-2]['tcp.flags.ack'] == '1' and \
                tcp_feature_list[-3]['tcp.flags.fin'] == '0' and tcp_feature_list[-3]['tcp.flags.ack'] == '1' and \
                tcp_feature_list[-4]['tcp.flags.fin'] == '1' and tcp_feature_list[-4]['tcp.flags.ack'] == '0' :
                end_tag = 'Normal Wavehand'
            else:
                end_tag = 'No Wavehand'
        else:
            end_tag = 'frame_num < 4'

        # Determine the client IP and server IP
        if start_tag == 'Normal Handshake':
            client_iP = tcp_feature_list[0]['ip.src']
            client_port = tcp_feature_list[0]['tcp.srcport']
            server_iP = tcp_feature_list[0]['ip.dst']
            server_port = tcp_feature_list[0]['tcp.dstport']
        else:
            if int(tcp_feature_list[0]['tcp.srcport']) > 5000:
                client_iP = tcp_feature_list[0]['ip.src']
                client_port = tcp_feature_list[0]['tcp.srcport']
                server_iP = tcp_feature_list[0]['ip.dst']
                server_port = tcp_feature_list[0]['tcp.dstport']
            else:
                client_iP = tcp_feature_list[0]['ip.dst']
                client_port = tcp_feature_list[0]['tcp.dstport']
                server_iP = tcp_feature_list[0]['ip.src']
                server_port = tcp_feature_list[0]['tcp.srcport']
        
        # Get the data flow direction stream_irection
        ip_list = []
        for j in range(len(tcp_feature_list)):
            if tcp_feature_list[j]['ip.src'] in ip_list:
                pass
            else:
                ip_list.append(tcp_feature_list[j]['ip.src'])
        if len(ip_list) > 1:
            stream_irection = 'double'

        elif ip_list[0] == '127.0.0.1':
            stream_irection = 'local'
        else:
            if ip_list[0] == client_iP:
                stream_irection = 'c2s'
            else:
                stream_irection = 's2c'

        # Get data flow in each direction: s2c_frames_num, s2c_byte, c2s_frames_num, c2s_byte, total_frames_num, total_byte
        s2c_frames_num = 0
        s2c_byte = 0
        c2s_frames_num = 0
        c2s_byte = 0
        total_frames_num = len(tcp_feature_list)
        total_byte = 0
        for j in range(len(tcp_feature_list)):
            if tcp_feature_list[j]['tcp.len'] == '':
                tcp_len = len(tcp_feature_list[j]['tcp.payload'])
            else:
                tcp_len = int(tcp_feature_list[j]['tcp.len'])
            total_byte += tcp_len
            if tcp_feature_list[j]['ip.src'] == client_iP:
                c2s_frames_num += 1
                c2s_byte += tcp_len
            else:
                s2c_frames_num += 1
                s2c_byte += tcp_len

        # Get the start time and duration of a data stream: relative_start_dt, duration_dt
        ret_get_data_flow_time = GetDataFlowTime(tcp_feature_list)
        relative_start_dt = ret_get_data_flow_time[0]
        relative_end_dt = ret_get_data_flow_time[1]
        duration_dt = ret_get_data_flow_time[2]

        tcp_stream_base_dict = GetBasicInfoDict(stream_type, 
                                                stream_ID, 
                                                start_tag, 
                                                end_tag, 
                                                client_iP, 
                                                client_port, 
                                                server_iP, 
                                                server_port, 
                                                stream_irection, 
                                                s2c_frames_num, 
                                                s2c_byte, 
                                                c2s_frames_num, 
                                                c2s_byte, 
                                                total_frames_num, 
                                                total_byte, 
                                                relative_start_dt, 
                                                relative_end_dt, 
                                                duration_dt)
    
        tcp_stream_basic_info_list.append(tcp_stream_base_dict)                
    return tcp_stream_basic_info_list

# UDP Obtaining basic information about data streams
def GetUDPStreamBaseInfo(all_frame_signature_dict_list):
    # Extract UDP stream ID list
    tcp_stream_basic_info_list = []
    udp_stream_ID_list = []
    for i in range(len(all_frame_signature_dict_list)):
        if all_frame_signature_dict_list[i]['udp.stream'] != '':
            if all_frame_signature_dict_list[i]['udp.stream'] not in udp_stream_ID_list:
                udp_stream_ID_list.append(all_frame_signature_dict_list[i]['udp.stream'])
                            
    # Extract basic information of udp data stream
    for i in range(len(udp_stream_ID_list)):
        udp_feature_list = []
        for j in range(len(all_frame_signature_dict_list)):
            if all_frame_signature_dict_list[j]['udp.stream'] == udp_stream_ID_list[i]:
                udp_feature_list.append(all_frame_signature_dict_list[j])

        stream_type = "UDP"
        stream_ID = udp_stream_ID_list[i]
        start_tag = 'Normal'
        end_tag    = 'Normal'
        # Determine the client IP and server IP. The one with the larger port in UDP is defined as the client.
        if int(udp_feature_list[0]['udp.srcport']) > int(udp_feature_list[0]['udp.dstport']):
            client_iP = udp_feature_list[0]['ip.src']
            client_port = udp_feature_list[0]['udp.srcport']
            server_iP = udp_feature_list[0]['ip.dst']
            server_port = udp_feature_list[0]['udp.dstport']
        else:
            client_iP = udp_feature_list[0]['ip.dst']
            client_port = udp_feature_list[0]['udp.dstport']
            server_iP = udp_feature_list[0]['ip.src']
            server_port = udp_feature_list[0]['udp.srcport']
        
        # Determine the direction of data flow
        ip_list = []
        for j in range(len(udp_feature_list)):
            if udp_feature_list[j]['ip.src'] in ip_list:
                pass
            else:
                ip_list.append(udp_feature_list[j]['ip.src'])
        if len(ip_list) > 1:
            stream_irection = 'double'

        elif ip_list[0] == '127.0.0.1':
            stream_irection = 'local'
        else:
            if ip_list[0] == client_iP:
                stream_irection = 'c2s'
            else:
                stream_irection = 's2c'
        # Get data flow in each direction: s2c_frames_num, s2c_byte, c2s_frames_num, c2s_byte, total_frames_num, total_byte
        s2c_frames_num = 0
        s2c_byte = 0
        c2s_frames_num = 0
        c2s_byte = 0
        total_frames_num = len(udp_feature_list)
        total_byte = 0
        for j in range(len(udp_feature_list)):
            total_byte += int(udp_feature_list[j]['udp.length'])
            if udp_feature_list[j]['ip.src'] == client_iP:
                c2s_frames_num += 1
                c2s_byte += int(udp_feature_list[j]['udp.length'])
            else:
                s2c_frames_num += 1
                s2c_byte += int(udp_feature_list[j]['udp.length'])
        # Get the start time and duration of a data stream relative_start_dt, duration_dt

        ret_get_data_flow_time = GetDataFlowTime(udp_feature_list)
        relative_start_dt = ret_get_data_flow_time[0]
        relative_end_dt = ret_get_data_flow_time[1]
        duration_dt = ret_get_data_flow_time[2]

        udp_stream_base_dict = GetBasicInfoDict(stream_type, 
                                                stream_ID, 
                                                start_tag, 
                                                end_tag, 
                                                client_iP, 
                                                client_port, 
                                                server_iP, 
                                                server_port, 
                                                stream_irection, 
                                                s2c_frames_num, 
                                                s2c_byte, 
                                                c2s_frames_num, 
                                                c2s_byte, 
                                                total_frames_num, 
                                                total_byte, 
                                                relative_start_dt, 
                                                relative_end_dt, 
                                                duration_dt)
        tcp_stream_basic_info_list.append(udp_stream_base_dict)         
    return tcp_stream_basic_info_list