Skip to content

Commit

Permalink
update readme figures
Browse files Browse the repository at this point in the history
  • Loading branch information
mielverkerken committed Oct 13, 2024
1 parent ce11c21 commit 0ee2896
Show file tree
Hide file tree
Showing 8 changed files with 16 additions and 12 deletions.
28 changes: 16 additions & 12 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
![banner](banner.jpg)
![banner](figures/banner.jpg)
# A Network Traffic Feature Extraction Tool

## <img src="RustiFlow_nobg.png" width="60px"/> Overview
## <img src="figures/RustiFlow_nobg.png" width="60px"/> Overview

This tool is engineered for robust and efficient feature extraction, particularly for applications such as network intrusion detection systems, among others. Leveraging Rust language and eBPF, it excels in processing high volumes of network traffic with remarkable speed and throughput. (When your traffic is already captured, don't worry! It also has a build in pcap reader which is also amazingly fast.) With various pre-defined feature sets and the ability to create custom feature sets, RustiFlow offers a versatile solution for network security applications.

Expand All @@ -11,9 +11,9 @@ This tool is engineered for robust and efficient feature extraction, particularl
![Ubuntu 24](https://img.shields.io/badge/Tested%20on%20ubuntu-purple?logo=ubuntu)


![Animated image showing network flows](flows.gif)
![Animated image showing network flows](figures/flows.gif)

## <img src="RustiFlow_nobg.png" width="60px"/> Key Features
## <img src="figures/RustiFlow_nobg.png" width="60px"/> Key Features

- **High Throughput:** Utilizes Rust and the [Aya](https://aya-rs.dev/) library for eBPF program compilation and execution, ensuring exceptional performance and resource efficiency.
- **Versatile Feature Sets:** Offers a variety of pre-defined feature sets (flows) and the flexibility to create custom feature sets tailored to specific requirements.
Expand All @@ -24,11 +24,15 @@ This tool is engineered for robust and efficient feature extraction, particularl

See the [wiki](https://github.com/idlab-discover/RustiFlow/wiki) for the different feature sets available.

## <img src="RustiFlow_nobg.png" width="60px"/> Architecture
## <img src="figures/RustiFlow_nobg.png" width="60px"/> Architecture

![RustiFlow Architecture](RustiFlow.svg)
### Realtime processing
![RustiFlow Architecture Realtime](figures/realtime.png)

## <img src="RustiFlow_nobg.png" width="60px"/> Using the release binary:
### Offline PCAP processing
![RustiFlow Architecture Offline](figures/offline.png)

## <img src="figures/RustiFlow_nobg.png" width="60px"/> Using the release binary:

Copy the rustiflow binary that you can find in this repo in releases to a location of your choice or to the `/usr/local/bin` folder.
If it does not have the right permissions, you can run the following command:
Expand All @@ -45,7 +49,7 @@ You can then run the binary with the following commands displayed on the [help m

If you want a more graphical interface, you can use the tui interface by just running `rustiflow` without any arguments. This will open the following interface:

![The tui interface](tui_rustiflow.GIF)
![The tui interface](figures/tui_rustiflow.GIF)

> **NOTE:** When using the save button, the current selection will be saved to the `rustiflow.toml` file. You can reuse this file with following command:
```bash
Expand Down Expand Up @@ -90,7 +94,7 @@ header = true
drop_contaminant_features = false
```

## <img src="RustiFlow_nobg.png" width="60px"/> Using the Container:
## <img src="figures/RustiFlow_nobg.png" width="60px"/> Using the Container:

Make sure that you don't use docker desktop and that you don't have it installed on your machine. If you have this setup, it will not work as intended as the `--network host` will not link the container to the host network, but to the network of a VM that docker desktop uses.

Expand All @@ -111,7 +115,7 @@ Make sure that you don't use docker desktop and that you don't have it installed
docker run --privileged --network host -v /home/matisse/Documents:/app rustiflow realtime enp5s0 cic-flow 60 csv /app/output.csv
```

## <img src="RustiFlow_nobg.png" width="60px"/> Installation Guide for development
## <img src="figures/RustiFlow_nobg.png" width="60px"/> Installation Guide for development

### Prerequisites:
- **libpcap-dev**:
Expand Down Expand Up @@ -144,7 +148,7 @@ Make sure that you don't use docker desktop and that you don't have it installed
export PATH=/usr/lib/linux-tools/5.8.0-63-generic:$PATH
```

## <img src="RustiFlow_nobg.png" width="60px"/> Building the Project
## <img src="figures/RustiFlow_nobg.png" width="60px"/> Building the Project

- **eBPF Programs**:
```bash
Expand All @@ -162,7 +166,7 @@ Make sure that you don't use docker desktop and that you don't have it installed
cargo xtask run -- [OPTIONS] <COMMAND>
```

## <img src="RustiFlow_nobg.png" width="60px"/> Usage Instructions
## <img src="figures/RustiFlow_nobg.png" width="60px"/> Usage Instructions

### Command Help:
```bash
Expand Down
File renamed without changes
File renamed without changes
File renamed without changes
File renamed without changes
Binary file added figures/offline.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added figures/realtime.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
File renamed without changes

0 comments on commit 0ee2896

Please sign in to comment.