diff --git a/README.md b/README.md index c175a3f3..a1aef808 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ -![banner](banner.jpg) +![banner](figures/banner.jpg) # A Network Traffic Feature Extraction Tool -## Overview +## Overview This tool is engineered for robust and efficient feature extraction, particularly for applications such as network intrusion detection systems, among others. Leveraging Rust language and eBPF, it excels in processing high volumes of network traffic with remarkable speed and throughput. (When your traffic is already captured, don't worry! It also has a build in pcap reader which is also amazingly fast.) With various pre-defined feature sets and the ability to create custom feature sets, RustiFlow offers a versatile solution for network security applications. @@ -11,9 +11,9 @@ This tool is engineered for robust and efficient feature extraction, particularl ![Ubuntu 24](https://img.shields.io/badge/Tested%20on%20ubuntu-purple?logo=ubuntu) -![Animated image showing network flows](flows.gif) +![Animated image showing network flows](figures/flows.gif) -## Key Features +## Key Features - **High Throughput:** Utilizes Rust and the [Aya](https://aya-rs.dev/) library for eBPF program compilation and execution, ensuring exceptional performance and resource efficiency. - **Versatile Feature Sets:** Offers a variety of pre-defined feature sets (flows) and the flexibility to create custom feature sets tailored to specific requirements. @@ -24,11 +24,15 @@ This tool is engineered for robust and efficient feature extraction, particularl See the [wiki](https://github.com/idlab-discover/RustiFlow/wiki) for the different feature sets available. -## Architecture +## Architecture -![RustiFlow Architecture](RustiFlow.svg) +### Realtime processing +![RustiFlow Architecture Realtime](figures/realtime.png) -## Using the release binary: +### Offline PCAP processing +![RustiFlow Architecture Offline](figures/offline.png) + +## Using the release binary: Copy the rustiflow binary that you can find in this repo in releases to a location of your choice or to the `/usr/local/bin` folder. If it does not have the right permissions, you can run the following command: @@ -45,7 +49,7 @@ You can then run the binary with the following commands displayed on the [help m If you want a more graphical interface, you can use the tui interface by just running `rustiflow` without any arguments. This will open the following interface: -![The tui interface](tui_rustiflow.GIF) +![The tui interface](figures/tui_rustiflow.GIF) > **NOTE:** When using the save button, the current selection will be saved to the `rustiflow.toml` file. You can reuse this file with following command: ```bash @@ -90,7 +94,7 @@ header = true drop_contaminant_features = false ``` -## Using the Container: +## Using the Container: Make sure that you don't use docker desktop and that you don't have it installed on your machine. If you have this setup, it will not work as intended as the `--network host` will not link the container to the host network, but to the network of a VM that docker desktop uses. @@ -111,7 +115,7 @@ Make sure that you don't use docker desktop and that you don't have it installed docker run --privileged --network host -v /home/matisse/Documents:/app rustiflow realtime enp5s0 cic-flow 60 csv /app/output.csv ``` -## Installation Guide for development +## Installation Guide for development ### Prerequisites: - **libpcap-dev**: @@ -144,7 +148,7 @@ Make sure that you don't use docker desktop and that you don't have it installed export PATH=/usr/lib/linux-tools/5.8.0-63-generic:$PATH ``` -## Building the Project +## Building the Project - **eBPF Programs**: ```bash @@ -162,7 +166,7 @@ Make sure that you don't use docker desktop and that you don't have it installed cargo xtask run -- [OPTIONS] ``` -## Usage Instructions +## Usage Instructions ### Command Help: ```bash diff --git a/RustiFlow.svg b/figures/RustiFlow.svg similarity index 100% rename from RustiFlow.svg rename to figures/RustiFlow.svg diff --git a/RustiFlow_nobg.png b/figures/RustiFlow_nobg.png similarity index 100% rename from RustiFlow_nobg.png rename to figures/RustiFlow_nobg.png diff --git a/banner.jpg b/figures/banner.jpg similarity index 100% rename from banner.jpg rename to figures/banner.jpg diff --git a/flows.gif b/figures/flows.gif similarity index 100% rename from flows.gif rename to figures/flows.gif diff --git a/figures/offline.png b/figures/offline.png new file mode 100644 index 00000000..43116473 Binary files /dev/null and b/figures/offline.png differ diff --git a/figures/realtime.png b/figures/realtime.png new file mode 100644 index 00000000..dfb0d10b Binary files /dev/null and b/figures/realtime.png differ diff --git a/tui_rustiflow.GIF b/figures/tui_rustiflow.GIF similarity index 100% rename from tui_rustiflow.GIF rename to figures/tui_rustiflow.GIF