The number of roles in the DeviceClassifier readme is no longer correct. about networkml

[rashley-iqt]

The existing label assignments can be found in: https://github.com/CyberReboot/PoseidonML/blob/master/DeviceClassifier/OneLayer/opts/label_assignments.json

[DanSibbernsen]

Ah, thanks @cglewis, I had a configuration problem and it wasn't reading in the file appropriately. Your output of a successful run helped me narrow it down :)

[Hax7]

Hi, do you have some documentation where i can find the correct number?

[DanSibbernsen]

Hi, I was attempting to get a handle on PoseidonML so I could fix this issue and had a problem with the data set I obtained from https://iotanalytics.unsw.edu.au , specifically 16-09-28.pcap and 16-10-04.pcap. I get the following message: INFO:__main__:Not enough sessions in pcap

Is there an already available data set that I can use? Or is there some special post-processing I need to do on the above PCAP files?

[cglewis]

@DanSibbernsen the not enough sessions in pcap message happens when there's less than 5 sessions in the capture for the primary IP that is being evaluated. I ran the OneLayer eval on both 16-09-29.pcap and 16-09-23.pcap from here: https://iotanalytics.unsw.edu.au/iottraces.html

Here are the results I got respectively:

$ export PCAP=~/Downloads/16-09-29.pcap 
$ make
Sending build context to Docker daemon  7.536MB
...
Running OneLayer Eval on PCAP file ~/Downloads/16-09-29.pcap
INFO:__main__:Unknown : 0.955
INFO:__main__:GPU laptop : 0.024
INFO:__main__:Business workstation : 0.008
INFO:__main__:Message: {"ec:1a:59:83:28:11": {"timestamp": 1475071484.695704, "decisions": {"behavior": "normal", "investigate": true}, "classification": {"labels": ["Unknown", "GPU laptop", "Business workstation"], "confidences": [0.9553587485600846, 0.024370670652594937, 0.008152348557037191]}, "valid": false}}

$ export PCAP=~/Downloads/16-09-23.pcap 
$ make
Sending build context to Docker daemon  7.536MB
...
Running OneLayer Eval on PCAP file ~/Downloads/16-09-23.pcap
INFO:__main__:Unknown : 0.955
INFO:__main__:GPU laptop : 0.025
INFO:__main__:Business workstation : 0.008
INFO:__main__:Message: {"ec:1a:59:83:28:11": {"timestamp": 1474553101.338756, "classification": {"labels": ["Unknown", "GPU laptop", "Business workstation"], "confidences": [0.9553420454242527, 0.024672997138479827, 0.00792211967226373]}, "valid": false, "decisions": {"investigate": true, "behavior": "normal"}}}