Write some Software

Application connections classification for Windows. The goal of the project is to demonstrate possibility of connection classifications. After demo proves possibility of such classification, a production version of the software can be developed. Application classification is defined as determining an application name and attributes of a network connection initiator. 1. Classification should be done right before a first packet of the connection is sent. First packet for TCP connections is done during connect() system call, for other protocols it is sending the first packet by an application, so these events should be intercepted. 2. In the future, this information will be sent to our proprietary router, but for the demo purposes it should be logged in a window and file. 3. There should be a possibility to hold the sending of the first packet, until confirmation from our router is received. 4. For standalone applications classification attribute is the program name. For example, if Skype makes a connection it is clear that it is a skype connection, just by producing the name of the program. 5. Web Application classification is more complex case. A browser is a connection initiator for a number of Applications. It is assumed that a web page in a tab is one application. Each tab is served by separate thread, so that can be used to separate information gathering. Application related information in case of browsers is extended of URL related to the connection and root URL of the page. For example URL can be href="[login to view URL]…” and root URL is [login to view URL] 6. The demo application should print following information before any Windows application send a first packet of the connection: • Source port and IP address; • Destination port and IP address; • Socket type (TCP, UDP, ICMP,…); • Program name and PID related to the socket; • URL for which the socket is opened (for browsers); • Root URL (for browsers); 7. Information for browsers should be obtained without plug-ins. Using plug-ins is too complex in the production environment. For the demo purposes a couple of browsers should be supported: IE (11.0, 8.0), Chrome and Firefox (39).