Snort_AIPreproc/TODO

======================
AVERAGE/HIGH PRIORITY:
======================

- Bayesian network
- Modules for correlation coefficients
- Code profiling
- Comment all the code!!!
- Neural network for computing k
- Testing more scenarios, making more hyperalert models
- Manual alert correlation from the web interface

=============
LOW PRIORITY:
=============

- Managing clusters for addresses, timestamps (and more?)
- Splitting the distinct subgraphs of the output graph
- libgc support

=====
DONE:
=====

+ PostgreSQL support
+ Regex comp cache
+ Managing hyperalert graph connection inside the alert structure itself
+ Keeping track of all the streams and alerts even after clustered
+ Dynamic cluster_min_size algorithm
+ Add alerts' history serialization to db.c as well
+ Bayesian learning among alerts in alert log
+ Split bayesian correlation out of correlation.c
+ Clustering alerts with time constraints
+ Save clusters and correlations to db
+ Uniformed error messages format
+ Full PostgreSQL support for output db
+ Web interface
+ Function names (private functions with _ or __ ?)
+ Saving packet flows as .pcap
Grouped alert info inside the cluster, better graph management in hyperalerts 2010-09-16 23:21:38 +02:00			`======================`
			`AVERAGE/HIGH PRIORITY:`
			`======================`

Adding webserver features 2010-10-07 12:19:21 +02:00			`- Bayesian network`
			`- Modules for correlation coefficients`
Keeping bayesian correlation in bayesian.c 2010-09-28 21:36:58 +02:00			`- Code profiling`
Now supporting clustering with time constraints 2010-09-29 12:24:30 +02:00			`- Comment all the code!!!`
Keeping bayesian correlation in bayesian.c 2010-09-28 21:36:58 +02:00			`- Neural network for computing k`
Grouped alert info inside the cluster, better graph management in hyperalerts 2010-09-16 23:21:38 +02:00			`- Testing more scenarios, making more hyperalert models`
Updated documentation and Makefile 2010-10-12 03:12:11 +02:00			`- Manual alert correlation from the web interface`
Grouped alert info inside the cluster, better graph management in hyperalerts 2010-09-16 23:21:38 +02:00
			`=============`
			`LOW PRIORITY:`
			`=============`
Sept 11 2010 commit 2010-09-11 12:45:30 +02:00
First commit for spp_ai 2010-08-14 14:30:41 +02:00			`- Managing clusters for addresses, timestamps (and more?)`
Keeping bayesian correlation in bayesian.c 2010-09-28 21:36:58 +02:00			`- Splitting the distinct subgraphs of the output graph`
Bayesian correlation now working 2010-09-23 21:57:20 +02:00			`- libgc support`
First commit for spp_ai 2010-08-14 14:30:41 +02:00
Grouped alert info inside the cluster, better graph management in hyperalerts 2010-09-16 23:21:38 +02:00			`=====`
			`DONE:`
			`=====`

			`+ PostgreSQL support`
			`+ Regex comp cache`
			`+ Managing hyperalert graph connection inside the alert structure itself`
			`+ Keeping track of all the streams and alerts even after clustered`
Clustering now improved 2010-09-18 16:42:11 +02:00			`+ Dynamic cluster_min_size algorithm`
Bayesian correlation now working 2010-09-23 21:57:20 +02:00			`+ Add alerts' history serialization to db.c as well`
			`+ Bayesian learning among alerts in alert log`
Keeping bayesian correlation in bayesian.c 2010-09-28 21:36:58 +02:00			`+ Split bayesian correlation out of correlation.c`
Now supporting clustering with time constraints 2010-09-29 12:24:30 +02:00			`+ Clustering alerts with time constraints`
Output database support (for MySQL) now complete 2010-10-02 17:46:15 +02:00			`+ Save clusters and correlations to db`
Starting to support PostgreSQL for logging output 2010-10-04 17:48:07 +02:00			`+ Uniformed error messages format`
Adding webserver features 2010-10-07 12:19:21 +02:00			`+ Full PostgreSQL support for output db`
Web interface done, web server fixed, pcap support 2010-10-11 17:00:03 +02:00			`+ Web interface`
			`+ Function names (private functions with _ or __ ?)`
Updated documentation and Makefile 2010-10-12 03:12:11 +02:00			`+ Saving packet flows as .pcap`
Grouped alert info inside the cluster, better graph management in hyperalerts 2010-09-16 23:21:38 +02:00