Data Structures | |
struct | attribute_key |
struct | attribute_value |
Functions | |
PRIVATE int | _heuristic_func (cluster_type type) |
Function that picks up the heuristic value for a clustering attribute in according to Julisch's heuristic (ACM, Vol.2, No.3, 09 2002, pag.124). | |
PRIVATE hierarchy_node * | _hierarchy_node_new (char *label, int min_val, int max_val) |
Create a new clustering hierarchy node. | |
PRIVATE void | _hierarchy_node_append (hierarchy_node *parent, hierarchy_node *child) |
Append a node to a clustering hierarchy node. | |
PRIVATE hierarchy_node * | _AI_get_min_hierarchy_node (int val, hierarchy_node *root) |
Get the minimum node in a hierarchy tree that matches a certain value. | |
PRIVATE BOOL | _AI_equal_alarms (AI_snort_alert *a1, AI_snort_alert *a2) |
Check if two alerts are semantically equal. | |
PRIVATE int | _AI_merge_alerts (AI_snort_alert **log) |
Merge the alerts marked as equal in the log. | |
PRIVATE void | _AI_print_clustered_alerts (AI_snort_alert *log, FILE *fp) |
Print the clustered alerts to a log file. | |
PRIVATE void * | _AI_cluster_thread (void *arg) |
Thread for periodically clustering the log information. | |
PRIVATE BOOL | _AI_check_duplicate (hierarchy_node *node, hierarchy_node *root) |
Check if a certain node's range (minimum and maximum value) are already present in a clustering hierarchy. | |
void | AI_hierarchies_build (AI_config *conf, hierarchy_node **nodes, int n_nodes) |
Build the clustering hierarchy trees. | |
PRIVATE AI_snort_alert * | _AI_copy_clustered_alerts (AI_snort_alert *node) |
Return a copy of the clustered alerts. | |
AI_snort_alert * | AI_get_clustered_alerts () |
Return the alerts parsed so far as a linked list. | |
Variables | |
PRIVATE hierarchy_node * | h_root [CLUSTER_TYPES] = { NULL } |
PRIVATE AI_config * | _config = NULL |
PRIVATE AI_snort_alert * | alert_log = NULL |
PRIVATE BOOL | lock_flag = false |
PRIVATE BOOL _AI_check_duplicate | ( | hierarchy_node * | node, | |
hierarchy_node * | root | |||
) |
Check if a certain node's range (minimum and maximum value) are already present in a clustering hierarchy.
node | Node to be checked | |
root | Clustering hierarchy |
PRIVATE void* _AI_cluster_thread | ( | void * | arg | ) |
Thread for periodically clustering the log information.
PRIVATE AI_snort_alert* _AI_copy_clustered_alerts | ( | AI_snort_alert * | node | ) |
Return a copy of the clustered alerts.
PRIVATE BOOL _AI_equal_alarms | ( | AI_snort_alert * | a1, | |
AI_snort_alert * | a2 | |||
) |
Check if two alerts are semantically equal.
a1 | First alert | |
a2 | Second alert |
PRIVATE hierarchy_node* _AI_get_min_hierarchy_node | ( | int | val, | |
hierarchy_node * | root | |||
) |
Get the minimum node in a hierarchy tree that matches a certain value.
val | Value to be matched in the range | |
root | Root of the hierarchy |
PRIVATE int _AI_merge_alerts | ( | AI_snort_alert ** | log | ) |
Merge the alerts marked as equal in the log.
log | Alert log reference |
PRIVATE void _AI_print_clustered_alerts | ( | AI_snort_alert * | log, | |
FILE * | fp | |||
) |
Print the clustered alerts to a log file.
log | Log containing the alerts | |
fp | File pointer where the alerts will be printed |
PRIVATE int _heuristic_func | ( | cluster_type | type | ) |
Function that picks up the heuristic value for a clustering attribute in according to Julisch's heuristic (ACM, Vol.2, No.3, 09 2002, pag.124).
type | Attribute type |
PRIVATE void _hierarchy_node_append | ( | hierarchy_node * | parent, | |
hierarchy_node * | child | |||
) |
Append a node to a clustering hierarchy node.
parent | Parent node | |
child | Child node |
PRIVATE hierarchy_node* _hierarchy_node_new | ( | char * | label, | |
int | min_val, | |||
int | max_val | |||
) |
Create a new clustering hierarchy node.
label | Label for the node | |
min_val | Minimum value for the range represented by the node | |
max_val | Maximum value for the range represented by the node |
AI_snort_alert* AI_get_clustered_alerts | ( | void | ) |
Return the alerts parsed so far as a linked list.
void AI_hierarchies_build | ( | AI_config * | conf, | |
hierarchy_node ** | nodes, | |||
int | n_nodes | |||
) |
Build the clustering hierarchy trees.
conf | Reference to the configuration of the module | |
nodes | Nodes containing the information about the clustering ranges | |
n_nodes | Number of nodes |
PRIVATE AI_snort_alert* alert_log = NULL |
PRIVATE hierarchy_node* h_root[CLUSTER_TYPES] = { NULL } |