Data Structures
struct	AI_alert_correlation
Enumerations
enum	{ inHyperAlert, inSnortIdTag, inPreTag, inPostTag, TAG_NUM }
Functions
double	_AI_correlation_coefficient (AI_snort_alert a, AI_snort_alert b)
	Compute the correlation coefficient between two alerts, as INTERSECTION(pre(B), post(A) / UNION(pre(B), post(A)).
void	_AI_macro_subst (AI_snort_alert **alert)
	Substitute the macros in hyperalert pre-conditions and post-conditions with their associated values.
PRIVATE AI_hyperalert_info *	_AI_hyperalert_from_XML (AI_hyperalert_key key)
	Parse info about a hyperalert from a correlation XML file, if it exists.
void *	AI_alert_correlation_thread (void *arg)
	Thread for correlating clustered alerts.
Variables
PRIVATE AI_hyperalert_info *	hyperalerts = NULL
PRIVATE AI_config *	conf = NULL
PRIVATE AI_snort_alert *	alerts = NULL
PRIVATE AI_alert_correlation *	correlation_table = NULL
PRIVATE BOOL	lock_flag = false

Enumeration Type Documentation

anonymous enum

Enumeration for the types of XML tags

Enumerator:

Function Documentation

double _AI_correlation_coefficient	(	AI_snort_alert *	a,
		AI_snort_alert *	b
	)

Compute the correlation coefficient between two alerts, as INTERSECTION(pre(B), post(A) / UNION(pre(B), post(A)).

Parameters:

	a	Alert a
	b	Alert b

Returns:: The correlation coefficient between A and B as coefficient in [0,1]

PRIVATE AI_hyperalert_info* _AI_hyperalert_from_XML ( AI_hyperalert_key key )

Parse info about a hyperalert from a correlation XML file, if it exists.

Parameters:

key

Key (gid, sid, rev) identifying the alert

Returns:: A hyperalert structure containing the info about the current alert, if the XML file was found

void _AI_macro_subst ( AI_snort_alert ** alert )

Substitute the macros in hyperalert pre-conditions and post-conditions with their associated values.

Parameters:

alert

Reference to the hyperalert to work on

void* AI_alert_correlation_thread ( void * arg )

Thread for correlating clustered alerts.

Parameters:

arg

Void pointer to module's configuration

PRIVATE AI_config* conf = NULL

PRIVATE BOOL lock_flag = false