#include "spp_ai.h"
#include <stdio.h>
#include <unistd.h>
#include <limits.h>
#include <pthread.h>
Data Structures | |
struct | attribute_key |
struct | attribute_value |
Functions | |
PRIVATE int | _heuristic_func (cluster_type type) |
Function that picks up the heuristic value for a clustering attribute in according to Julisch's heuristic (ACM, Vol.2, No.3, 09 2002, pag.124). | |
PRIVATE hierarchy_node * | _hierarchy_node_new (char *label, int min_val, int max_val) |
Create a new clustering hierarchy node. | |
PRIVATE void | _hierarchy_node_append (hierarchy_node *parent, hierarchy_node *child) |
Append a node to a clustering hierarchy node. | |
PRIVATE hierarchy_node * | _AI_get_min_hierarchy_node (int val, hierarchy_node *root) |
Get the minimum node in a hierarchy tree that matches a certain value. | |
PRIVATE BOOL | _AI_equal_alarms (AI_snort_alert *a1, AI_snort_alert *a2) |
Check if two alerts are semantically equal. | |
PRIVATE int | _AI_merge_alerts (AI_snort_alert **log) |
Merge the alerts marked as equal in the log. | |
PRIVATE void | _AI_print_clustered_alerts (AI_snort_alert *log, FILE *fp) |
Print the clustered alerts to a log file. | |
PRIVATE void * | _AI_cluster_thread (void *arg) |
Thread for periodically clustering the log information. | |
PRIVATE BOOL | _AI_check_duplicate (hierarchy_node *node, hierarchy_node *root) |
Check if a certain node's range (minimum and maximum value) are already present in a clustering hierarchy. | |
void | AI_hierarchies_build (AI_config *conf, hierarchy_node **nodes, int n_nodes) |
Build the clustering hierarchy trees. | |
Variables | |
PRIVATE hierarchy_node * | h_root [CLUSTER_TYPES] = { NULL } |
PRIVATE AI_config * | _config = NULL |
PRIVATE AI_snort_alert * | alert_log = NULL |
PRIVATE BOOL _AI_check_duplicate | ( | hierarchy_node * | node, | |
hierarchy_node * | root | |||
) |
Check if a certain node's range (minimum and maximum value) are already present in a clustering hierarchy.
FUNCTION: _AI_check_duplicate
node | Node to be checked | |
root | Clustering hierarchy |
PRIVATE void* _AI_cluster_thread | ( | void * | arg | ) |
Thread for periodically clustering the log information.
FUNCTION: _AI_cluster_thread
PRIVATE BOOL _AI_equal_alarms | ( | AI_snort_alert * | a1, | |
AI_snort_alert * | a2 | |||
) |
Check if two alerts are semantically equal.
FUNCTION: _AI_equal_alarms
a1 | First alert | |
a2 | Second alert |
PRIVATE hierarchy_node* _AI_get_min_hierarchy_node | ( | int | val, | |
hierarchy_node * | root | |||
) |
Get the minimum node in a hierarchy tree that matches a certain value.
FUNCTION: _AI_get_min_hierarchy_node
val | Value to be matched in the range | |
root | Root of the hierarchy |
PRIVATE int _AI_merge_alerts | ( | AI_snort_alert ** | log | ) |
Merge the alerts marked as equal in the log.
FUNCTION: _AI_merge_alerts
log | Alert log reference |
PRIVATE void _AI_print_clustered_alerts | ( | AI_snort_alert * | log, | |
FILE * | fp | |||
) |
Print the clustered alerts to a log file.
FUNCTION: _AI_print_clustered_alerts
log | Log containing the alerts | |
fp | File pointer where the alerts will be printed |
PRIVATE int _heuristic_func | ( | cluster_type | type | ) |
Function that picks up the heuristic value for a clustering attribute in according to Julisch's heuristic (ACM, Vol.2, No.3, 09 2002, pag.124).
FUNCTION: _heuristic_func
type | Attribute type |
PRIVATE void _hierarchy_node_append | ( | hierarchy_node * | parent, | |
hierarchy_node * | child | |||
) |
Append a node to a clustering hierarchy node.
FUNCTION: _hierarchy_node_append
parent | Parent node | |
child | Child node |
PRIVATE hierarchy_node* _hierarchy_node_new | ( | char * | label, | |
int | min_val, | |||
int | max_val | |||
) |
Create a new clustering hierarchy node.
FUNCTION: _hierarchy_node_new
label | Label for the node | |
min_val | Minimum value for the range represented by the node | |
max_val | Maximum value for the range represented by the node |
void AI_hierarchies_build | ( | AI_config * | conf, | |
hierarchy_node ** | nodes, | |||
int | n_nodes | |||
) |
Build the clustering hierarchy trees.
FUNCTION: AI_hierarchies_build
conf | Reference to the configuration of the module | |
nodes | Nodes containing the information about the clustering ranges | |
n_nodes | Number of nodes |
PRIVATE AI_snort_alert* alert_log = NULL |
PRIVATE hierarchy_node* h_root[CLUSTER_TYPES] = { NULL } |