Manage the clustering of alarms

Data Structures
struct	attribute_key
struct	attribute_value
Functions
PRIVATE int	_heuristic_func (cluster_type type)
	Function that picks up the heuristic value for a clustering attribute in according to Julisch's heuristic (ACM, Vol.2, No.3, 09 2002, pag.124).
PRIVATE hierarchy_node *	_hierarchy_node_new (char *label, int min_val, int max_val)
	Create a new clustering hierarchy node.
PRIVATE void	_hierarchy_node_append (hierarchy_node *parent, hierarchy_node *child)
	Append a node to a clustering hierarchy node.
PRIVATE hierarchy_node *	_AI_get_min_hierarchy_node (int val, hierarchy_node *root)
	Get the minimum node in a hierarchy tree that matches a certain value.
PRIVATE BOOL	_AI_equal_alarms (AI_snort_alert *a1, AI_snort_alert *a2)
	Check if two alerts are semantically equal.
PRIVATE int	_AI_merge_alerts (AI_snort_alert **log)
	Merge the alerts marked as equal in the log.
PRIVATE void	_AI_print_clustered_alerts (AI_snort_alert *log, FILE *fp)
	Print the clustered alerts to a log file.
PRIVATE void *	_AI_cluster_thread (void *arg)
	Thread for periodically clustering the log information.
PRIVATE BOOL	_AI_check_duplicate (hierarchy_node *node, hierarchy_node *root)
	Check if a certain node's range (minimum and maximum value) are already present in a clustering hierarchy.
void	AI_hierarchies_build (AI_config *conf, hierarchy_node **nodes, int n_nodes)
	Build the clustering hierarchy trees.
PRIVATE AI_snort_alert *	_AI_copy_clustered_alerts (AI_snort_alert *node)
	Return a copy of the clustered alerts.
AI_snort_alert *	AI_get_clustered_alerts ()
	Return the alerts parsed so far as a linked list.
Variables
PRIVATE hierarchy_node *	h_root [CLUSTER_TYPES] = { NULL }
PRIVATE AI_config *	_config = NULL
PRIVATE AI_snort_alert *	alert_log = NULL
PRIVATE BOOL	lock_flag = false

---

Function Documentation

PRIVATE BOOL _AI_check_duplicate	(	hierarchy_node *	node,
		hierarchy_node *	root
	)

Check if a certain node's range (minimum and maximum value) are already present in a clustering hierarchy.

Parameters:

	node	Node to be checked
	root	Clustering hierarchy

Returns:

True if 'node' is already in 'root', false otherwise

PRIVATE void* _AI_cluster_thread

(

void *

arg

)

Thread for periodically clustering the log information.

PRIVATE AI_snort_alert* _AI_copy_clustered_alerts

(

AI_snort_alert *

node

)

Return a copy of the clustered alerts.

Returns:

An AI_snort_alert pointer identifying the list of clustered alerts

PRIVATE BOOL _AI_equal_alarms	(	AI_snort_alert *	a1,
		AI_snort_alert *	a2
	)

Check if two alerts are semantically equal.

Parameters:

	a1	First alert
	a2	Second alert

Returns:

True if they are equal, false otherwise

PRIVATE hierarchy_node* _AI_get_min_hierarchy_node	(	int	val,
		hierarchy_node *	root
	)

Get the minimum node in a hierarchy tree that matches a certain value.

Parameters:

	val	Value to be matched in the range
	root	Root of the hierarchy

Returns:

The minimum node that matches the value if any, NULL otherwise

PRIVATE int _AI_merge_alerts

(

AI_snort_alert **

log

)

Merge the alerts marked as equal in the log.

Parameters:

log

Alert log reference

Returns:

The number of merged couples

PRIVATE void _AI_print_clustered_alerts	(	AI_snort_alert *	log,
		FILE *	fp
	)

Print the clustered alerts to a log file.

Parameters:

	log	Log containing the alerts
	fp	File pointer where the alerts will be printed

PRIVATE int _heuristic_func

(

cluster_type

type

)

Function that picks up the heuristic value for a clustering attribute in according to Julisch's heuristic (ACM, Vol.2, No.3, 09 2002, pag.124).

Parameters:

type

Attribute type

Returns:

The heuristic coefficient for that attribute, -1 if no clustering information is available for that attribute

PRIVATE void _hierarchy_node_append	(	hierarchy_node *	parent,
		hierarchy_node *	child
	)

Append a node to a clustering hierarchy node.

Parameters:

	parent	Parent node
	child	Child node

PRIVATE hierarchy_node* _hierarchy_node_new	(	char *	label,
		int	min_val,
		int	max_val
	)

Create a new clustering hierarchy node.

Parameters:

	label	Label for the node
	min_val	Minimum value for the range represented by the node
	max_val	Maximum value for the range represented by the node

Returns:

The brand new node if the allocation was ok, otherwise abort the application

AI_snort_alert* AI_get_clustered_alerts

(

void

)

Return the alerts parsed so far as a linked list.

Returns:

An AI_snort_alert pointer identifying the list of clustered alerts

void AI_hierarchies_build	(	AI_config *	conf,
		hierarchy_node **	nodes,
		int	n_nodes
	)

Build the clustering hierarchy trees.

Parameters:

	conf	Reference to the configuration of the module
	nodes	Nodes containing the information about the clustering ranges
	n_nodes	Number of nodes

---

Variable Documentation

PRIVATE AI_config* _config = NULL

PRIVATE AI_snort_alert* alert_log = NULL

PRIVATE hierarchy_node* h_root[CLUSTER_TYPES] = { NULL }

PRIVATE BOOL lock_flag = false