Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 07:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Measurement framework tests all pass now.

Browse source
This commit is contained in:
Seth Hall 2013-04-01 14:16:37 -04:00
parent 6dc204b385
commit 53f9948b02
22 changed files with 544 additions and 381 deletions
Download patch file Download diff file Expand all files Collapse all files

14
scripts/base/frameworks/measurement/plugins/average.bro
View file

@ -7,24 +7,24 @@ export {
AVERAGE
};
redef record Result += {
redef record ResultVal += {
## For numeric data, this calculates the average of all values.
average: double &log &optional;
average: double &optional;
};
}
hook add_to_reducer(r: Reducer, val: double, data: DataPoint, result: Result)
hook add_to_reducer_hook(r: Reducer, val: double, data: DataPoint, rv: ResultVal)
{
if ( AVERAGE in r$apply )
{
if ( ! result?$average )
result$average = val;
if ( ! rv?$average )
rv$average = val;
else
result$average += (val - result$average) / result$num;
rv$average += (val - rv$average) / rv$num;
}
}
hook compose_resultvals_hook(result: Result, rv1: Result, rv2: Result)
hook compose_resultvals_hook(result: ResultVal, rv1: ResultVal, rv2: ResultVal)
{
if ( rv1?$average && rv2?$average )
result$average = ((rv1$average*rv1$num) + (rv2$average*rv2$num))/(rv1$num+rv2$num);

16
scripts/base/frameworks/measurement/plugins/max.bro
View file

@ -7,24 +7,24 @@ export {
MAX
};
redef record Result += {
redef record ResultVal += {
## For numeric data, this tracks the maximum value given.
max: double &log &optional;
max: double &optional;
};
}
hook add_to_reducer(r: Reducer, val: double, data: DataPoint, result: Result)
hook add_to_reducer_hook(r: Reducer, val: double, data: DataPoint, rv: ResultVal)
{
if ( MAX in r$apply )
{
if ( ! result?$max )
result$max = val;
else if ( val > result$max )
result$max = val;
if ( ! rv?$max )
rv$max = val;
else if ( val > rv$max )
rv$max = val;
}
}
hook compose_resultvals_hook(result: Result, rv1: Result, rv2: Result)
hook compose_resultvals_hook(result: ResultVal, rv1: ResultVal, rv2: ResultVal)
{
if ( rv1?$max && rv2?$max )
result$max = (rv1$max > rv2$max) ? rv1$max : rv2$max;

16
scripts/base/frameworks/measurement/plugins/min.bro
View file

@ -7,24 +7,24 @@ export {
MIN
};
redef record Result += {
redef record ResultVal += {
## For numeric data, this tracks the minimum value given.
min: double &log &optional;
min: double &optional;
};
}
hook add_to_reducer(r: Reducer, val: double, data: DataPoint, result: Result)
hook add_to_reducer_hook(r: Reducer, val: double, data: DataPoint, rv: ResultVal)
{
if ( MIN in r$apply )
{
if ( ! result?$min )
result$min = val;
else if ( val < result$min )
result$min = val;
if ( ! rv?$min )
rv$min = val;
else if ( val < rv$min )
rv$min = val;
}
}
hook compose_resultvals_hook(result: Result, rv1: Result, rv2: Result)
hook compose_resultvals_hook(result: ResultVal, rv1: ResultVal, rv2: ResultVal)
{
if ( rv1?$min && rv2?$min )
result$min = (rv1$min < rv2$min) ? rv1$min : rv2$min;

14
scripts/base/frameworks/measurement/plugins/sample.bro
View file

@ -8,7 +8,7 @@ export {
samples: count &default=0;
};
redef record Result += {
redef record ResultVal += {
## A sample of something being measured. This is helpful in
## some cases for collecting information to do further detection
## or better logging for forensic purposes.
@ -16,24 +16,24 @@ export {
};
}
redef record Result += {
redef record ResultVal += {
# Internal use only. This is the queue where samples
# are maintained since the queue is self managing for
# the number of samples requested.
sample_queue: Queue::Queue &optional;
};
hook add_to_reducer(r: Reducer, val: double, data: DataPoint, result: Result)
hook add_to_reducer_hook(r: Reducer, val: double, data: DataPoint, rv: ResultVal)
{
if ( r$samples > 0 )
{
if ( ! result?$sample_queue )
result$sample_queue = Queue::init([$max_len=r$samples]);
Queue::push(result$sample_queue, data$str);
if ( ! rv?$sample_queue )
rv$sample_queue = Queue::init([$max_len=r$samples]);
Queue::push(rv$sample_queue, data$str);
}
}
hook compose_resultvals_hook(result: Result, rv1: Result, rv2: Result)
hook compose_resultvals_hook(result: ResultVal, rv1: ResultVal, rv2: ResultVal)
{
# Merge $sample_queue
if ( rv1?$sample_queue && rv2?$sample_queue )

29
scripts/base/frameworks/measurement/plugins/std-dev.bro
View file

@ -9,28 +9,31 @@ export {
STD_DEV
};
redef record Result += {
redef record ResultVal += {
## For numeric data, this calculates the standard deviation.
std_dev: double &log &optional;
std_dev: double &optional;
};
}
function calc_std_dev(rv: ResultVal)
{
if ( rv?$variance )
rv$std_dev = sqrt(rv$variance);
}
# This depends on the variance plugin which uses priority -5
hook add_to_reducer(r: Reducer, val: double, data: DataPoint, result: Result)
hook add_to_reducer_hook(r: Reducer, val: double, data: DataPoint, rv: ResultVal) &priority=-10
{
if ( STD_DEV in r$apply )
{
if ( result?$variance )
result$std_dev = sqrt(result$variance);
if ( rv?$variance )
calc_std_dev(rv);
else
rv$std_dev = 0.0;
}
}
hook compose_resultvals_hook(result: Result, rv1: Result, rv2: Result) &priority=-10
hook compose_resultvals_hook(result: ResultVal, rv1: ResultVal, rv2: ResultVal) &priority=-10
{
if ( rv1?$sum || rv2?$sum )
{
result$sum = rv1?$sum ? rv1$sum : 0;
if ( rv2?$sum )
result$sum += rv2$sum;
}
}
calc_std_dev(result);
}

27
scripts/base/frameworks/measurement/plugins/sum.bro
View file

@ -8,23 +8,32 @@ export {
SUM
};
redef record Result += {
redef record ResultVal += {
## For numeric data, this tracks the sum of all values.
sum: double &log &optional;
sum: double &default=0.0;
};
type threshold_function: function(key: Measurement::Key, result: Measurement::Result): count;
global sum_threshold: function(data_id: string): threshold_function;
}
hook add_to_reducer(r: Reducer, val: double, data: DataPoint, result: Result)
function sum_threshold(data_id: string): threshold_function
{
if ( SUM in r$apply )
return function(key: Measurement::Key, result: Measurement::Result): count
{
if ( ! result?$sum )
result$sum = 0;
result$sum += val;
}
print fmt("data_id: %s", data_id);
print result;
return double_to_count(result[data_id]$sum);
};
}
hook compose_resultvals_hook(result: Result, rv1: Result, rv2: Result)
hook add_to_reducer_hook(r: Reducer, val: double, data: DataPoint, rv: ResultVal)
{
if ( SUM in r$apply )
rv$sum += val;
}
hook compose_resultvals_hook(result: ResultVal, rv1: ResultVal, rv2: ResultVal)
{
if ( rv1?$sum || rv2?$sum )
{

18
scripts/base/frameworks/measurement/plugins/unique.bro
View file

@ -7,14 +7,14 @@ export {
UNIQUE
};
redef record Result += {
redef record ResultVal += {
## If cardinality is being tracked, the number of unique
## items is tracked here.
unique: count &log &optional;
unique: count &optional;
};
}
redef record Result += {
redef record ResultVal += {
# Internal use only. This is not meant to be publically available
# because we don't want to trust that we can inspect the values
# since we will like move to a probalistic data structure in the future.
@ -22,18 +22,18 @@ redef record Result += {
unique_vals: set[DataPoint] &optional;
};
hook add_to_reducer(r: Reducer, val: double, data: DataPoint, result: Result)
hook add_to_reducer_hook(r: Reducer, val: double, data: DataPoint, rv: ResultVal)
{
if ( UNIQUE in r$apply )
{
if ( ! result?$unique_vals )
result$unique_vals=set();
add result$unique_vals[data];
result$unique = |result$unique_vals|;
if ( ! rv?$unique_vals )
rv$unique_vals=set();
add rv$unique_vals[data];
rv$unique = |rv$unique_vals|;
}
}
hook compose_resultvals_hook(result: Result, rv1: Result, rv2: Result)
hook compose_resultvals_hook(result: ResultVal, rv1: ResultVal, rv2: ResultVal)
{
if ( rv1?$unique_vals || rv2?$unique_vals )
{

28
scripts/base/frameworks/measurement/plugins/variance.bro
View file

@ -8,40 +8,40 @@ export {
VARIANCE
};
redef record Result += {
redef record ResultVal += {
## For numeric data, this calculates the variance.
variance: double &log &optional;
variance: double &optional;
};
}
redef record Result += {
redef record ResultVal += {
# Internal use only. Used for incrementally calculating variance.
prev_avg: double &optional;
# Internal use only. For calculating incremental variance.
var_s: double &optional;
var_s: double &default=0.0;
};
hook add_to_reducer(r: Reducer, val: double, data: DataPoint, result: Result)
function calc_variance(rv: ResultVal)
{
if ( VARIANCE in r$apply )
result$prev_avg = result$average;
rv$variance = (rv$num > 1) ? rv$var_s/(rv$num-1) : 0.0;
}
# Reduced priority since this depends on the average
hook add_to_reducer(r: Reducer, val: double, data: DataPoint, result: Result) &priority=-5
hook add_to_reducer_hook(r: Reducer, val: double, data: DataPoint, rv: ResultVal) &priority=-5
{
if ( VARIANCE in r$apply )
{
if ( ! result?$var_s )
result$var_s = 0.0;
result$var_s += (val - result$prev_avg) * (val - result$average);
result$variance = (val > 0) ? result$var_s/val : 0.0;
if ( rv$num > 1 )
rv$var_s += ((val - rv$prev_avg) * (val - rv$average));
calc_variance(rv);
rv$prev_avg = rv$average;
}
}
# Reduced priority since this depends on the average
hook compose_resultvals_hook(result: Result, rv1: Result, rv2: Result) &priority=-5
hook compose_resultvals_hook(result: ResultVal, rv1: ResultVal, rv2: ResultVal) &priority=-5
{
if ( rv1?$var_s && rv2?$var_s )
{
@ -62,4 +62,6 @@ hook compose_resultvals_hook(result: Result, rv1: Result, rv2: Result) &priority
result$prev_avg = rv1$prev_avg;
else if ( rv2?$prev_avg )
result$prev_avg = rv2$prev_avg;
calc_variance(result);
}