Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 15:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Checkpoint, don't try running this. It's broken all over the place.

Browse source
This commit is contained in:
Seth Hall 2013-03-19 11:39:58 -04:00
parent 8778761c07
commit 6dc204b385
14 changed files with 352 additions and 379 deletions
Download patch file Download diff file Expand all files Collapse all files

1
scripts/base/frameworks/measurement/plugins/__load__.bro
View file

@ -1,6 +1,7 @@
@load ./average
@load ./max
@load ./min
@load ./sample
@load ./std-dev
@load ./sum
@load ./unique

10
scripts/base/frameworks/measurement/plugins/average.bro
View file

@ -1,5 +1,5 @@
module Metrics;
module Measurement;
export {
redef enum Calculation += {
@ -7,15 +7,15 @@ export {
AVERAGE
};
redef record ResultVal += {
redef record Result += {
## For numeric data, this calculates the average of all values.
average: double &log &optional;
};
}
hook add_to_calculation(filter: Filter, val: double, data: DataPoint, result: ResultVal)
hook add_to_reducer(r: Reducer, val: double, data: DataPoint, result: Result)
{
if ( AVERAGE in filter$measure )
if ( AVERAGE in r$apply )
{
if ( ! result?$average )
result$average = val;
@ -24,7 +24,7 @@ hook add_to_calculation(filter: Filter, val: double, data: DataPoint, result: Re
}
}
hook plugin_merge_measurements(result: ResultVal, rv1: ResultVal, rv2: ResultVal)
hook compose_resultvals_hook(result: Result, rv1: Result, rv2: Result)
{
if ( rv1?$average && rv2?$average )
result$average = ((rv1$average*rv1$num) + (rv2$average*rv2$num))/(rv1$num+rv2$num);

10
scripts/base/frameworks/measurement/plugins/max.bro
View file

@ -1,5 +1,5 @@
module Metrics;
module Measurement;
export {
redef enum Calculation += {
@ -7,15 +7,15 @@ export {
MAX
};
redef record ResultVal += {
redef record Result += {
## For numeric data, this tracks the maximum value given.
max: double &log &optional;
};
}
hook add_to_calculation(filter: Filter, val: double, data: DataPoint, result: ResultVal)
hook add_to_reducer(r: Reducer, val: double, data: DataPoint, result: Result)
{
if ( MAX in filter$measure )
if ( MAX in r$apply )
{
if ( ! result?$max )
result$max = val;
@ -24,7 +24,7 @@ hook add_to_calculation(filter: Filter, val: double, data: DataPoint, result: Re
}
}
hook plugin_merge_measurements(result: ResultVal, rv1: ResultVal, rv2: ResultVal)
hook compose_resultvals_hook(result: Result, rv1: Result, rv2: Result)
{
if ( rv1?$max && rv2?$max )
result$max = (rv1$max > rv2$max) ? rv1$max : rv2$max;

10
scripts/base/frameworks/measurement/plugins/min.bro
View file

@ -1,5 +1,5 @@
module Metrics;
module Measurement;
export {
redef enum Calculation += {
@ -7,15 +7,15 @@ export {
MIN
};
redef record ResultVal += {
redef record Result += {
## For numeric data, this tracks the minimum value given.
min: double &log &optional;
};
}
hook add_to_calculation(filter: Filter, val: double, data: DataPoint, result: ResultVal)
hook add_to_reducer(r: Reducer, val: double, data: DataPoint, result: Result)
{
if ( MIN in filter$measure )
if ( MIN in r$apply )
{
if ( ! result?$min )
result$min = val;
@ -24,7 +24,7 @@ hook add_to_calculation(filter: Filter, val: double, data: DataPoint, result: Re
}
}
hook plugin_merge_measurements(result: ResultVal, rv1: ResultVal, rv2: ResultVal)
hook compose_resultvals_hook(result: Result, rv1: Result, rv2: Result)
{
if ( rv1?$min && rv2?$min )
result$min = (rv1$min < rv2$min) ? rv1$min : rv2$min;

45
scripts/base/frameworks/measurement/plugins/sample.bro Normal file
View file

@ -0,0 +1,45 @@
module Measurement;
export {
redef record Reducer += {
## A number of sample DataPoints to collect.
samples: count &default=0;
};
redef record Result += {
## A sample of something being measured. This is helpful in
## some cases for collecting information to do further detection
## or better logging for forensic purposes.
samples: vector of Measurement::DataPoint &optional;
};
}
redef record Result += {
# Internal use only. This is the queue where samples
# are maintained since the queue is self managing for
# the number of samples requested.
sample_queue: Queue::Queue &optional;
};
hook add_to_reducer(r: Reducer, val: double, data: DataPoint, result: Result)
{
if ( r$samples > 0 )
{
if ( ! result?$sample_queue )
result$sample_queue = Queue::init([$max_len=r$samples]);
Queue::push(result$sample_queue, data$str);
}
}
hook compose_resultvals_hook(result: Result, rv1: Result, rv2: Result)
{
# Merge $sample_queue
if ( rv1?$sample_queue && rv2?$sample_queue )
result$sample_queue = Queue::merge(rv1$sample_queue, rv2$sample_queue);
else if ( rv1?$sample_queue )
result$sample_queue = rv1$sample_queue;
else if ( rv2?$sample_queue )
result$sample_queue = rv2$sample_queue;
}

10
scripts/base/frameworks/measurement/plugins/std-dev.bro
View file

@ -1,7 +1,7 @@
@load ./sum
@load ./variance
module Metrics;
module Measurement;
export {
redef enum Calculation += {
@ -9,23 +9,23 @@ export {
STD_DEV
};
redef record ResultVal += {
redef record Result += {
## For numeric data, this calculates the standard deviation.
std_dev: double &log &optional;
};
}
# This depends on the variance plugin which uses priority -5
hook add_to_calculation(filter: Filter, val: double, data: DataPoint, result: ResultVal) &priority=-10
hook add_to_reducer(r: Reducer, val: double, data: DataPoint, result: Result)
{
if ( STD_DEV in filter$measure )
if ( STD_DEV in r$apply )
{
if ( result?$variance )
result$std_dev = sqrt(result$variance);
}
}
hook plugin_merge_measurements(result: ResultVal, rv1: ResultVal, rv2: ResultVal) &priority=-10
hook compose_resultvals_hook(result: Result, rv1: Result, rv2: Result) &priority=-10
{
if ( rv1?$sum || rv2?$sum )
{

10
scripts/base/frameworks/measurement/plugins/sum.bro
View file

@ -1,5 +1,5 @@
module Metrics;
module Measurement;
export {
redef enum Calculation += {
@ -8,15 +8,15 @@ export {
SUM
};
redef record ResultVal += {
redef record Result += {
## For numeric data, this tracks the sum of all values.
sum: double &log &optional;
};
}
hook add_to_calculation(filter: Filter, val: double, data: DataPoint, result: ResultVal)
hook add_to_reducer(r: Reducer, val: double, data: DataPoint, result: Result)
{
if ( SUM in filter$measure )
if ( SUM in r$apply )
{
if ( ! result?$sum )
result$sum = 0;
@ -24,7 +24,7 @@ hook add_to_calculation(filter: Filter, val: double, data: DataPoint, result: Re
}
}
hook plugin_merge_measurements(result: ResultVal, rv1: ResultVal, rv2: ResultVal)
hook compose_resultvals_hook(result: Result, rv1: Result, rv2: Result)
{
if ( rv1?$sum || rv2?$sum )
{

13
scripts/base/frameworks/measurement/plugins/unique.bro
View file

@ -1,5 +1,5 @@
module Metrics;
module Measurement;
export {
redef enum Calculation += {
@ -7,14 +7,14 @@ export {
UNIQUE
};
redef record ResultVal += {
redef record Result += {
## If cardinality is being tracked, the number of unique
## items is tracked here.
unique: count &log &optional;
};
}
redef record ResultVal += {
redef record Result += {
# Internal use only. This is not meant to be publically available
# because we don't want to trust that we can inspect the values
# since we will like move to a probalistic data structure in the future.
@ -22,17 +22,18 @@ redef record ResultVal += {
unique_vals: set[DataPoint] &optional;
};
hook add_to_calculation(filter: Filter, val: double, data: DataPoint, result: ResultVal)
hook add_to_reducer(r: Reducer, val: double, data: DataPoint, result: Result)
{
if ( UNIQUE in filter$measure )
if ( UNIQUE in r$apply )
{
if ( ! result?$unique_vals )
result$unique_vals=set();
add result$unique_vals[data];
result$unique = |result$unique_vals|;
}
}
hook plugin_merge_measurements(result: ResultVal, rv1: ResultVal, rv2: ResultVal)
hook compose_resultvals_hook(result: Result, rv1: Result, rv2: Result)
{
if ( rv1?$unique_vals || rv2?$unique_vals )
{

16
scripts/base/frameworks/measurement/plugins/variance.bro
View file

@ -1,6 +1,6 @@
@load ./average
module Metrics;
module Measurement;
export {
redef enum Calculation += {
@ -8,13 +8,13 @@ export {
VARIANCE
};
redef record ResultVal += {
redef record Result += {
## For numeric data, this calculates the variance.
variance: double &log &optional;
};
}
redef record ResultVal += {
redef record Result += {
# Internal use only. Used for incrementally calculating variance.
prev_avg: double &optional;
@ -22,16 +22,16 @@ redef record ResultVal += {
var_s: double &optional;
};
hook add_to_calculation(filter: Filter, val: double, data: DataPoint, result: ResultVal) &priority=5
hook add_to_reducer(r: Reducer, val: double, data: DataPoint, result: Result)
{
if ( VARIANCE in filter$measure )
if ( VARIANCE in r$apply )
result$prev_avg = result$average;
}
# Reduced priority since this depends on the average
hook add_to_calculation(filter: Filter, val: double, data: DataPoint, result: ResultVal) &priority=-5
hook add_to_reducer(r: Reducer, val: double, data: DataPoint, result: Result) &priority=-5
{
if ( VARIANCE in filter$measure )
if ( VARIANCE in r$apply )
{
if ( ! result?$var_s )
result$var_s = 0.0;
@ -41,7 +41,7 @@ hook add_to_calculation(filter: Filter, val: double, data: DataPoint, result: Re
}
# Reduced priority since this depends on the average
hook plugin_merge_measurements(result: ResultVal, rv1: ResultVal, rv2: ResultVal) &priority=-5
hook compose_resultvals_hook(result: Result, rv1: Result, rv2: Result) &priority=-5
{
if ( rv1?$var_s && rv2?$var_s )
{