vrr/nDPI
2
0
Fork 0
mirror of https://github.com/vel21ripn/nDPI.git synced 2026-08-13 18:44:02 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

Configure improvements

Browse source 
Fixed invalid anomaly detection in rrd_anomaly
This commit is contained in:
Luca Deri 2021-12-04 13:21:57 +01:00
parent fe2822c6a8
commit fb85dac905
3 changed files with 38 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

8
configure.ac
View file

@ -106,8 +106,14 @@ CFLAGS="-W -Wall -Wno-unused-parameter -Wno-unused-function $CFLAGS $JSONC_CFLAG
AC_CHECK_HEADERS([netinet/in.h stdint.h stdlib.h string.h unistd.h math.h float.h])
AC_CHECK_LIB([m], [sqrt], [], [LIBM="-lm"])
AC_CHECK_LIB([rrd], [rrd_fetch_r], [LIBRRD=-lrrd])
ADDITIONAL_LIBS="$LIBM"
if test "x$ac_cv_lib_rrd_rrd_fetch_r" = xyes; then :
AC_DEFINE_UNQUOTED(HAVE_RRDTOOL, "1", [rrdtool is present])
EXTRA_TARGETS="rrdtool"
fi
ADDITIONAL_LIBS="$LIBRRD $LIBM"
PCAP_HOME=$HOME/PF_RING/userland
DPDK_TARGET=

7
rrdtool/Makefile.in
View file

@ -3,10 +3,15 @@ INC=-I ../src/include
LIBDPI=../src/lib/libndpi.a
LIB=$(LIBDPI) -lrrd -lm @LIBS@ @ADDITIONAL_LIBS@ @LDFLAGS@
all: rrd_anomaly rrd_similarity
TOOLS=rrd_anomaly rrd_similarity
all: $(TOOLS)
rrd_anomaly: rrd_anomaly.c Makefile $(LIBDPI)
$(CC) -g $(INC) rrd_anomaly.c -o rrd_anomaly $(LIB)
rrd_similarity: rrd_similarity.c Makefile $(LIBDPI)
$(CC) -g $(INC) rrd_similarity.c -o rrd_similarity $(LIB)
clean:
/bin/rm -f *.o $(TOOLS) *~

37
rrdtool/rrd_anomaly.c
View file

@ -26,19 +26,21 @@
#include "ndpi_api.h"
#define DEFAULT_ALPHA 0.5
#define DEFAULT_RO 0.05
#define DEFAULT_START "now-1d"
#define DEFAULT_END "now"
/* *************************************************** */
static void help() {
printf("Usage: rrd_anomaly [-a <alpha>][-e <end>][-q][-s <start>] -f <filename>\n"
printf("Usage: rrd_anomaly [-v][-a <alpha>][-e <end>][-q][-s <start>] -f <filename>\n"
"-a | Set alpha. Valid range >0 .. <1. Default %.2f\n"
"-e <end> | RRD end time. Default %s\n"
"-q | Quick output (only anomalies are reported)\n"
"-s <start> | RRD start time. Default %s\n"
"-f <rrd path> | Path of the RRD filename to analyze\n",
"-f <rrd path> | Path of the RRD filename to analyze\n"
"-v | Verbose\n"
,
DEFAULT_ALPHA, DEFAULT_END, DEFAULT_START);
printf("\n\nExample: rrd_anomaly -q -f hum.rrd\n");
@ -52,10 +54,10 @@ int main(int argc, char *argv[]) {
unsigned long step = 0, ds_cnt = 0;
rrd_value_t *data, *p;
char **names, *filename = NULL, *start_s, *end_s, *cf;
u_int i, j, t, first = 1, quick_mode = 0;
u_int i, j, t, first = 1, quick_mode = 0, verbose = 0;
time_t start, end;
struct ndpi_ses_struct ses;
float alpha;
float alpha, ro;
char c;
/* Defaults */
@ -63,8 +65,9 @@ int main(int argc, char *argv[]) {
start_s = DEFAULT_START;
end_s = DEFAULT_END;
cf = "AVERAGE";
while((c = getopt(argc, argv, "s:e:a:qf:")) != '?') {
ro = DEFAULT_RO;
while((c = getopt(argc, argv, "s:e:a:qf:r:v")) != '?') {
if(c == -1) break;
switch(c) {
@ -95,6 +98,16 @@ int main(int argc, char *argv[]) {
filename = optarg;
break;
case 'r':
ro = atof(optarg);
if((ro <= 0) || (ro >= 1))
ro = DEFAULT_RO;
break;
case 'v':
verbose = 1;
break;
default:
help();
break;
@ -104,7 +117,7 @@ int main(int argc, char *argv[]) {
if(filename == NULL)
help();
ndpi_ses_init(&ses, alpha, 0.05);
ndpi_ses_init(&ses, alpha, ro);
if((rrd_parsetime(start_s, &start_tv) != NULL)) {
printf("Unable to parse start time %s\n", start_s);
@ -136,12 +149,12 @@ int main(int argc, char *argv[]) {
int rc;
u_int is_anomaly;
value *= 100;
value *= 100; /* trick to avoid dealing with floats */
rc = ndpi_ses_add_value(&ses, value, &prediction, &confidence_band);
lower = prediction - confidence_band, upper = prediction + confidence_band;
is_anomaly = ((rc == 0) || ((value >= lower) && (value <= upper))) ? 0 : 1;
if(is_anomaly) {
is_anomaly = ((rc == 0) || (confidence_band == 0) || ((value >= lower) && (value <= upper))) ? 0 : 1;
if(verbose || is_anomaly) {
if(quick_mode) {
printf("%u\n", t);
} else {