Changes between Version 4 and Version 5 of waue/2009/0804

Timestamp:

Aug 4, 2009, 5:07:20 PM (15 years ago)

Author:

waue

Comment:

--

waue/2009/0804

@@ +1 @@
+
+{{{
+Merge Algorithm 
+output: correlated_event queue
+global: event_scenario , MO_win_size
+
+1. pull the top event
+2. if OO_events queue == NULL
+3. new OO_events as event_scenario in event queue
+4. OO_events inherit event
+5. while event-queue ≠ NULL
+{
+6. pull the top event
+7. if event.timestamp < ( OO_events.end_time + win_size )
+8. Search a correlated_event in correlated_event queue that correlated_event.{ IP_dst,
+port_dst,signature } == event.{ IP_dst, port_dst, signature }
+9. correlated_event _event.endtime  max(event.endtime, MO_event.endtime)
+10. correlated_event.reference append (event.id )
+11. correlated_event.IP_src  correlated_event. IP_ src ∪ event. IP_ src
+correlated_event t.port_src  correlated_event. port_src ∪ event. port_ src
+12. else
+13. new OO_events as event_scenario in event queue
+14. OO_events inherit event
+}
+15 return correlated_event queue
+
+…
+
+}}}
+
 
  * the merge component of SEC