delete anomaly score from ip_statistics

code_boost/src/cxx/statistics.cpp

@@ -268,25 +268,24 @@ void statistics::addIntervalStat(std::chrono::duration<int, std::micro> interval
  * @param dport The destination port.
  * @param timestamp The timestamp of the packet.
  */
-void statistics::addConvStat(std::string ipAddressSender,int sport,std::string ipAddressReceiver,int dport, std::chrono::microseconds timestamp){       
-    
+void statistics::addConvStat(std::string ipAddressSender,int sport,std::string ipAddressReceiver,int dport, std::chrono::microseconds timestamp){
+
     conv f1 = {ipAddressReceiver, dport, ipAddressSender, sport};
     conv f2 = {ipAddressSender, sport, ipAddressReceiver, dport};
-    
-    // if already exist A(ipAddressReceiver, dport), B(ipAddressSender, sport)
+
+    // if already exist A(ipAddressReceiver, dport), B(ipAddressSender, sport) conversation
     if (conv_statistics.count(f1)>0){
-        conv_statistics[f1].pkts_B_A++; // increment packets number from B to A
-        conv_statistics[f1].pkts_B_A_timestamp.push_back(timestamp);
-    
-        // Calculate reply delay considering only delay of first two reply packets (TCP handshake)
-        //if(conv_statistics[f1].pkts_A_B_timestamp.size()>0 && conv_statistics[f1].pkts_A_B_timestamp.size()<=2){
-        conv_statistics[f1].pkts_delay.push_back(std::chrono::duration_cast<std::chrono::microseconds> (timestamp - conv_statistics[f1].pkts_A_B_timestamp.back()));
-        //}
+        conv_statistics[f1].pkts_count++;
+        if(conv_statistics[f1].pkts_count<=3)
+            conv_statistics[f1].pkts_delay.push_back(std::chrono::duration_cast<std::chrono::microseconds> (timestamp - conv_statistics[f1].pkts_timestamp.back()));
+        conv_statistics[f1].pkts_timestamp.push_back(timestamp);
     }
     else{
-        conv_statistics[f2].pkts_A_B++; // increment packets number from A to B
-        conv_statistics[f2].pkts_A_B_timestamp.push_back(timestamp);
-    }        
+        conv_statistics[f2].pkts_count++;
+        if(conv_statistics[f2].pkts_timestamp.size()>0 && conv_statistics[f2].pkts_count<=3 )
+            conv_statistics[f2].pkts_delay.push_back(std::chrono::duration_cast<std::chrono::microseconds> (timestamp - conv_statistics[f2].pkts_timestamp.back()));
+        conv_statistics[f2].pkts_timestamp.push_back(timestamp);
+    }
 }
     
     
@@ -394,92 +393,19 @@ void statistics::addIpStat_packetSent(std::string filePath, std::string ipAddres
     if(ip_statistics[ipAddressSender].pkts_sent==0){  
         // Add the IP class
         ip_statistics[ipAddressSender].ip_class = getIPv4Class(ipAddressSender);
-        
-        // Initialize packet rates
-        /*ip_statistics[ipAddressSender].max_pkt_rate = 0;
-        ip_statistics[ipAddressSender].min_pkt_rate = 0;
-        
-        // Caculate Mahoney anomaly score for ip.src
-        float ipSrc_Mahoney_score = 0;
-        // s_r: The number of IP sources (the different values)
-        // n: The number of the total instances
-        // s_t: The "time" since last anomalous (novel) IP was appeared
-        int s_t = 0, n = 0, s_r = 0;        
-        for (auto i = ip_statistics.begin(); i != ip_statistics.end(); i++) {
-                if (i->second.pkts_sent > 0)
-                    s_r++;
-            }
-        if(s_r > 0){
-            // The number of the total instances
-            n = packetCount;
-            // The packet count when the last novel IP was added as a sender
-            int pktCntNvlSndr = 0;
-            for (auto i = ip_statistics.begin(); i != ip_statistics.end(); i++) {
-                if (pktCntNvlSndr < i->second.firstAppearAsSenderPktCount)
-                    pktCntNvlSndr = i->second.firstAppearAsSenderPktCount;
-            }
-            // The "time" since last anomalous (novel) IP was appeared
-            s_t = packetCount - pktCntNvlSndr + 1;        
-            ipSrc_Mahoney_score = (float)s_t*n/s_r;
-        }
-
-    ip_statistics[ipAddressSender].firstAppearAsSenderPktCount = packetCount;  
-    ip_statistics[ipAddressSender].sourceAnomalyScore = ipSrc_Mahoney_score;
-     */
     }
     
     // Aidmar - Adding IP as a receiver for first time
     if(ip_statistics[ipAddressReceiver].pkts_received==0){
         // Add the IP class
-        ip_statistics[ipAddressReceiver].ip_class = getIPv4Class(ipAddressReceiver); 
-        
-        // Caculate Mahoney anomaly score for ip.dst
-        /*float ipDst_Mahoney_score = 0;
-        // s_r: The number of IP sources (the different values)
-        // n: The number of the total instances
-        // s_t: The "time" since last anomalous (novel) IP was appeared
-        int s_t = 0, n = 0, s_r = 0;        
-        for (auto i = ip_statistics.begin(); i != ip_statistics.end(); i++) {
-                if (i->second.pkts_received > 0)
-                    s_r++;
-            }
-        if(s_r > 0){
-            // The number of the total instances
-            n = packetCount;
-            // The packet count when the last novel IP was added as a sender
-            int pktCntNvlRcvr = 0;
-            for (auto i = ip_statistics.begin(); i != ip_statistics.end(); i++) {
-                if (pktCntNvlRcvr < i->second.firstAppearAsReceiverPktCount)
-                    pktCntNvlRcvr = i->second.firstAppearAsReceiverPktCount;
-            }
-            // The "time" since last anomalous (novel) IP was appeared
-            s_t = packetCount - pktCntNvlRcvr + 1;
-        
-            ipDst_Mahoney_score = (float)s_t*n/s_r;
-        }
-
-    ip_statistics[ipAddressReceiver].firstAppearAsReceiverPktCount = packetCount;
-    ip_statistics[ipAddressReceiver].destinationAnomalyScore = ipDst_Mahoney_score;
-    */
+        ip_statistics[ipAddressReceiver].ip_class = getIPv4Class(ipAddressReceiver);
     }
 
-    
     // Update stats for packet sender
     ip_statistics[ipAddressSender].kbytes_sent += (float(bytesSent) / 1024);
     ip_statistics[ipAddressSender].pkts_sent++;
     // Aidmar
     ip_statistics[ipAddressSender].pktsSentTimestamp.push_back(timestamp);
-    
-    //// Aidmar - calculate packet rate (assumption: max_pkt_rate=1/smallest time between two consecutive pkts)
-    // resulting in very big rates, therefore it could be better to calculate pkt rate on time intervals
-    /*if(ip_statistics[ipAddressSender].pktsSentTimestamp.size() > 0){
-    std::chrono::microseconds temp_pkt_consecutive_time = timestamp - ip_statistics[ipAddressSender].pktsSentTimestamp.back();
-    float temp_pkt_rate = (float) 1000000/temp_pkt_consecutive_time.count(); // pkt per sec = 10**6/micro sec
-    if(temp_pkt_rate > ip_statistics[ipAddressSender].max_pkt_rate || ip_statistics[ipAddressSender].max_pkt_rate == 0)
-        ip_statistics[ipAddressSender].max_pkt_rate = temp_pkt_rate;
-    if(temp_pkt_rate < ip_statistics[ipAddressSender].min_pkt_rate || ip_statistics[ipAddressSender].min_pkt_rate == 0)
-        ip_statistics[ipAddressSender].min_pkt_rate = temp_pkt_rate;
-    }*/
                 
     // Update stats for packet receiver
     ip_statistics[ipAddressReceiver].kbytes_received += (float(bytesSent) / 1024);