com.cysols.iodef.analysis
Class EventAggregator

java.lang.Object
  com.cysols.iodef.analysis.EventAggregator

public class EventAggregator
extends Object

The responsibility of this class is to aggregate the events and to generate AggregatedEvent according to those events. This class is instantiated with AggregatedEventFactory concrete instanse and timeout(sec). This class generate AggregatedEvent by using AggregatedEventFactory according to the inputted Event instances.

The aggregation rule is as follows.
0. T is constant timeout(duration) value; given from the constructor.
1. Each incoming Event is maintained on eventTable.

• eventTable maintains the last update time indexed by the source address,
• those are candidate events

2. When an event comes (by pack(Event) method,

            if ( timestamp (incoming event)
               lastUpdateTime ( eventTable ( source address ) ) < T )
            then
               aggregate the record into corresponding candidate event.
            else
               add it as new candidate event on eventTable.
 

3. Generates AggregatedEvent

       checks all the candidate events on eventTable
        if  (times(now) - lastUpdateTime(candidate event) > T)
        then
           the candidate event is output as Incident
 

When all events are inputted (pack(Event> method), it is necessary to call finish() method. After that, it is possible to call getAggregatedEventCount(), getResultSet() and iterator() methods. The results of aggregation are obtained through those methods.

Constructor Summary

EventAggregator(AggregatedEventFactory factory, long timeout)
Default Constructor, specifying the AggregatedEventFactory and timeout to aggregate the relevant Event instances.

Method Summary

void	finish() Calls post-processing of aggregation by this method.
int	getAggregatedEventCount() Returns the number of the generated AggregatedEvent.
Set<AggregatedEvent>	getResultSet() Returns Set<AggregatedEvent> instance.
Iterator<AggregatedEvent>	iterator() Returns Iterator<AggregatedEvent> instance.
void	pack(Event event) Inputs the Event to this aggregator.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

EventAggregator

public EventAggregator(AggregatedEventFactory factory,
                       long timeout)

Default Constructor, specifying the AggregatedEventFactory and timeout to aggregate the relevant Event instances.

Parameters:

factory - a concrete AggregatedEventFactory instance relating with Events to be analyzed.

timeout - seconds.

Method Detail

pack

public void pack(Event event)

Inputs the Event to this aggregator. Those events are the targets to be aggregated.

Parameters:

event - a concrete Event instance

finish

public void finish()

Calls post-processing of aggregation by this method. It is necessary to call the method after all Events are packed.

getAggregatedEventCount

public int getAggregatedEventCount()

Returns the number of the generated AggregatedEvent. It is returned after finish method is called.

Returns:

the number of generated AggregatedEvent

getResultSet

public Set<AggregatedEvent> getResultSet()

Returns Set<AggregatedEvent> instance. It is returned after finish method is called.

Returns:

Set<AggregatedEvent> instance in which the AggregatedEvent instances are included.

iterator

public Iterator<AggregatedEvent> iterator()

Returns Iterator<AggregatedEvent> instance. It is returned after finish method is called.

Returns:

Iterator<AggregatedEvent> instance from which the AggregatedEvent instances are obtained