/*

* =====================================================================================

*

* Filename: correlation.c

*

* Description: Runs the correlation algorithm of the alerts

*

* Version: 0.1

* Created: 07/09/2010 22:04:27

* Revision: none

* Compiler: gcc

*

* Author: BlackLight (http://0x00.ath.cx), <blacklight@autistici.org>

* Licence: GNU GPL v.3

* Company: DO WHAT YOU WANT CAUSE A PIRATE IS FREE, YOU ARE A PIRATE!

*

* =====================================================================================

*/

#include "spp_ai.h"

#include <alloca.h>

#include <math.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <unistd.h>

#include <sys/stat.h>

#include <time.h>

#ifdef HAVE_LIBGVC

#include <gvc.h>

#endif

#ifdef HAVE_LIBPYTHON2_6

/*******************************************/

/* Avoid conflicts with Snort header files */

#ifdef _POSIX_C_SOURCE

#undef _POSIX_C_SOURCE

#endif

#ifdef _XOPEN_C_SOURCE

#undef _XOPEN_C_SOURCE

#endif

#ifdef _XOPEN_SOURCE

#undef _XOPEN_SOURCE

#endif

/*******************************************/

#include <Python.h>

#endif

/** \defgroup correlation Module for the correlation of security alerts

* @{ */

PRIVATE AI_snort_alert *alerts = NULL;

PRIVATE AI_alert_correlation *correlation_table = NULL;

PRIVATE pthread_mutex_t mutex;

/**

* \brief Clean up the correlation hash table

*/

PRIVATE void

__AI_correlation_table_cleanup ()

{

AI_alert_correlation *current;

while ( correlation_table )

{

current = correlation_table;

HASH_DEL ( correlation_table, current );

free ( current );

}

} /* ----- end of function __AI_correlation_table_cleanup ----- */

/**

* \brief Recursively write a flow of correlated alerts to a .dot file, ready for being rendered as graph

* \param corr Correlated alerts

* \param fp File pointer

*/

PRIVATE void

__AI_correlated_alerts_to_dot ( AI_alert_correlation *corr, FILE *fp )

{

int i;

char src_addr1[INET_ADDRSTRLEN],

dst_addr1[INET_ADDRSTRLEN],

src_addr2[INET_ADDRSTRLEN],

dst_addr2[INET_ADDRSTRLEN],

src_port1[10],

dst_port1[10],

src_port2[10],

dst_port2[10];

char *time1 = NULL,

*time2 = NULL;

if ( !corr )

return;

inet_ntop ( AF_INET, &(corr->key.a->ip_src_addr), src_addr1, INET_ADDRSTRLEN );

inet_ntop ( AF_INET, &(corr->key.a->ip_dst_addr), dst_addr1, INET_ADDRSTRLEN );

snprintf ( src_port1, sizeof ( src_port1 ), "%d", ntohs ( corr->key.a->tcp_src_port ));

snprintf ( dst_port1, sizeof ( dst_port1 ), "%d", ntohs ( corr->key.a->tcp_dst_port ));

inet_ntop ( AF_INET, &(corr->key.b->ip_src_addr), src_addr2, INET_ADDRSTRLEN );

inet_ntop ( AF_INET, &(corr->key.b->ip_dst_addr), dst_addr2, INET_ADDRSTRLEN );

snprintf ( src_port2, sizeof ( src_port2 ), "%d", ntohs ( corr->key.b->tcp_src_port ));

snprintf ( dst_port2, sizeof ( dst_port2 ), "%d", ntohs ( corr->key.b->tcp_dst_port ));

time1 = strdup ( ctime ( &(corr->key.a->timestamp )) );

for ( i = strlen ( time1 ) - 1; i >= 0; i-- )

{

if ( time1[i] == '\n' || time1[i] == '\r' || time1[i] == ' ' )

{

time1[i] = 0;

} else {

break;

}

}

time2 = strdup ( ctime ( &(corr->key.b->timestamp )) );

for ( i = strlen ( time2 ) - 1; i >= 0; i-- )

{

if ( time2[i] == '\n' || time2[i] == '\r' || time2[i] == ' ' )

{

time2[i] = 0;

} else {

break;

}

}

fprintf ( fp,

"\t\"[%d.%d.%d] %s\\n"

"%s:%s -> %s:%s\\n"

"starting from %s\\n"

"(%d alerts grouped)\" -> "

"\"[%d.%d.%d] %s\\n"

"%s:%s -> %s:%s\\n"

"starting from %s\\n"

"(%d alerts grouped)\";\n",

corr->key.a->gid, corr->key.a->sid, corr->key.a->rev, corr->key.a->desc,

src_addr1, src_port1, dst_addr1, dst_port1,

time1,

corr->key.a->grouped_alerts_count,

corr->key.b->gid, corr->key.b->sid, corr->key.b->rev, corr->key.b->desc,

src_addr2, src_port2, dst_addr2, dst_port2,

time2,

corr->key.b->grouped_alerts_count

);

free ( time1 );

free ( time2 );

} /* ----- end of function __AI_correlated_alerts_to_dot ----- */

/**

* \brief Recursively write the flow of correlated alerts to a .json file, ready for being rendered in the web interface

*/

PRIVATE void

__AI_correlated_alerts_to_json ()

{

AI_snort_alert *alert_iterator = NULL;

struct pkt_info *pkt_iterator = NULL;

FILE *fp;

unsigned int i = 0,

pkt_len = 0;

char *strtime = NULL,

*encoded_pkt = NULL,

json_file[1040] = { 0 },

srcip[INET_ADDRSTRLEN] = { 0 },

dstip[INET_ADDRSTRLEN] = { 0 },

srcport[10] = { 0 },

dstport[10] = { 0 };

/* If there is no directory configured for the web interface, just exit */

if ( strlen ( config->webserv_dir ) == 0 )

return;

snprintf ( json_file, sizeof ( json_file ), "%s/correlation_graph.json", config->webserv_dir );

if ( !( fp = fopen ( json_file, "w" )))

{

AI_fatal_err ( "Unable to write on correlated_graph.json in htdocs directory", __FILE__, __LINE__ );

}

fprintf ( fp, "[\n" );

for ( alert_iterator = alerts; alert_iterator; alert_iterator = alert_iterator->next )

{

strtime = ctime ( &(alert_iterator->timestamp ));

strtime[ strlen(strtime) - 1 ] = 0;

inet_ntop ( AF_INET, &(alert_iterator->ip_src_addr), srcip, INET_ADDRSTRLEN );

inet_ntop ( AF_INET, &(alert_iterator->ip_dst_addr), dstip, INET_ADDRSTRLEN );

snprintf ( srcport, sizeof ( srcport ), "%d", htons ( alert_iterator->tcp_src_port ));

snprintf ( dstport, sizeof ( dstport ), "%d", htons ( alert_iterator->tcp_dst_port ));

fprintf ( fp, "{\n"

"\t\"id\": %lu,\n"

"\t\"snortSID\": \"%u\",\n"

"\t\"snortGID\": \"%u\",\n"

"\t\"snortREV\": \"%u\",\n"

"\t\"label\": \"%s\",\n"

"\t\"date\": \"%s\",\n"

"\t\"clusteredAlertsCount\": %u,\n"

"\t\"from\": \"%s:%s\",\n"

"\t\"to\": \"%s:%s\",\n"

"\t\"latitude\": \"%f\",\n"

"\t\"longitude\": \"%f\"",

alert_iterator->alert_id,

alert_iterator->sid,

alert_iterator->gid,

alert_iterator->rev,

alert_iterator->desc,

strtime,

alert_iterator->grouped_alerts_count,

srcip, srcport, dstip, dstport,

alert_iterator->geocoord[0],

alert_iterator->geocoord[1]

);

if ( alert_iterator->stream )

{

fprintf ( fp, ",\n"

"\t\"packets\": [\n" );

for ( pkt_iterator = alert_iterator->stream; pkt_iterator; pkt_iterator = pkt_iterator->next )

{

encoded_pkt = NULL;

pkt_len = pkt_iterator->pkt->pcap_header->len + pkt_iterator->pkt->payload_size;

if ( !( encoded_pkt = (char*) calloc ( 4*pkt_len + 1, sizeof ( char ))))

{

AI_fatal_err ( "Fatal dynamic memory allocation", __FILE__, __LINE__ );

}

base64_encode (

(const char*) pkt_iterator->pkt->pkt_data,

pkt_len,

&encoded_pkt

);

fprintf ( fp, "\t\t\"%s\"%s\n",

encoded_pkt, ((pkt_iterator->next) ? "," : ""));

free ( encoded_pkt );

encoded_pkt = NULL;

}

fprintf ( fp, "\t]" );

}

for ( i=1; i < alert_iterator->grouped_alerts_count; i++ )

{

if ( i == 1 )

{

fprintf ( fp, ",\n\t\"clusteredAlerts\": [\n" );

}

if ( alert_iterator->grouped_alerts )

{

if ( alert_iterator->grouped_alerts[i] )

{

strtime = ctime ( &(alert_iterator->grouped_alerts[i]->timestamp ));

strtime[ strlen ( strtime ) - 1 ] = 0;

inet_ntop ( AF_INET, &(alert_iterator->grouped_alerts[i]->ip_src_addr), srcip, INET_ADDRSTRLEN );

inet_ntop ( AF_INET, &(alert_iterator->grouped_alerts[i]->ip_dst_addr), dstip, INET_ADDRSTRLEN );

snprintf ( srcport, sizeof ( srcport ), "%d", htons ( alert_iterator->grouped_alerts[i]->tcp_src_port ));

snprintf ( dstport, sizeof ( dstport ), "%d", htons ( alert_iterator->grouped_alerts[i]->tcp_dst_port ));

fprintf ( fp, "\t\t{\n"

"\t\t\t\"id\": %lu,\n"

"\t\t\t\"label\": \"%s\",\n"

"\t\t\t\"date\": \"%s\",\n"

"\t\t\t\"from\": \"%s:%s\",\n"

"\t\t\t\"to\": \"%s:%s\",\n"

"\t\t\t\"latitude\": \"%f\",\n"

"\t\t\t\"longitude\": \"%f\"%s",

alert_iterator->grouped_alerts[i]->alert_id,

alert_iterator->grouped_alerts[i]->desc,

strtime,

srcip, srcport, dstip, dstport,

alert_iterator->grouped_alerts[i]->geocoord[0],

alert_iterator->grouped_alerts[i]->geocoord[1],

(( alert_iterator->grouped_alerts[i]->stream ) ? ",\n" : "\n" )

);

if ( alert_iterator->grouped_alerts[i]->stream )

{

fprintf ( fp, "\t\t\t\"packets\": [\n" );

for ( pkt_iterator = alert_iterator->grouped_alerts[i]->stream; pkt_iterator; pkt_iterator = pkt_iterator->next )

{

if ( !pkt_iterator->pkt->ip4_header )

{

pkt_len = pkt_iterator->pkt->pcap_header->len +

pkt_iterator->pkt->tcp_options_length +

pkt_iterator->pkt->payload_size;

} else {

pkt_len = pkt_iterator->pkt->ip4_header->data_length;

}

if ( !( encoded_pkt = (char*) malloc ( 4*pkt_len + 1 )))

{

AI_fatal_err ( "Fatal dynamic memory allocation", __FILE__, __LINE__ );

}

memset ( encoded_pkt, 0, 4*pkt_len + 1 );

base64_encode (

(const char*) pkt_iterator->pkt->pkt_data,

pkt_len,

&encoded_pkt

);

fprintf ( fp, "\t\t\t\t\"%s\"%s\n",

encoded_pkt, ((pkt_iterator->next) ? "," : ""));

}

fprintf ( fp, "\t\t\t]\n" );

}

fprintf ( fp,

"\t\t}%s\n",

(( i < alert_iterator->grouped_alerts_count - 1 ) ? "," : "" ));

}

}

if ( i == alert_iterator->grouped_alerts_count - 1 )

{

fprintf ( fp, "\t]" );

}

}

for ( i=0; i < alert_iterator->n_derived_alerts; i++ )

{

if ( i == 0 )

{

fprintf ( fp, ",\n\t\"connectedTo\": [\n" );

}

fprintf ( fp, "\t\t{ \"id\": %lu }%s\n",

alert_iterator->derived_alerts[i]->alert_id,

((i < alert_iterator->n_derived_alerts - 1) ? "," : ""));

if ( i == alert_iterator->n_derived_alerts - 1 )

{

fprintf ( fp, "\t]" );

}

}

fprintf ( fp, "\n}%s\n",

(alert_iterator->next ? "," : ""));

}

fprintf ( fp, "]\n" );

fclose ( fp );

chmod ( json_file, 0644 );

} /* ----- end of function __AI_correlated_alerts_to_json ----- */

/**

* \brief Thread for correlating clustered alerts

*/

void*

AI_alert_correlation_thread ( void *arg )

{

int i;

struct stat st;

char corr_dot_file[4096] = { 0 };

#ifdef HAVE_LIBGVC

char corr_ps_file [4096] = { 0 };

#endif

double avg_correlation = 0.0,

std_deviation = 0.0,

corr_threshold = 0.0,

kb_correlation = 0.0,

bayesian_correlation = 0.0,

neural_correlation = 0.0;

size_t n_correlations = 0,

n_corr_functions = 0,

n_corr_weights = 0;

FILE *fp = NULL;

AI_alert_correlation_key corr_key;

AI_alert_correlation *corr = NULL;

AI_alert_type_pair_key pair_key;

AI_alert_type_pair *pair = NULL,

*unpair = NULL;

AI_snort_alert *alert_iterator = NULL,

*alert_iterator2 = NULL;

pthread_t manual_corr_thread;

#ifdef HAVE_LIBGVC

char corr_png_file[4096] = { 0 };

GVC_t *gvc = NULL;

graph_t *g = NULL;

#endif

double (**corr_functions)( const AI_snort_alert*, const AI_snort_alert* ) = NULL;

double (**corr_weights)() = NULL;

#ifdef HAVE_LIBPYTHON2_6

PyObject *pyA = NULL,

*pyB = NULL;

PyObject *pArgs = NULL,

*pRet = NULL;

PyObject **py_corr_functions = NULL;

PyObject **py_weight_functions = NULL;

size_t n_py_corr_functions = 0;

size_t n_py_weight_functions = 0;

double py_value = 0.0,

py_weight = 0.0;

py_corr_functions = AI_get_py_functions ( &n_py_corr_functions );

py_weight_functions = AI_get_py_weights ( &n_py_weight_functions );

#endif

corr_functions = AI_get_corr_functions ( &n_corr_functions );

corr_weights = AI_get_corr_weights ( &n_corr_weights );

pthread_mutex_init ( &mutex, NULL );

/* Start the thread for parsing manual correlations from XML */

if ( pthread_create ( &manual_corr_thread, NULL, AI_manual_correlations_parsing_thread, NULL ) != 0 )

{

AI_fatal_err ( "Failed to create the manual correlations parsing thread", __FILE__, __LINE__ );

}

while ( 1 )

{

sleep ( config->correlationGraphInterval );

if ( stat ( config->corr_rules_dir, &st ) < 0 )

{

_dpd.errMsg ( "AIPreproc: Correlation rules directory '%s' not found, the correlation thread won't be active\n",

config->corr_rules_dir );

pthread_exit (( void* ) 0 );

return ( void* ) 0;

}

/* Set the lock flag to true, and keep it this way until I've done with correlating alerts */

pthread_mutex_lock ( &mutex );

if ( alerts )

{

AI_free_alerts ( alerts );

alerts = NULL;

}

if ( !( alerts = AI_get_clustered_alerts() ))

{

pthread_mutex_unlock ( &mutex );

continue;

}

if ( config->use_knowledge_base_correlation_index != 0 )

{

AI_kb_index_init ( alerts );

}

__AI_correlation_table_cleanup();

correlation_table = NULL;

/* Fill the table of correlated alerts */

for ( alert_iterator = alerts; alert_iterator; alert_iterator = alert_iterator->next )

{

for ( alert_iterator2 = alerts; alert_iterator2; alert_iterator2 = alert_iterator2->next )

{

if ( alert_iterator != alert_iterator2 && ! (

alert_iterator->gid == alert_iterator2->gid &&

alert_iterator->sid == alert_iterator2->sid &&

alert_iterator->rev == alert_iterator2->rev ))

{

if ( !( corr = ( AI_alert_correlation* ) malloc ( sizeof ( AI_alert_correlation ))))

AI_fatal_err ( "Fatal dynamic memory allocation error", __FILE__, __LINE__ );

corr_key.a = alert_iterator;

corr_key.b = alert_iterator2;

corr->key = corr_key;

corr->correlation = 0.0;

n_correlations = 0;

kb_correlation = AI_kb_correlation_coefficient ( corr_key.a, corr_key.b );

bayesian_correlation = AI_alert_bayesian_correlation ( corr_key.a, corr_key.b );

neural_correlation = AI_alert_neural_som_correlation ( corr_key.a, corr_key.b );

/* Use the correlation indexes for which we have a value */

if ( bayesian_correlation != 0.0 && config->bayesianCorrelationInterval != 0 )

{

corr->correlation += AI_bayesian_correlation_weight() * bayesian_correlation;

n_correlations++;

}

if ( kb_correlation != 0.0 && config->use_knowledge_base_correlation_index )

{

corr->correlation += kb_correlation;

n_correlations++;

}

if ( neural_correlation != 0.0 && config->neuralNetworkTrainingInterval != 0 )

{

corr->correlation += AI_neural_correlation_weight() * neural_correlation;

n_correlations++;

}

/* Get the correlation indexes from extra correlation modules */

if (( corr_functions ))

{

for ( i=0; i < n_corr_functions; i++ )

{

if ( corr_weights[i]() != 0.0 )

{

corr->correlation += corr_weights[i]() * corr_functions[i] ( corr_key.a, corr_key.b );

n_correlations++;

}

}

}

#ifdef HAVE_LIBPYTHON2_6

if (( py_corr_functions ))

{

pyA = AI_alert_to_pyalert ( corr_key.a );

pyB = AI_alert_to_pyalert ( corr_key.b );

if ( pyA && pyB )

{

for ( i=0; i < n_py_corr_functions; i++ )

{

if ( !( pArgs = Py_BuildValue ( "(OO)", pyA, pyB )))

{

PyErr_Print();

AI_fatal_err ( "Could not initialize the Python arguments for the call", __FILE__, __LINE__ );

}

if ( !( pRet = PyEval_CallObject ( py_corr_functions[i], pArgs )))

{

PyErr_Print();

AI_fatal_err ( "Could not call the correlation function from the Python module", __FILE__, __LINE__ );

}

if ( !( PyArg_Parse ( pRet, "d", &py_value )))

{

PyErr_Print();

AI_fatal_err ( "Could not parse the correlation value out of the Python correlation function", __FILE__, __LINE__ );

}

Py_DECREF ( pRet );

Py_DECREF ( pArgs );

if ( !( pRet = PyEval_CallObject ( py_weight_functions[i], (PyObject*) NULL )))

{

PyErr_Print();

AI_fatal_err ( "Could not call the correlation function from the Python module", __FILE__, __LINE__ );

}

if ( !( PyArg_Parse ( pRet, "d", &py_weight )))

{

PyErr_Print();

AI_fatal_err ( "Could not parse the correlation weight out of the Python correlation function", __FILE__, __LINE__ );

}

Py_DECREF ( pRet );

if ( py_weight != 0.0 )

{

corr->correlation += py_weight * py_value;

n_correlations++;

}

}

Py_DECREF ( pyA ); Py_DECREF ( pyB );

/* free ( pyA ); free ( pyB ); */

pyA = NULL; pyB = NULL;

}

}

#endif

if ( n_correlations != 0 )

{

corr->correlation /= (double) n_correlations;

}

HASH_ADD ( hh, correlation_table, key, sizeof ( AI_alert_correlation_key ), corr );

}

}

}

if ( HASH_COUNT ( correlation_table ) > 0 )

{

avg_correlation = 0.0;

std_deviation = 0.0;

/* Compute the average correlation coefficient */

for ( corr = correlation_table; corr; corr = ( AI_alert_correlation* ) corr->hh.next )

{

avg_correlation += corr->correlation;

}

avg_correlation /= (double) HASH_COUNT ( correlation_table );

/* Compute the standard deviation */

for ( corr = correlation_table; corr; corr = ( AI_alert_correlation* ) corr->hh.next )

{

std_deviation += ( corr->correlation - avg_correlation ) * ( corr->correlation - avg_correlation );

}

std_deviation = sqrt ( std_deviation / (double) HASH_COUNT ( correlation_table ));

corr_threshold = avg_correlation + ( config->correlationThresholdCoefficient * std_deviation );

snprintf ( corr_dot_file, sizeof ( corr_dot_file ), "%s/correlated_alerts.dot", config->corr_alerts_dir );

if ( stat ( config->corr_alerts_dir, &st ) < 0 )

{

if ( mkdir ( config->corr_alerts_dir, 0755 ) < 0 )

{

AI_fatal_err ( "Unable to create directory the correlated alerts directory", __FILE__, __LINE__ );

}

} else if ( !S_ISDIR ( st.st_mode )) {

AI_fatal_err ( "The specified directory for correlated alerts is not a directory", __FILE__, __LINE__ );

}

if ( !( fp = fopen ( corr_dot_file, "w" )))

AI_fatal_err ( "Could not write on the correlated alerts .dot file", __FILE__, __LINE__ );

fprintf ( fp, "digraph G {\n" );

/* Find correlated alerts */

for ( corr = correlation_table; corr; corr = ( AI_alert_correlation* ) corr->hh.next )

{

pair_key.from_sid = corr->key.a->sid;

pair_key.from_gid = corr->key.a->gid;

pair_key.from_rev = corr->key.a->rev;

pair_key.to_sid = corr->key.b->sid;

pair_key.to_gid = corr->key.b->gid;

pair_key.to_rev = corr->key.b->rev;

HASH_FIND ( hh, manual_correlations, &pair_key, sizeof ( pair_key ), pair );

HASH_FIND ( hh, manual_uncorrelations, &pair_key, sizeof ( pair_key ), unpair );

/* Yes, BlackLight wrote this line of code in a pair of minutes and immediately

* compiled it without a single error */

if ( !unpair && ( pair || (

corr->correlation >= corr_threshold &&

corr_threshold != 0.0 &&

corr->key.a->timestamp <= corr->key.b->timestamp && ! (

corr->key.a->gid == corr->key.b->gid &&

corr->key.a->sid == corr->key.b->sid &&

corr->key.a->rev == corr->key.b->rev ) && (

corr->key.a->ip_src_addr == corr->key.b->ip_src_addr || (

(corr->key.a->h_node[src_addr] && corr->key.b->h_node[src_addr]) ?

( corr->key.a->h_node[src_addr]->max_val == corr->key.b->h_node[src_addr]->max_val &&

corr->key.a->h_node[src_addr]->min_val == corr->key.b->h_node[src_addr]->min_val ) : 0

)) && (

corr->key.a->ip_dst_addr == corr->key.b->ip_dst_addr || (

(corr->key.a->h_node[dst_addr] && corr->key.b->h_node[dst_addr]) ?

( corr->key.a->h_node[dst_addr]->max_val == corr->key.b->h_node[dst_addr]->max_val &&

corr->key.a->h_node[dst_addr]->min_val == corr->key.b->h_node[dst_addr]->min_val ) : 0

))

)

)

) {

if ( !( corr->key.a->derived_alerts = ( AI_snort_alert** ) realloc ( corr->key.a->derived_alerts,

(++corr->key.a->n_derived_alerts) * sizeof ( AI_snort_alert* ))))

AI_fatal_err ( "Fatal dynamic memory allocation error", __FILE__, __LINE__ );

if ( !( corr->key.b->parent_alerts = ( AI_snort_alert** ) realloc ( corr->key.b->parent_alerts,

(++corr->key.b->n_parent_alerts) * sizeof ( AI_snort_alert* ))))

AI_fatal_err ( "Fatal dynamic memory allocation error", __FILE__, __LINE__ );

corr->key.a->derived_alerts[ corr->key.a->n_derived_alerts - 1 ] = corr->key.b;

corr->key.b->parent_alerts [ corr->key.b->n_parent_alerts - 1 ] = corr->key.a;

__AI_correlated_alerts_to_dot ( corr, fp );

if ( config->outdbtype != outdb_none )

{

AI_store_correlation_to_db ( corr );

}

}

}

fprintf ( fp, "}\n" );

fclose ( fp );

#ifdef HAVE_LIBGVC

snprintf ( corr_png_file, sizeof ( corr_png_file ), "%s/correlated_alerts.png", config->corr_alerts_dir );

snprintf ( corr_ps_file , sizeof ( corr_ps_file ), "%s/correlated_alerts.ps" , config->corr_alerts_dir );

if ( !( gvc = gvContext() ))

{

pthread_mutex_unlock ( &mutex );

continue;

}

if ( !( fp = fopen ( corr_dot_file, "r" )))

{

pthread_mutex_unlock ( &mutex );

continue;

}

if ( !( g = agread ( fp )))

{

pthread_mutex_unlock ( &mutex );

continue;

}

gvLayout ( gvc, g, "dot" );

gvRenderFilename ( gvc, g, "png", corr_png_file );

gvRenderFilename ( gvc, g, "ps" , corr_ps_file );

gvFreeLayout ( gvc, g );

agclose ( g );

fclose ( fp );

#endif

/* If no database output is defined, then the alerts have no alert_id, so we cannot use the

* web interface for correlating them, as they have no unique identifier */

if ( config->outdbtype != outdb_none )

{

if ( strlen ( config->webserv_dir ) != 0 )

{

__AI_correlated_alerts_to_json ();

}

}

}

pthread_mutex_unlock ( &mutex );

}

pthread_exit (( void* ) 0 );

return (void*) 0;

} /* ----- end of function AI_alert_correlation_thread ----- */

/** @} */