void *ClassificationLoop(void *ptr)
{
MaskKillSignals();
//Builds the Silent Alarm Network address
serv_addr.sin_family = AF_INET;
serv_addr.sin_port = htons(Config::Inst()->GetSaPort());
//Classification Loop
do
{
sleep(Config::Inst()->GetClassificationTimeout());
CheckForDroppedPackets();
//Calculate the "true" Feature Set for each Suspect
vector<uint64_t> updateKeys = suspects.GetKeys_of_ModifiedSuspects();
for(uint i = 0; i < updateKeys.size(); i++)
{
UpdateAndClassify(updateKeys[i]);
}
engine->m_dopp->UpdateDoppelganger();
if(Config::Inst()->GetSaveFreq() > 0)
{
if((time(NULL) - lastSaveTime) > Config::Inst()->GetSaveFreq())
{
AppendToStateFile();
}
}
if(Config::Inst()->GetDataTTL() > 0)
{
if((time(NULL) - lastLoadTime) > Config::Inst()->GetDataTTL())
{
AppendToStateFile();
suspects.EraseAllSuspects();
RefreshStateFile();
LoadStateFile();
}
}
}while(Config::Inst()->GetClassificationTimeout() && !Config::Inst()->GetReadPcap());
if(Config::Inst()->GetReadPcap())
{
return NULL;
}
//Shouldn't get here!!
if(Config::Inst()->GetClassificationTimeout())
{
LOG(CRITICAL, "The code should never get here, something went very wrong.", "");
}
return NULL;
}
void *ClassificationLoop(void *ptr)
{
MaskKillSignals();
//Classification Loop
do
{
struct timespec timespec;
struct timeval timeval;
gettimeofday(&timeval, NULL);
timespec.tv_sec = timeval.tv_sec;
timespec.tv_nsec = timeval.tv_usec*1000;
timespec.tv_sec += Config::Inst()->GetClassificationTimeout();
{
//Protection for the queue structure
Lock lock(&shutdownClassificationMutex);
//While loop to protect against spurious wakeups
while(!shutdownClassification)
{
if(pthread_cond_timedwait(&shutdownClassificationCond, &shutdownClassificationMutex, ×pec) == ETIMEDOUT)
{
break;
}
}
if(shutdownClassification)
{
return NULL;
}
}
CheckForDroppedPackets();
Database::Inst()->m_count = 0;
suspects.WriteToDatabase();
doppel->UpdateDoppelganger();
}while(Config::Inst()->GetClassificationTimeout() && !Config::Inst()->GetReadPcap());
if(Config::Inst()->GetReadPcap())
{
return NULL;
}
//Shouldn't get here!!
if(Config::Inst()->GetClassificationTimeout())
{
LOG(CRITICAL, "The code should never get here, something went very wrong.", "");
}
return NULL;
}
