Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix learning method matches for the detected events #322

Open
syncpark opened this issue Aug 12, 2024 · 1 comment
Open

Fix learning method matches for the detected events #322

syncpark opened this issue Aug 12, 2024 · 1 comment

Comments

@syncpark
Copy link
Contributor

syncpark commented Aug 12, 2024

In src/event.rs, the learning methods are defined as follows:

/// in src/event.rs
/// Machine Learning Method.
#[derive(Clone, Copy, Eq, PartialEq, Deserialize, Serialize)]
pub enum LearningMethod {
    Unsupervised,
    SemiSupervised,
}

After the EventCategory::HttpThreat is replaced to EventCategory::Reconnaissance, the following code in src/event/common.rs may return incorrect results.

if let Some(learning_methods) = &filter.learning_methods {
let category = self.category();
if learning_methods.iter().all(|learning_method| {
let unsuper = matches!(*learning_method, LearningMethod::Unsupervised);
let http = matches!(category, EventCategory::Reconnaissance);
unsuper && !http || !unsuper && http
}) {
return Ok((false, None));
}
}

Tasks:

  • The matching code must be modified to return correct results.
  • And the learning methods of the detected events need to be assigned when the detected events are generated.
@syncpark
Copy link
Contributor Author

To solve this issue, all event structures must contain LearningMethod value and implement learning_method() function.

@sehkone sehkone pinned this issue Dec 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant