Nettisa plugin

[koumajos]

NetTiSA plugin contains features computed by stream-wise computation with take care on efficiency and required memory. The feature set contains following features:

• Mean - Computes mean of the payload lengths of packets
• Min - Minimal value from all packet payload lengths
• Max - Maximum value from all packet payload lengths
• Switching ratio - Represents a switching ratio between different values of the sequence of observation.
• Standard deviation - The standard deviation is measure of the variation of data from the mean.
• Root mean square - The measure of the magnitude of payload lengths of packets.
• Average dispersion - The average absolute difference between each payload length of packet and the mean value.
• Kurtosis - The kurtosis is the measure describing the extent to which the tails of a distribution differ from the tails of a normal distribution
• Mean of scaled times - The scaled times is defined as sequence ({st} = { t_1 - t_1, t_2 - t_1, \dots, t_n - t_1 }). We compute the mean of the value with same method as for feature \textit{Mean}.
• Mean of time differences - The time differences is defined as sequence ({dt} = { t_j - t_i | j = i + 1, i \in {1, 2, \dots, n - 1} }). We compute the mean of the value with same method as for feature \textit{Mean}.
• Min from time differences - Minimal value from all time differences, i.e., min space between packets.
• Max from time differences - Maximum value from all time differences, i.e., max space between packets.

• Time distribution - Describes the distribution of time differences between individual packets.

  The NetTiSA flow increase the network telemetry by only 52 bytes compared to classical flow.

The implementation of the NetTiSA flow requires to store 15 floats for each IP flow, respectively biflow, that is 60 bytes in RAM memory for each flow. Furthermore, when new packet arrives it requires to perform 23 mathematical operations and 5 comparisons. Moreover, before exporting the flow plugin perform 20 additional mathematical operations.

[koumajos]

[codecov-commenter]

Codecov Report

Patch coverage: 4.51% and project coverage change: -0.71 :warning:

Comparison is base (7ac3641) 41.68% compared to head (f29f249) 40.98%.

:exclamation: Current head f29f249 differs from pull request most recent head 4d857a4. Consider uploading reports for the commit 4d857a4 to get more accurate results

Additional details and impacted files

```diff @@ Coverage Diff @@ ## master #160 +/- ## ========================================== - Coverage 41.68% 40.98% -0.71% ========================================== Files 84 86 +2 Lines 8266 8406 +140 Branches 1278 1286 +8 ========================================== - Hits 3446 3445 -1 - Misses 4053 4193 +140 - Partials 767 768 +1 ``` | Flag | Coverage Δ | | |---|---|---| | tests | `40.98% <4.51%> (-0.71%)` | :arrow_down: | Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=CESNET#carryforward-flags-in-the-pull-request-comment) to find out more. | [Impacted Files](https://app.codecov.io/gh/CESNET/ipfixprobe/pull/160?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=CESNET) | Coverage Δ | | |---|---|---| | [process/nettisa.hpp](https://app.codecov.io/gh/CESNET/ipfixprobe/pull/160?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=CESNET#diff-cHJvY2Vzcy9uZXR0aXNhLmhwcA==) | `0.00% <0.00%> (ø)` | | | [process/nettisa.cpp](https://app.codecov.io/gh/CESNET/ipfixprobe/pull/160?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=CESNET#diff-cHJvY2Vzcy9uZXR0aXNhLmNwcA==) | `11.53% <11.53%> (ø)` | | ... and [7 files with indirect coverage changes](https://app.codecov.io/gh/CESNET/ipfixprobe/pull/160/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=CESNET)

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Do you have feedback about the report comment? Let us know in this issue.

[SiskaPavel]

Moved to #161