ait-aecid / aecid-alert-aggregation

A method for grouping, clustering, and merging semi-structured alerts
GNU General Public License v3.0
16 stars 4 forks source link

KeyError Test when running sample.py #2

Closed priamai closed 9 months ago

priamai commented 9 months ago

Hi there, I am running the sample.py to understand the algorithm.

I get this error:

delta = 1: 8 groups in ['data/sample/test_cup.txt']
delta = 10: 2 groups in ['data/sample/test_cup.txt']
delta = 50: 1 groups in ['data/sample/test_cup.txt']
delta = 100: 1 groups in ['data/sample/test_cup.txt']
delta = 1: 16 groups in ['data/sample/test_spiral.txt']
delta = 10: 4 groups in ['data/sample/test_spiral.txt']
delta = 50: 2 groups in ['data/sample/test_spiral.txt']
delta = 100: 1 groups in ['data/sample/test_spiral.txt']
Now processing file 1/2...
 Processing groups with delta=1
Traceback (most recent call last):
  File "/home/robomotic/DevOps/github/aecid-alert-aggregation/samples/sample.py", line 32, in <module>
    label.label_group(group)
  File "/home/robomotic/DevOps/github/aecid-alert-aggregation/preprocessing/label.py", line 31, in label_group
    attack_label = get_phase(logfile, ts)
  File "/home/robomotic/DevOps/github/aecid-alert-aggregation/attacktimes.py", line 36, in get_phase
    for test_phase, interval in phase[scenario].items():
KeyError: 'test'
priamai commented 9 months ago

I understand the issue is that in attacktimes.py there are no phases linked with the test data so the fix is:

def get_phase(scenario, time):
    p = ""
    if scenario not in phase: return p
    for test_phase, interval in phase[scenario].items():
        if  interval[0].timestamp() < time < interval[1].timestamp():
            return test_phase
    return p
priamai commented 9 months ago

Can you check if this is the expected outcome:

delta = 1: 8 groups in ['data/sample/test_cup.txt']
delta = 10: 2 groups in ['data/sample/test_cup.txt']
delta = 50: 1 groups in ['data/sample/test_cup.txt']
delta = 100: 1 groups in ['data/sample/test_cup.txt']
delta = 1: 16 groups in ['data/sample/test_spiral.txt']
delta = 10: 4 groups in ['data/sample/test_spiral.txt']
delta = 50: 2 groups in ['data/sample/test_spiral.txt']
delta = 100: 1 groups in ['data/sample/test_spiral.txt']
Now processing file 1/2...
 Processing groups with delta=1
  Processed group 1/8 with 1 alerts.
  Processed group 2/8 with 1 alerts.
  Processed group 3/8 with 1 alerts.
  Processed group 4/8 with 1 alerts.
  Processed group 5/8 with 1 alerts.
  Processed group 6/8 with 1 alerts.
  Processed group 7/8 with 1 alerts.
  Processed group 8/8 with 1 alerts.
 Processing groups with delta=10
  Processed group 1/2 with 4 alerts.
  Processed group 2/2 with 4 alerts.
 Processing groups with delta=50
  Processed group 1/1 with 8 alerts.
 Processing groups with delta=100
  Processed group 1/1 with 8 alerts.
Now processing file 2/2...
 Processing groups with delta=1
  Processed group 1/16 with 1 alerts.
  Processed group 2/16 with 1 alerts.
  Processed group 3/16 with 1 alerts.
  Processed group 4/16 with 1 alerts.
  Processed group 5/16 with 1 alerts.
  Processed group 6/16 with 1 alerts.
  Processed group 7/16 with 1 alerts.
  Processed group 8/16 with 1 alerts.
  Processed group 9/16 with 1 alerts.
  Processed group 10/16 with 1 alerts.
  Processed group 11/16 with 1 alerts.
  Processed group 12/16 with 1 alerts.
  Processed group 13/16 with 1 alerts.
  Processed group 14/16 with 1 alerts.
  Processed group 15/16 with 1 alerts.
  Processed group 16/16 with 1 alerts.
 Processing groups with delta=10
  Processed group 1/4 with 4 alerts.
  Processed group 2/4 with 4 alerts.
  Processed group 3/4 with 4 alerts.
  Processed group 4/4 with 4 alerts.
 Processing groups with delta=50
  Processed group 1/2 with 8 alerts.
  Processed group 2/2 with 8 alerts.
 Processing groups with delta=100
  Processed group 1/1 with 16 alerts.

Results:
 delta = 1: 2 meta-alerts generated
 delta = 10: 1 meta-alerts generated
 delta = 50: 1 meta-alerts generated
 delta = 100: 2 meta-alerts generated

Meta-alerts are stored in data/out/sample/meta_alerts.txt

Alerts are stored in data/out/sample/alerts.txt
landauermax commented 9 months ago

Thanks for pointing out the issue! I fixed it by correctly loading files starting with "test" and pushed the changes to the master branch.

The outcome is as expected!

priamai commented 9 months ago

Fantastic closing down.