Package be.cylab.mark.detection

Class Frequency

java.lang.Object

be.cylab.mark.detection.Frequency

All Implemented Interfaces:

DetectionAgentInterface

public class Frequency
extends Object
implements DetectionAgentInterface

Perform a frequency analysis over the data regarding this subject. It will trigger an alert if a frequency peak is largely above the average.

The threshold for producing an alert is computed as average + threshold_coeficient * standard deviation.

The score is computed using the relative_peak_value = peak_value / threshold:

• score = 0 if relative_peak_value is less than relative_value_0
• score = 1 if relative_peak_value is more than relative_value_1
• perform linear regression between these values

Parameters:

• time_window in seconds (default 604800 - 1 week)
• sampling_interval in seconds (default 60 seconds)
• min_raw_data (default 50)
• threshold_coeficient (default 6.0)
• relative_value_0 (default 1)
• relative_value_1 (default 3)

Author:

Thibault Debatty

Constructor Summary

Constructors

Constructor	Description
Frequency()

Method Summary

Modifier and Type	Method	Description
void	analyze(Event event, DetectionAgentProfile dap, ServerInterface si)	Analyze function inherited from the DetectionAgentInterface.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

Frequency

public Frequency()

Method Detail

analyze

public final void analyze(Event event,
                          DetectionAgentProfile dap,
                          ServerInterface si)
                   throws Throwable

Analyze function inherited from the DetectionAgentInterface. accepts the subject to analyze trigger of the agent the profile used to load the agent the database to which to connect to gather RawData

Specified by:

analyze in interface DetectionAgentInterface

Parameters:

event -

dap -

si -

Throws:

Throwable