Add frame size calculations.
import statistics
+from numpy import percentile
from networkml.featurizers.features import Features
@@ -7,8 +8,9 @@ class Host(Features):
@staticmethod
def _stat_row_field(statfunc, field, rows):
+ # apply a statistical function, to all rows with a given field.
try:
- return statfunc([float(row[field]) for row in rows if field in row])
+ return statfunc([float(row[field]) for row in filter(lambda row: field in row, rows)])
except (ValueError, statistics.StatisticsError):
return 0
@@ -60,6 +62,16 @@ class Host(Features):
return new_rows
+ def tshark_last_protocols(self, rows):
+ protocols = ''
+ for row in rows:
+ row_protocols = row.get('frame.protocols', None)
+ if row_protocols is not None:
+ protocols = row_protocols
+ new_rows = [{'Protocols': protocols}]
+ return new_rows
+
+
def tshark_ipv4(self, rows):
if 4 in self._tshark_ipversions(rows):
return [{'IPv4': 1}]
@@ -76,19 +88,47 @@ class Host(Features):
new_rows = [{'average_time_delta': self._stat_row_field(statistics.mean, 'frame.time_delta_displayed', rows)}]
return new_rows
+
def tshark_min_time_delta(self, rows):
new_rows = [{'min_time_delta': self._stat_row_field(min, 'frame.time_delta_displayed', rows)}]
return new_rows
+
def tshark_max_time_delta(self, rows):
new_rows = [{'max_time_delta': self._stat_row_field(max, 'frame.time_delta_displayed', rows)}]
return new_rows
- def tshark_last_protocols(self, rows):
- protocols = ''
- for row in rows:
- row_protocols = row.get('frame.protocols', None)
- if row_protocols is not None:
- protocols = row_protocols
- new_rows = [{'Protocols': protocols}]
+
+ def tshark_avg_frame_len(self, rows):
+ new_rows = [{'average_frame_len': self._stat_row_field(statistics.mean, 'frame.len', rows)}]
+ return new_rows
+
+
+ def tshark_min_frame_len(self, rows):
+ new_rows = [{'min_frame_len': self._stat_row_field(min, 'frame.len', rows)}]
+ return new_rows
+
+
+ def tshark_max_frame_len(self, rows):
+ new_rows = [{'max_frame_len': self._stat_row_field(max, 'frame.len', rows)}]
+ return new_rows
+
+
+ def tshark_median_frame_len(self, rows):
+ new_rows = [{'median_frame_len': self._stat_row_field(statistics.median, 'frame.len', rows)}]
+ return new_rows
+
+
+ def tshark_variance_frame_len(self, rows):
+ new_rows = [{'variance_frame_len': self._stat_row_field(statistics.variance, 'frame.len', rows)}]
+ return new_rows
+
+
+ def tshark_25q_frame_len(self, rows):
+ new_rows = [{'25q_frame_len': self._stat_row_field(lambda x: percentile(x, 25), 'frame.len', rows)}]
+ return new_rows
+
+
+ def tshark_75q_frame_len(self, rows):
+ new_rows = [{'75q_frame_len': self._stat_row_field(lambda x: percentile(x, 75), 'frame.len', rows)}]
return new_rows
