Skip to content

Fix and rename IP activity classifier #35

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dbnk0 merged 2 commits into from
Feb 6, 2026
Merged

Fix and rename IP activity classifier #35

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
91b4bf9
rename(ip_activity_classifier): rename from IP activity
dbnk0 Feb 5, 2026
0e88cdf
fix(ip_activity_classifier): use bidirectional flows
dbnk0 Feb 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion dp3_server/config/processing_core.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,6 @@ modules_dir: "../modules"
# extension must be used!
enabled_modules:
- "dns_open_resolver"
- "ip_activity"
- "ip_activity_classifier"
- "ip_filter"
- "ip_to_dns_hostname"
14 changes: 9 additions & 5 deletions dp3_server/modules/ip_activity.py → dp3_server/modules/ip_activity_classifier.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,13 +7,17 @@
from dp3.common.task import DataPointTask


class IPactivity(BaseModule):
def __init__(self, platform_config: PlatformConfig, _, registrar: CallbackRegistrar):
class IPActivityClassifier(BaseModule):
def __init__(
self, platform_config: PlatformConfig, _, registrar: CallbackRegistrar
):
super().__init__(platform_config, {}, registrar)
registrar.register_on_new_attr_hook(self.processing_function, "ip", "activity")

def processing_function(self, eid: str, dp: DataPointTimeseriesBase) -> List[DataPointTask]:
avg_bytes_per_time_step = sum(dp.v.bytes) / len(dp.v.bytes)
def processing_function(
self, eid: str, dp: DataPointTimeseriesBase
) -> List[DataPointTask]:
avg_bytes_per_time_step = sum(dp.v.out_bytes) / len(dp.v.out_bytes)

act_class = self.ip_act(avg_bytes_per_time_step)

Expand All @@ -27,7 +31,7 @@ def processing_function(self, eid: str, dp: DataPointTimeseriesBase) -> List[Dat
"etype": "ip",
"eid": eid,
"attr": "activity_class",
"src": "secondary/ip_activity",
"src": "secondary/ip_activity_classifier",
"v": act_class,
}
],
Expand Down