mirror of https://github.com/MISP/MISP
chg: [decaying] `last_seen` takes precedence over `timestamp`
If `last_seen` is set, it will take precedence over the timestamp if no sightings have been recorded. By doing so, we prevent the score to be refreshed if the attribute is slightly modified (a tag is added/removed)pull/5967/head
parent
69f606a6c0
commit
a1548adc53
|
@ -489,27 +489,44 @@ class DecayingModel extends AppModel
|
|||
$this->Sighting = ClassRegistry::init('Sighting');
|
||||
$sightings = $this->Sighting->listSightings($user, $attribute_id, 'attribute', false, 0, false);
|
||||
if (empty($sightings)) {
|
||||
$sightings = array(array('Sighting' => array('date_sighting' => $attribute['Attribute']['timestamp']))); // simulate a Sighting nonetheless
|
||||
if (!is_null($attribute['Attribute']['last_seen'])) {
|
||||
$falseSighting = (new DateTime($attribute['Attribute']['last_seen']))->format('U');
|
||||
} else {
|
||||
$falseSighting = $attribute['Attribute']['timestamp'];
|
||||
}
|
||||
$sightings = array(array('Sighting' => array('date_sighting' => $falseSighting))); // simulate a Sighting nonetheless
|
||||
}
|
||||
foreach ($sightings as $i => $sighting) {
|
||||
$sightings[$i]['Sighting']['rounded_timestamp'] = $this->round_timestamp_to_hour($sighting['Sighting']['date_sighting']);
|
||||
}
|
||||
// get start time
|
||||
$start_time = $attribute['Attribute']['timestamp'];
|
||||
if (!is_null($attribute['Attribute']['last_seen'])) {
|
||||
$start_time = (new DateTime($attribute['Attribute']['last_seen']))->format('U');
|
||||
}
|
||||
$start_time = $sightings[0]['Sighting']['date_sighting'] < $start_time ? $sightings[0]['Sighting']['date_sighting'] : $start_time;
|
||||
$start_time = intval($start_time);
|
||||
$start_time = $this->round_timestamp_to_hour($start_time);
|
||||
// get end time
|
||||
$last_sighting_timestamp = $sightings[count($sightings)-1]['Sighting']['date_sighting'];
|
||||
if ($attribute['Attribute']['timestamp'] > $last_sighting_timestamp) { // The attribute was modified after the last sighting, simulate a Sighting
|
||||
if (!is_null($attribute['Attribute']['timestamp'])) {
|
||||
$falseSighting = (new DateTime($attribute['Attribute']['last_seen']))->format('U');
|
||||
} else {
|
||||
$falseSighting = $attribute['timestamp'];
|
||||
}
|
||||
$sightings[count($sightings)] = array(
|
||||
'Sighting' => array(
|
||||
'date_sighting' => $attribute['Attribute']['timestamp'],
|
||||
'date_sighting' => $falseSighting,
|
||||
'type' => 0,
|
||||
'rounded_timestamp' => $this->round_timestamp_to_hour($attribute['Attribute']['timestamp'])
|
||||
'rounded_timestamp' => $this->round_timestamp_to_hour($falseSighting)
|
||||
)
|
||||
);
|
||||
$last_sighting_timestamp = $attribute['Attribute']['timestamp'];
|
||||
if (!is_null($attribute['Attribute']['timestamp'])) {
|
||||
$last_sighting_timestamp = (new DateTime($attribute['Attribute']['last_seen']))->format('U');
|
||||
} else {
|
||||
$last_sighting_timestamp = $attribute['Attribute']['timestamp'];
|
||||
}
|
||||
}
|
||||
$end_time = $last_sighting_timestamp + $model['DecayingModel']['parameters']['lifetime']*24*60*60;
|
||||
$end_time = $this->round_timestamp_to_hour($end_time);
|
||||
|
|
|
@ -136,12 +136,18 @@ abstract class DecayingModelBase
|
|||
$all_sightings = $this->Sighting->listSightings($user, $attribute['id'], 'attribute', false, 0, true);
|
||||
if (!empty($all_sightings)) {
|
||||
$last_sighting_timestamp = $all_sightings[0]['Sighting']['date_sighting'];
|
||||
} elseif (!is_null($attribute['last_seen'])) {
|
||||
$last_sighting_timestamp = (new DateTime($attribute['last_seen']))->format('U');
|
||||
} else {
|
||||
$last_sighting_timestamp = $attribute['timestamp']; // if no sighting, take the last update time
|
||||
$last_sighting_timestamp = $attribute['timestamp']; // if no sighting nor valid last_seen, take the last update time
|
||||
}
|
||||
}
|
||||
if ($attribute['timestamp'] > $last_sighting_timestamp) { // The attribute was modified after the last sighting
|
||||
$last_sighting_timestamp = $attribute['timestamp'];
|
||||
if (!is_null($attribute['last_seen'])) {
|
||||
$last_sighting_timestamp = (new DateTime($attribute['last_seen']))->format('U');
|
||||
} else {
|
||||
$last_sighting_timestamp = $attribute['timestamp'];
|
||||
}
|
||||
}
|
||||
$timestamp = time();
|
||||
$scores = array(
|
||||
|
|
Loading…
Reference in New Issue