MISP
/
MISP
mirror of https://github.com/MISP/MISP
2
2
Fork 0
Code Issues Releases Wiki Activity

fix: [decaying:basescoreComputation] Correctly support 2-tag and 3-tag

nibbler
mokaddem 2019-12-04 12:12:10 +01:00
parent f690c2c8e8
commit da4e9e45d8
No known key found for this signature in database
GPG Key ID: 164C473F627A06FA
1 changed files with 35 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
app/Model/DecayingModelsFormulas/Base.php
View File

@ -6,8 +6,30 @@ abstract class DecayingModelBase
return 'BONFIRE LIT'; return 'BONFIRE LIT';
} }
protected function __extractTagBasename($tagName) {
$pieces = array();
if (preg_match('/^[^:="]+:[^:="]+="[^:="]+"$/i', $tagName)) {
$temp = explode(':', $tagName);
$pieces = array_merge(array($temp[0]), explode('=', $temp[1]));
$pieces['complete'] = $tagName;
$pieces['namespace'] = $pieces[0];
$pieces['predicate'] = $pieces[1];
$pieces['2tag'] = sprintf('%s:%s', $pieces[0], $pieces[1]);
$pieces['base'] = sprintf('%s:%s', $pieces[0], $pieces[1]);
} elseif (preg_match('/^[^:="]+:[^:="]+$/i', $tagName)) {
$pieces = explode(':', $tagName);
$pieces['complete'] = $tagName;
$pieces['namespace'] = $pieces[0];
$pieces['predicate'] = $pieces[1];
$pieces['2tag'] = sprintf('%s:%s', $pieces[0], $pieces[1]);
$pieces['base'] = $pieces[0];
}
return $pieces;
}
// Get effective taxonomy ratio based on taxonomies attached to the attribute // Get effective taxonomy ratio based on taxonomies attached to the attribute
// Basically, it adapts the ratio defined in the model to fit the actual attached tags // Basically, it adapts the ratio defined in the model to fit the actual attached tags
protected function __getRatioScore($model, $tags) protected function __getRatioScore($model, $tags)
{ {
$ratioScore = array(); $ratioScore = array();
@ -17,21 +39,21 @@ abstract class DecayingModelBase
} }
$total_score = 0.0; $total_score = 0.0;
foreach ($tags as $tag) { foreach ($tags as $tag) {
$namespace_predicate = explode('=', $tag['Tag']['name'])[0]; $tagBaseName = $this->__extractTagBasename($tag['Tag']['name'])['base'];
if (isset($taxonomy_base_ratio[$namespace_predicate]) && is_numeric($tag['Tag']['numerical_value'])) { if (isset($taxonomy_base_ratio[$tagBaseName]) && is_numeric($tag['Tag']['numerical_value'])) {
$total_score += floatval($taxonomy_base_ratio[$namespace_predicate]); $total_score += floatval($taxonomy_base_ratio[$tagBaseName]);
} }
} }
foreach ($tags as $i => $tag) { foreach ($tags as $i => $tag) {
$namespace_predicate = explode('=', $tag['Tag']['name'])[0]; $tagBaseName = $this->__extractTagBasename($tag['Tag']['name'])['base'];
if (isset($taxonomy_base_ratio[$namespace_predicate]) && is_numeric($tag['Tag']['numerical_value'])) { if (isset($taxonomy_base_ratio[$tagBaseName]) && is_numeric($tag['Tag']['numerical_value'])) {
$ratioScore[$namespace_predicate] = floatval($taxonomy_base_ratio[$namespace_predicate]) / $total_score; $ratioScore[$tagBaseName] = floatval($taxonomy_base_ratio[$tagBaseName]) / $total_score;
} }
} }
return $ratioScore; return $ratioScore;
} }
// return attribute tag with event tag matching the namespace+predicate overridden // return attribute tag with event tag matching the tag basename overridden
protected function __getPrioritisedTag($attribute) protected function __getPrioritisedTag($attribute)
{ {
$tags = array(); $tags = array();
@ -40,15 +62,15 @@ abstract class DecayingModelBase
if (isset($attribute['EventTag'])) { if (isset($attribute['EventTag'])) {
foreach ($attribute['EventTag'] as $i => $tag) { foreach ($attribute['EventTag'] as $i => $tag) {
$tags[] = $tag; $tags[] = $tag;
$namespace_predicate = explode('=', $tag['Tag']['name'])[0]; $tagBaseName = $this->__extractTagBasename($tag['Tag']['name'])['base'];
$temp_mapping[$namespace_predicate][] = $i; $temp_mapping[$tagBaseName][] = $i;
} }
} }
if (isset($attribute['AttributeTag'])) { if (isset($attribute['AttributeTag'])) {
foreach ($attribute['AttributeTag'] as $tag) { foreach ($attribute['AttributeTag'] as $tag) {
$namespace_predicate = explode('=', $tag['Tag']['name'])[0]; $tagBaseName = $this->__extractTagBasename($tag['Tag']['name'])['base'];
if (!empty($temp_mapping[$namespace_predicate])) { // need to override event tag if (!empty($temp_mapping[$tagBaseName])) { // need to override event tag
foreach ($temp_mapping[$namespace_predicate] as $i => $eventtag_index) { foreach ($temp_mapping[$tagBaseName] as $i => $eventtag_index) {
$overridden_tags[] = array( $overridden_tags[] = array(
'EventTag' => $tags[$eventtag_index], 'EventTag' => $tags[$eventtag_index],
'AttributeTag' => $tag 'AttributeTag' => $tag