HJQ/tianxuan
2
1
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix: add 11 missing TlsDB columns to type_classifier + entity_aggregator

Browse Source
This commit is contained in:
PM-pinou
2026-07-18 21:05:44 +08:00
parent f4c45e9ec8
commit 7fd081d991
2 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
analysis/entity_aggregator.py
+2 -2
View File
@@ -24,10 +24,10 @@ _agg_logger = logging.getLogger(__name__)
# ---------------------------------------------------------------------------
# Flow stats — user exact column names only
_BYTES_SENT_KEYWORDS = ('8ack',)
_BYTES_SENT_KEYWORDS = ('8ack', '8byt',)
_BYTES_REV_KEYWORDS = () # no user column for reverse bytes
_DURATION_KEYWORDS = ('4dur',)
_PACKETS_KEYWORDS = ('8ppk',)
_PACKETS_KEYWORDS = ('8ppk', '8pak',)
_PACKETS_REV_KEYWORDS = () # no user column for reverse packets
# Destination diversity — user exact column names only
analysis/type_classifier.py
+6 -4
View File
@@ -83,12 +83,12 @@ _NAME_TYPE_MAP: list[tuple[re.Pattern, DataType]] = [
(re.compile(r'^:ips$|^:ipd$|^server.ip$|^client.ip$', re.I), DataType.IPv4),
# ENUM columns
(re.compile(r'^:prs$|^:prd$', re.I), DataType.ENUM),
(re.compile(r'^(?:scnt|dcnt|cnrs|isrs|1ipp|4dbn)$', re.I), DataType.ENUM),
(re.compile(r'^(?:scnt|dcnt|cnrs|isrs|1ipp|4dbn|4srs|eiph)$', re.I), DataType.ENUM),
(re.compile(r'^0ver$', re.I), DataType.ENUM),
# FLOAT columns
(re.compile(r'^4dur$|^8ses$|^2tmo$|^0rnt$', re.I), DataType.FLOAT),
# INT columns
(re.compile(r'^4ksz$|^8ack$|^8ppk$|^row$', re.I), DataType.INT),
(re.compile(r'^4ksz$|^8ack$|^8ppk$|^8pak$|^8seq$|^8did$|^8byt$|^row$', re.I), DataType.INT),
# HEX columns
(re.compile(r'^0cph$|^0crv$', re.I), DataType.HEX),
# TIMESTAMP columns
@@ -97,9 +97,11 @@ _NAME_TYPE_MAP: list[tuple[re.Pattern, DataType]] = [
(re.compile(r'\.latd$', re.I), DataType.LAT_LON),
(re.compile(r'\.lond$', re.I), DataType.LAT_LON),
# Dot-notation STRING suffixes (e.g. :ips.ispn, :ipd.city)
(re.compile(r'\.(ispn|orgn|city)$', re.I), DataType.STRING),
(re.compile(r'\.(ispn|orgn|city|anon)$', re.I), DataType.STRING),
# Standalone string columns - exact match
(re.compile(r'^(?:cnam|snam|tabl|name|0rnd|source.node|ecdhe.named.curve)$', re.I), DataType.STRING),
(re.compile(r'^(?:cnam|snam|tabl|name|0rnd|source.node|ecdhe.named.curve|crcc|orga|orgu)$', re.I), DataType.STRING),
# Special columns with @ prefix
(re.compile(r'^@', re.I), DataType.STRING),
]
# Mapping from config.yaml type strings to DataType