huginn_net_db/
db_matching_trait.rs

1use crate::db::Label;
2use std::fmt::Debug;
3use std::hash::Hash;
4
5/// An observed fingerprint from live network traffic or a test case.
6pub trait ObservedFingerprint: Clone + Debug {
7    /// The type of key used to index database signatures compatible with this observed fingerprint.
8    type Key: IndexKey;
9
10    /// Generates an index key from this observed fingerprint.
11    fn generate_index_key(&self) -> Self::Key;
12}
13
14/// A fingerprint signature as defined in a database.
15/// `OF` is the type of `ObservedFingerprint` that this database signature can be compared against.
16pub trait DatabaseSignature<OF: ObservedFingerprint> {
17    /// Calculates a distance or dissimilarity score. Lower is better.
18    fn calculate_distance(&self, observed: &OF) -> Option<u32>;
19
20    /// Returns the quality score based on the distance.
21    fn get_quality_score(&self, distance: u32) -> f32;
22
23    /// Generates index keys from this database signature.
24    /// It's a Vec because some DB signatures (like IpVersion::Any) might map to multiple keys.
25    /// The Option<OF::Key> in the Vec allows for cases where a specific DB sig might not produce a key
26    /// for a certain specific version (e.g. an IpVersion::Any sig, when asked to produce a V4 key, will).
27    fn generate_index_keys_for_db_entry(&self) -> Vec<OF::Key>;
28}
29
30/// Base trait for keys used in fingerprint indexes.
31pub trait IndexKey: Debug + Clone + Eq + Hash {}
32
33/// Represents a collection of database signatures of a specific type.
34/// `OF` is the `ObservedFingerprint` type.
35/// `DS` is the `DatabaseSignature` type that can be compared against `OF`.
36pub trait FingerprintDb<OF: ObservedFingerprint, DS: DatabaseSignature<OF>> {
37    /// Finds the best match for an observed fingerprint within this database.
38    /// Returns the label of the match, the matching database signature, and a quality score.
39    fn find_best_match(&self, observed: &OF) -> Option<(&Label, &DS, f32)>;
40}
41
42pub trait MatchQuality {
43    /// Maximum possible distance for this quality type
44    const MAX_DISTANCE: u32;
45
46    /// Converts distance to a quality score between 0.0 and 1.0
47    fn distance_to_score(distance: u32) -> f32;
48}
huginn_net_db/db_matching_trait.rs

huginn_net_db/
db_matching_trait.rs
