Add a "confidence" field about the reliability of the classification. (#1395)

As a general rule, the higher the confidence value, the higher the
"reliability/precision" of the classification.

In other words, this new field provides an hint about "how" the flow
classification has been obtained.
For example, the application may want to ignore classification "by-port"
(they are not real DPI classifications, after all) or give a second
glance at flows classified via LRU caches (because of false positives).

Setting only one value for the confidence field is a bit tricky: more
work is probably needed in the next future to tweak/fix/improve the logic.

1 files changed, 2 insertions, 0 deletions

diff --git a/example/reader_util.h b/example/reader_util.h
index 89bdd382c..8fc964d6a 100644
--- a/example/reader_util.h
+++ b/example/reader_util.h
@@ -189,6 +189,7 @@ typedef struct ndpi_flow_info {
 
   // result only, not used for flow identification
   ndpi_protocol detected_protocol;
+  ndpi_confidence_t confidence;
 
   // Flow data analysis
   pkt_timeval src2dst_last_pkt_time, dst2src_last_pkt_time, flow_last_pkt_time;
@@ -263,6 +264,7 @@ typedef struct ndpi_stats {
   u_int64_t packet_len[6];
   u_int16_t max_packet_len;
   u_int64_t dpi_packet_count[3];
+  u_int64_t flow_confidence[NDPI_CONFIDENCE_MAX];
 } ndpi_stats_t;