Add a "confidence" field about the reliability of the classification. (#1395)

As a general rule, the higher the confidence value, the higher the
"reliability/precision" of the classification.

In other words, this new field provides an hint about "how" the flow
classification has been obtained.
For example, the application may want to ignore classification "by-port"
(they are not real DPI classifications, after all) or give a second
glance at flows classified via LRU caches (because of false positives).

Setting only one value for the confidence field is a bit tricky: more
work is probably needed in the next future to tweak/fix/improve the logic.

3 files changed, 26 insertions, 0 deletions

diff --git a/example/ndpiReader.c b/example/ndpiReader.c
index 46295ffd5..a4f43b729 100644
--- a/example/ndpiReader.c
+++ b/example/ndpiReader.c
@@ -1398,6 +1398,8 @@ static void printFlow(u_int32_t id, struct ndpi_flow_info *flow, u_int16_t threa
 
   fprintf(out, "[%s]",
 	  ndpi_is_encrypted_proto(ndpi_thread_info[thread_id].workflow->ndpi_struct, flow->detected_protocol) ? "Encrypted" : "ClearText");
+
+  fprintf(out, "[Confidence: %s]", ndpi_confidence_get_name(flow->confidence));
   
   if(flow->detected_protocol.category != 0)
     fprintf(out, "[cat: %s/%u]",
@@ -1624,6 +1626,7 @@ static void node_proto_guess_walker(const void *node, ndpi_VISIT which, int dept
     ndpi_thread_info[thread_id].workflow->stats.protocol_counter[proto]       += flow->src2dst_packets + flow->dst2src_packets;
     ndpi_thread_info[thread_id].workflow->stats.protocol_counter_bytes[proto] += flow->src2dst_bytes + flow->dst2src_bytes;
     ndpi_thread_info[thread_id].workflow->stats.protocol_flows[proto]++;
+    ndpi_thread_info[thread_id].workflow->stats.flow_confidence[flow->confidence]++;
   }
 }
 
@@ -2148,6 +2151,8 @@ static void setupDetection(u_int16_t thread_id, pcap_t * pcap_handle) {
 	 sizeof(ndpi_thread_info[thread_id].workflow->stats.protocol_counter_bytes));
   memset(ndpi_thread_info[thread_id].workflow->stats.protocol_flows, 0,
 	 sizeof(ndpi_thread_info[thread_id].workflow->stats.protocol_flows));
+  memset(ndpi_thread_info[thread_id].workflow->stats.flow_confidence, 0,
+	 sizeof(ndpi_thread_info[thread_id].workflow->stats.flow_confidence));
 
   if(_protoFilePath != NULL)
     ndpi_load_protocols_file(ndpi_thread_info[thread_id].workflow->ndpi_struct, _protoFilePath);
@@ -2970,6 +2975,9 @@ static void printResults(u_int64_t processing_time_usec, u_int64_t setup_time_us
     cumulative_stats.dpi_packet_count[0] += ndpi_thread_info[thread_id].workflow->stats.dpi_packet_count[0];
     cumulative_stats.dpi_packet_count[1] += ndpi_thread_info[thread_id].workflow->stats.dpi_packet_count[1];
     cumulative_stats.dpi_packet_count[2] += ndpi_thread_info[thread_id].workflow->stats.dpi_packet_count[2];
+
+    for(i = 0; i < sizeof(cumulative_stats.flow_confidence)/sizeof(cumulative_stats.flow_confidence[0]); i++)
+      cumulative_stats.flow_confidence[i] += ndpi_thread_info[thread_id].workflow->stats.flow_confidence[i];
   }
 
   if(cumulative_stats.total_wire_bytes == 0)
@@ -3068,6 +3076,12 @@ static void printResults(u_int64_t processing_time_usec, u_int64_t setup_time_us
         printf("\tDPI Packets (other):   %-13llu (%.2f pkts/flow)\n",
                (long long unsigned int)cumulative_stats.dpi_packet_count[2],
                cumulative_stats.dpi_packet_count[2] / (float)cumulative_stats.flow_count[2]);
+
+      for(i = 0; i < sizeof(cumulative_stats.flow_confidence)/sizeof(cumulative_stats.flow_confidence[0]); i++) {
+        if(cumulative_stats.flow_confidence[i] != 0)
+          printf("\tConfidence %-17s: %-10llu (flows)\n", ndpi_confidence_get_name(i),
+                 (long long unsigned int)cumulative_stats.flow_confidence[i]);
+      }
   }
 
   if(results_file) {
@@ -3086,6 +3100,14 @@ static void printResults(u_int64_t processing_time_usec, u_int64_t setup_time_us
         fprintf(results_file, "DPI Packets (other):\t%llu\t(%.2f pkts/flow)\n",
                (long long unsigned int)cumulative_stats.dpi_packet_count[2],
                cumulative_stats.dpi_packet_count[2] / (float)cumulative_stats.flow_count[2]);
+
+      for(i = 0; i < sizeof(cumulative_stats.flow_confidence)/sizeof(cumulative_stats.flow_confidence[0]); i++) {
+        if(cumulative_stats.flow_confidence[i] != 0)
+	  fprintf(results_file, "Confidence %-17s: %llu (flows)\n",
+	          ndpi_confidence_get_name(i),
+                  (long long unsigned int)cumulative_stats.flow_confidence[i]);
+      }
+
       fprintf(results_file, "\n");
   }
 
diff --git a/example/reader_util.c b/example/reader_util.c
index 7a2649da4..76729c4c6 100644
--- a/example/reader_util.c
+++ b/example/reader_util.c
@@ -1065,6 +1065,8 @@ void process_ndpi_collected_info(struct ndpi_workflow * workflow, struct ndpi_fl
 
   if(!flow->ndpi_flow) return;
 
+  flow->confidence = flow->ndpi_flow->confidence;
+
   snprintf(flow->host_server_name, sizeof(flow->host_server_name), "%s",
 	   flow->ndpi_flow->host_server_name);
 
diff --git a/example/reader_util.h b/example/reader_util.h
index 89bdd382c..8fc964d6a 100644
--- a/example/reader_util.h
+++ b/example/reader_util.h
@@ -189,6 +189,7 @@ typedef struct ndpi_flow_info {
 
   // result only, not used for flow identification
   ndpi_protocol detected_protocol;
+  ndpi_confidence_t confidence;
 
   // Flow data analysis
   pkt_timeval src2dst_last_pkt_time, dst2src_last_pkt_time, flow_last_pkt_time;
@@ -263,6 +264,7 @@ typedef struct ndpi_stats {
   u_int64_t packet_len[6];
   u_int16_t max_packet_len;
   u_int64_t dpi_packet_count[3];
+  u_int64_t flow_confidence[NDPI_CONFIDENCE_MAX];
 } ndpi_stats_t;