Implements ndpi_pearson_correlation for measuring how correlated are two series

1 files changed, 34 insertions, 13 deletions

diff --git a/src/include/ndpi_api.h b/src/include/ndpi_api.h
index 168014c2e..9200fcbf5 100644
--- a/src/include/ndpi_api.h
+++ b/src/include/ndpi_api.h
@@ -360,7 +360,8 @@ extern "C" {
    * @return the ID of the app protocol detected
    *
    */
-  u_int16_t ndpi_get_flow_appprotocol(struct ndpi_detection_module_struct *ndpi_str, struct ndpi_flow_struct *flow);
+  u_int16_t ndpi_get_flow_appprotocol(struct ndpi_detection_module_struct *ndpi_str,
+				      struct ndpi_flow_struct *flow);
 
   /**
    * Get the category of the passed flows for the detected module
@@ -371,7 +372,8 @@ extern "C" {
    * @return the ID of the category
    *
    */
-  ndpi_protocol_category_t ndpi_get_flow_category(struct ndpi_detection_module_struct *ndpi_str, struct ndpi_flow_struct *flow);
+  ndpi_protocol_category_t ndpi_get_flow_category(struct ndpi_detection_module_struct *ndpi_str,
+						  struct ndpi_flow_struct *flow);
 
   /**
    * Get the ndpi protocol data of the passed flows for the detected module
@@ -382,8 +384,9 @@ extern "C" {
    * @par    ndpi_proto   = the output struct where to store the requested information
    *
    */
-  void ndpi_get_flow_ndpi_proto(struct ndpi_detection_module_struct *ndpi_str, struct ndpi_flow_struct *flow,
-                    struct ndpi_proto * ndpi_proto);
+  void ndpi_get_flow_ndpi_proto(struct ndpi_detection_module_struct *ndpi_str,
+				struct ndpi_flow_struct *flow,
+				struct ndpi_proto * ndpi_proto);
 
   /**
    * API call that is called internally by ndpi_detection_process_packet or by apps
@@ -415,7 +418,8 @@ extern "C" {
    else != 0
    *
    */
-  u_int8_t ndpi_detection_get_l4(const u_int8_t *l3, u_int16_t l3_len, const u_int8_t **l4_return, u_int16_t *l4_len_return,
+  u_int8_t ndpi_detection_get_l4(const u_int8_t *l3, u_int16_t l3_len,
+				 const u_int8_t **l4_return, u_int16_t *l4_len_return,
 				 u_int8_t *l4_protocol_return, u_int32_t flags);
 
   /**
@@ -430,10 +434,8 @@ extern "C" {
    *
    */
   ndpi_protocol ndpi_find_port_based_protocol(struct ndpi_detection_module_struct *ndpi_struct/* , u_int8_t proto */,
-					      u_int32_t shost,
-					      u_int16_t sport,
-					      u_int32_t dhost,
-					      u_int16_t dport);
+					      u_int32_t shost, u_int16_t sport,
+					      u_int32_t dhost, u_int16_t dport);
   /**
    * Search and return the protocol guessed that is undetected
    *
@@ -463,10 +465,8 @@ extern "C" {
   ndpi_protocol ndpi_guess_undetected_protocol_v4(struct ndpi_detection_module_struct *ndpi_struct,
 						  struct ndpi_flow_struct *flow,
 						  u_int8_t proto,
-						  u_int32_t shost,
-						  u_int16_t sport,
-						  u_int32_t dhost,
-						  u_int16_t dport);
+						  u_int32_t shost, u_int16_t sport,
+						  u_int32_t dhost, u_int16_t dport);
   /**
    * Check if the string passed match with a protocol
    *
@@ -1742,6 +1742,7 @@ extern "C" {
 
   /* Data analysis */
   struct ndpi_analyze_struct* ndpi_alloc_data_analysis(u_int16_t _max_series_len);
+  struct ndpi_analyze_struct* ndpi_alloc_data_analysis_from_series(const u_int32_t *values, u_int16_t num_values);
   void ndpi_init_data_analysis(struct ndpi_analyze_struct *s, u_int16_t _max_series_len);
   void ndpi_free_data_analysis(struct ndpi_analyze_struct *d, u_int8_t free_pointer);
   void ndpi_reset_data_analysis(struct ndpi_analyze_struct *d);
@@ -1928,6 +1929,26 @@ extern "C" {
 
   /* ******************************* */
 
+  /*
+   * Checks if the two series are correlated using the
+   * Pearson correlation coefficient that is a value in the -1..0..+1 range
+   * where:
+   * -1 < x < 0   Negative correlation (when one changes the other series changes in opposite direction)
+   * x = 0        No correlation       (no relationship between the series)
+   * 0 < x < 1    Positive correlation (when one changes the other series changes in the same direction)
+   * (i.e. when a series increases, the other also increase and vice-versa)
+   *
+   * @par    values_a   = First series with num_values values
+   * @par    values_b   = Second series with num_values values
+   * @par    num_values = Number of series entries
+   *
+   * @return pearson correlation coefficient
+   *
+   */
+  double ndpi_pearson_correlation(u_int32_t *values_a, u_int32_t *values_b, u_int16_t num_values);
+  
+  /* ******************************* */
+
   u_int32_t ndpi_quick_16_byte_hash(u_int8_t *in_16_bytes_long);
 
   /* ******************************* */