public void FeatureEnqueue(Feature F)
{
if (this.LastObservedSession == -1)
{
this.LastObservedSession = F.Keylog.Session;
this.GetSampleCollections();
}
if (F.Keylog.Session != this.LastObservedSession)
{
//New session, old features no longer relevant for outliers
if (!this.BatchProcessingDone)
{
this.ProcessBacklog();
}
this.FeatureQ.Clear();
this.BatchProcessingDone = false;
this.LastObservedSession = F.Keylog.Session;
this.GetSampleCollections();
}
this.FeatureQ.Enqueue(F);
this.RegisteredKeylogs++;
this.Values = FeatureQ.ToArray().Select(x => x.Value).ToArray();
var MAD_return = MedianHelper.FindMAD(this.Values);
this.MAD = MAD_return.Item1;
this.Median = MAD_return.Item2;
if (this.FeatureQ.Count() == this.OutlierSampleSize)
{
if (this.BatchProcessingDone)
{
// We have already processed the sample so just do this latest feature and move on
ProcessFeature(F);
}
else
{
// We need to process all the Features in the queue
this.ProcessBacklog();
}
if (this.TrackMAD == true && this.BatchProcessingDone)
{
// We are tracking deviation and batchprocessing is done so sampelsize reached
this.OutputMAD();
}
this.FeatureQ.Dequeue();
}
}
public void OutputMAD()
{
//how do we handle MAD Samples?
this.CurrentMADSampleCollection.ProcessFeature(FeatureQ.Last().Keylog.Timestamp, this.MAD);
switch (this.OutputFormat)
{
case "CSV":
if (!this.StreamWriters.ContainsKey("MADSW"))
{
this.StreamWriters.Add("MADSW", new System.IO.StreamWriter(String.Format(this.OutputPath, $"{this.Name}_MAD")));
this.StreamWriters["MADSW"].WriteLine(this.DeviationCSVHeader + dotnet_keylogger.keylog.delimeter.ToString() + this.Name + "_MAD");
}
string line = (String.Join(dotnet_keylogger.keylog.delimeter.ToString(), new string[]
{ FeatureQ.Last().Keylog.Timestamp.ToString("o"), FeatureQ.Last().User, this.RegisteredKeylogs.ToString(), this.MAD.ToString() }));
this.StreamWriters["MADSW"].WriteLine(line);
break;
}
}
public double Count()
{
return(FeatureQ.Count());
}
