| 77 | } |
| 78 | } |
| 79 | //----remove timeout class---- |
| 80 | //====many2one check=== |
| 81 | for($i=$mo_ptr; $i<$mo_ctr ;$i++) |
| 82 | { |
| 83 | if($object[$obj_ptr]->ip_dst[0] == $object[$i]->ip_dst[0]) |
| 84 | { |
| 85 | // if($object[$obj_ptr]->dport[0] == $object[$i]->dport[0]) |
| 86 | // { |
| 87 | if($object[$obj_ptr]->signature[0] == $object[$i]->signature[0]) |
| 88 | { |
| 89 | //-------------------------merge---------------------------- |
| 90 | $object[$i]->reference=($object[$i]->reference).", ".($object[$obj_ptr]->reference); |
| 91 | if( $object[$i]->ip_proto!=$object[$obj_ptr]->ip_proto ) $object[$i]->ip_proto="multiproto"; |
| 92 | $object[$i]->ip_src=arr_merge($object[$obj_ptr]->ip_src,$object[$i]->ip_src); |
| 93 | $object[$i]->sid=arr_merge($object[$obj_ptr]->sid,$object[$i]->sid); |
| 94 | if( $object[$i]->sport!=$object[$obj_ptr]->sport ) $object[$i]->sport="multiport"; |
| 95 | if( $object[$i]->sig_class_id != $object[$obj_ptr]->sig_class_id ) $object[$i]->sig_class_id=0; |
| 96 | if( $object[$i]->sig_priority > $object[$obj_ptr]->sig_priority ) $object[$i]->sig_priority=$object[$obj_ptr]->sig_priority; |
| 97 | if((time_smaller($object[$obj_ptr]->start_time,$object[$i]->start_time))==1) |
| 98 | { |
| 99 | $object[$i]->start_time = $object[$obj_ptr]->start_time; |
| 100 | } |
| 101 | if((time_smaller($object[$i]->end_time,$object[$obj_ptr]->end_time))==1) |
| 102 | { |
| 103 | $object[$i]->end_time = $object[$obj_ptr]->end_time; |
| 104 | } |
| 105 | $object[$i]->cmp_time=nor_time($object[$i]->end_time); |
| 106 | $i=$mo_ctr; |
| 107 | //-------------------------merge---------------------------- |
| 108 | } |
| 109 | // } |
| 110 | } |
| 111 | } |
| 112 | if($i!=$mo_ctr+1) |
| 113 | { |
146 | | |
147 | | } |
| 115 | $object[$mo_ctr]->start_time=$object[$obj_ptr]->start_time; |
| 116 | $object[$mo_ctr]->end_time=$object[$obj_ptr]->end_time; |
| 117 | $object[$mo_ctr]->reference=$object[$obj_ptr]->reference; |
| 118 | $object[$mo_ctr]->ip_proto=$object[$obj_ptr]->ip_proto; |
| 119 | $object[$mo_ctr]->event_name=$object[$obj_ptr]->event_name; |
| 120 | $object[$mo_ctr]->ip_dst=arr_cover($object[$obj_ptr]->ip_dst,$object[$mo_ctr]->ip_dst); |
| 121 | $object[$mo_ctr]->ip_src=arr_cover($object[$obj_ptr]->ip_src,$object[$mo_ctr]->ip_src); |
| 122 | $object[$mo_ctr]->sid=arr_cover($object[$obj_ptr]->sid,$object[$mo_ctr]->sid); |
| 123 | $object[$mo_ctr]->dport=arr_cover($object[$obj_ptr]->dport,$object[$mo_ctr]->dport); |
| 124 | $object[$mo_ctr]->sport=$object[$obj_ptr]->sport; |
| 125 | $object[$mo_ctr]->sig_class_id=$object[$obj_ptr]->sig_class_id; |
| 126 | $object[$mo_ctr]->signature=arr_cover($object[$obj_ptr]->signature,$object[$mo_ctr]->signature); |
| 127 | $object[$mo_ctr]->sig_priority=$object[$obj_ptr]->sig_priority; |
| 128 | $object[$mo_ctr]->cmp_time=nor_time($object[$mo_ctr]->end_time); |
| 129 | $mo_ctr++; |
151 | | //----remove timeout class---- |
152 | | |
153 | | //====many2one check=== |
154 | | |
155 | | for($i=$mo_ptr; $i<$mo_ctr ;$i++) |
156 | | |
157 | | { |
158 | | |
159 | | if($object[$obj_ptr]->ip_dst[0] == $object[$i]->ip_dst[0]) |
160 | | |
161 | | { |
162 | | |
163 | | // if($object[$obj_ptr]->dport[0] == $object[$i]->dport[0]) |
164 | | |
165 | | // { |
166 | | |
167 | | if($object[$obj_ptr]->signature[0] == $object[$i]->signature[0]) |
168 | | |
169 | | { |
170 | | |
171 | | //-------------------------merge---------------------------- |
172 | | |
173 | | $object[$i]->reference=($object[$i]->reference).", ".($object[$obj_ptr]->reference); |
174 | | |
175 | | if( $object[$i]->ip_proto!=$object[$obj_ptr]->ip_proto ) $object[$i]->ip_proto="multiproto"; |
176 | | |
177 | | $object[$i]->ip_src=arr_merge($object[$obj_ptr]->ip_src,$object[$i]->ip_src); |
178 | | |
179 | | $object[$i]->sid=arr_merge($object[$obj_ptr]->sid,$object[$i]->sid); |
180 | | |
181 | | if( $object[$i]->sport!=$object[$obj_ptr]->sport ) $object[$i]->sport="multiport"; |
182 | | |
183 | | if( $object[$i]->sig_class_id != $object[$obj_ptr]->sig_class_id ) $object[$i]->sig_class_id=0; |
184 | | |
185 | | if( $object[$i]->sig_priority > $object[$obj_ptr]->sig_priority ) $object[$i]->sig_priority=$object[$obj_ptr]->sig_priority; |
186 | | |
187 | | if((time_smaller($object[$obj_ptr]->start_time,$object[$i]->start_time))==1) |
188 | | |
189 | | { |
190 | | |
191 | | $object[$i]->start_time = $object[$obj_ptr]->start_time; |
192 | | |
193 | | } |
194 | | |
195 | | if((time_smaller($object[$i]->end_time,$object[$obj_ptr]->end_time))==1) |
196 | | |
197 | | { |
198 | | |
199 | | $object[$i]->end_time = $object[$obj_ptr]->end_time; |
200 | | |
201 | | } |
202 | | |
203 | | $object[$i]->cmp_time=nor_time($object[$i]->end_time); |
204 | | |
205 | | $i=$mo_ctr; |
206 | | |
207 | | //-------------------------merge---------------------------- |
208 | | |
209 | | } |
210 | | |
211 | | // } |
212 | | |
213 | | } |
214 | | |
215 | | } |
216 | | |
217 | | if($i!=$mo_ctr+1) |
218 | | |
219 | | { |
220 | | |
221 | | |
222 | | |
223 | | $object[$mo_ctr]->start_time=$object[$obj_ptr]->start_time; |
224 | | |
225 | | $object[$mo_ctr]->end_time=$object[$obj_ptr]->end_time; |
226 | | |
227 | | $object[$mo_ctr]->reference=$object[$obj_ptr]->reference; |
228 | | |
229 | | $object[$mo_ctr]->ip_proto=$object[$obj_ptr]->ip_proto; |
230 | | |
231 | | $object[$mo_ctr]->event_name=$object[$obj_ptr]->event_name; |
232 | | |
233 | | $object[$mo_ctr]->ip_dst=arr_cover($object[$obj_ptr]->ip_dst,$object[$mo_ctr]->ip_dst); |
234 | | |
235 | | $object[$mo_ctr]->ip_src=arr_cover($object[$obj_ptr]->ip_src,$object[$mo_ctr]->ip_src); |
236 | | |
237 | | $object[$mo_ctr]->sid=arr_cover($object[$obj_ptr]->sid,$object[$mo_ctr]->sid); |
238 | | |
239 | | $object[$mo_ctr]->dport=arr_cover($object[$obj_ptr]->dport,$object[$mo_ctr]->dport); |
240 | | |
241 | | $object[$mo_ctr]->sport=$object[$obj_ptr]->sport; |
242 | | |
243 | | $object[$mo_ctr]->sig_class_id=$object[$obj_ptr]->sig_class_id; |
244 | | |
245 | | $object[$mo_ctr]->signature=arr_cover($object[$obj_ptr]->signature,$object[$mo_ctr]->signature); |
246 | | |
247 | | $object[$mo_ctr]->sig_priority=$object[$obj_ptr]->sig_priority; |
248 | | |
249 | | $object[$mo_ctr]->cmp_time=nor_time($object[$mo_ctr]->end_time); |
250 | | |
251 | | $mo_ctr++; |
252 | | |
253 | | |
254 | | |
255 | | } |
256 | | |
257 | | //====many2one check=== |
258 | | |
259 | | $obj_ptr++; |
260 | | |
261 | | } |
262 | | |
263 | | $obj_ctr=$mo_ctr; |
264 | | |
265 | | }; |