[Bro-Dev] #1039: Merge request for Bloom filters

Bro Tracker bro at tracker.bro.org
Mon Jul 22 13:57:13 PDT 2013

#1039: Merge request for Bloom filters
 Reporter:  matthias       |      Owner:
     Type:  Merge Request  |     Status:  new
 Priority:  Medium         |  Milestone:  Bro2.2
Component:  Bro            |    Version:  git/master
 Keywords:                 |
 The Bloom filter implementation in `topic/matthias/bloom-filter` is ready
 to merge into master. Have a look at the very end of `bro.bif` for the
 script-land interface.

 Internally, we have a new `BloomFilterVal`, which is serializable and
 mergeable and thus ready for cluster use. This `Val` contains a
 polymorphic Bloom filter instance, which hides the concrete Bloom filter
 type (currently only basic and counting). Moreover, this branch introduces
 the notion of ''hashers'', which are parameterizable (i.e., seedable)
 structures for hashing values ''k'' times. I recall that Bernhard waits
 for this feature. See `Hasher.h` for the documented interface.

 In the future, we need to rethink how to construct hash functions which
 only depend on a seed given at script land. This will be important when
 sharing Bloom filters across organizational boundaries. At this point, the
 implementation relies on `CompHash` (at least for composite values, such
 as records) which itself depends on the initial Bro seed generated at
 startup time or when the user specifies the environment variable

Ticket URL: <http://tracker.bro.org/bro/ticket/1039>
Bro Tracker <http://tracker.bro.org/bro>
Bro Issue Tracker

More information about the bro-dev mailing list