MediumCompare Metric

SimpleCompare does not account for highly-unique duration values. MediumCompare was created as an alternative to deal more intelligently with such duration values. Intuitively, if two prints both use duration values that are globally unique (i.e. illegal values generated by prism2-based implementations) then this should count more than matching very common values such as 0.

Like SimpleCompare, the MediumCompare metric compares an input pcap with every print in the database except that for each print in the database, it also considers global duration uniqueness by examining the rest of the database. It computes one of two weights, either duration uniqueness, or packet type duration uniqueness, depending on the data set as follows.

When computing duration uniqueness the metric counts the total number of unique (implementation, duration value) pairs in the entire database. This does not take into account how often an individual duration value appears in packets for a given implementation. Rather, it counts how often a duration value is used across all implementations. If two implementations both use duration value 314, but one uses it 1% of the time, and the other uses it 80% of the time, both of these implementations will contribute the same amount to duration uniqueness.

Similarly packet type duration uniqueness is computed by counting the total number of unique (implementation, packet type duration) values across the entire database.

Once these two values have been computed MediumCompare is very similar to SimpleCompare.

Figure 4.3: MediumCompare duration-value only analysis

sum = 0;
for every duration-value d  
sum += duration_uniqueness(d) 
return sum;

Figure 4.4: MediumCompare (packet_type, duration) analysis

sum = 0;
for every packet_type p, duration-value d  
sum += duration_uniqueness(p,d)  
return sum;