Another variant of BayesCompare was investigated. As pointed out
above, conditional probability can become zero if L has a
duration that has not yet been learned to be producible by
implementation X, perhaps because the print database hasn't been
updated for some time. So another version was explored where only
duration values that fall in the intersection of an input
fingerprint L and a database fingerprint R are included in the
calculation of . So the product becomes
R.duration_ratio(d) where d ranges over all durations in L
R, and R.duration_ratio(p, d) where p and d range over all
packet types and durations respectively where duration d occurs in a
packet of type p in L R.
Figure 4.9:
BayesCompare-Modified duration value only analysis
ret = 1.0
for every duration-value d
ret *= R.duration_ratio(d)
return ret;
Figure 4.10:
BayesCompare-Modified (packet-type, duration) analysis
ret = 1.0
for every packet_type p, duration-value d
ret *= R.duration_ratio(p, d)
return ret;
|