Modified BayesCompare Metric

Another variant of BayesCompare was investigated. As pointed out above, conditional probability can become zero if L has a duration that has not yet been learned to be producible by implementation X, perhaps because the print database hasn't been updated for some time. So another version was explored where only duration values that fall in the intersection of an input fingerprint L and a database fingerprint R are included in the calculation of . So the product becomes R.duration_ratio(d) where d ranges over all durations in L R, and R.duration_ratio(p, d) where p and d range over all packet types and durations respectively where duration d occurs in a packet of type p in L R.

Figure 4.9: BayesCompare-Modified duration value only analysis

ret = 1.0 
for every duration-value d  
ret *= R.duration_ratio(d) 
return ret;

Figure 4.10: BayesCompare-Modified (packet-type, duration) analysis

ret = 1.0 
for every packet_type p, duration-value d  
ret *= R.duration_ratio(p, d) 
return ret;