NewAnalyzer returns a new Analyzer object
(db *database.DB, cfg *config.Config, importID util.FixedString, minTS, maxTS, minTSBeacon, maxTSBeacon time.Time, useCurrentTime bool, skipBeaconing bool)
| 81 | |
| 82 | // NewAnalyzer returns a new Analyzer object |
| 83 | func NewAnalyzer(db *database.DB, cfg *config.Config, importID util.FixedString, minTS, maxTS, minTSBeacon, maxTSBeacon time.Time, useCurrentTime bool, skipBeaconing bool) (*Analyzer, error) { |
| 84 | |
| 85 | // create a rate limiter to control the rate of writing to the database |
| 86 | limiter := rate.NewLimiter(5, 5) |
| 87 | networkSize, err := db.GetNetworkSize(minTS) // use true min TS for network size |
| 88 | if err != nil { |
| 89 | return nil, err |
| 90 | } |
| 91 | var firstSeenMaxTS time.Time |
| 92 | if !useCurrentTime { |
| 93 | firstSeenMaxTS = maxTS |
| 94 | } |
| 95 | |
| 96 | workers := int(math.Floor(math.Max(4, float64(runtime.NumCPU())/2))) |
| 97 | return &Analyzer{ |
| 98 | Database: db, |
| 99 | Config: cfg, |
| 100 | ImportID: importID, |
| 101 | AnalysisWorkers: workers, |
| 102 | WriterWorkers: workers, |
| 103 | useCurrentTime: useCurrentTime, |
| 104 | maxTS: maxTS, |
| 105 | minTS: minTS, |
| 106 | maxTSBeacon: maxTSBeacon, |
| 107 | minTSBeacon: minTSBeacon, |
| 108 | firstSeenMaxTS: firstSeenMaxTS, |
| 109 | skipBeaconing: skipBeaconing, |
| 110 | networkSize: networkSize, |
| 111 | UconnChan: make(chan AnalysisResult), |
| 112 | writer: database.NewBulkWriter(db, cfg, workers, db.GetSelectedDB(), "threat_mixtape", "INSERT INTO {database:Identifier}.threat_mixtape", limiter, false), |
| 113 | }, nil |
| 114 | } |
| 115 | |
| 116 | func (analyzer *Analyzer) Analyze() error { |
| 117 | logger := zlog.GetLogger() |