diff --git a/FPEngine.cc b/FPEngine.cc index 3f34f8fc2..e320a631d 100644 --- a/FPEngine.cc +++ b/FPEngine.cc @@ -925,8 +925,6 @@ int label_prob_cmp(const void *a, const void *b) { return 0; } -#define NOVELTY_THRESHOLD 10.0 - static double novelty_of(const struct feature_node *features, int label) { const double *means, *variances; int i, nr_feature; @@ -998,12 +996,12 @@ static void classify(FingerPrintResultsIPv6 *FPR) { if (o.debugging > 1) log_write(LOG_PLAIN, "Novelty of closest match is %.3f.\n", novelty); - if (novelty < NOVELTY_THRESHOLD) { + if (novelty < FP_NOVELTY_THRESHOLD) { FPR->overall_results = OSSCAN_SUCCESS; } else { if (o.debugging > 0) { log_write(LOG_PLAIN, "Novelty of closest match is %.3f > %.3f; ignoring.\n", - novelty, NOVELTY_THRESHOLD); + novelty, FP_NOVELTY_THRESHOLD); } FPR->overall_results = OSSCAN_NOMATCHES; FPR->num_perfect_matches = 0; diff --git a/FPEngine.h b/FPEngine.h index 02761aa54..c46a89e57 100644 --- a/FPEngine.h +++ b/FPEngine.h @@ -122,6 +122,10 @@ class FingerPrintResultsIPv6; /* Total number of IPv6 OS detection probes. */ #define NUM_FP_PROBES_IPv6 (NUM_FP_PROBES_IPv6_TCP+NUM_FP_PROBES_IPv6_ICMPv6+NUM_FP_PROBES_IPv6_UDP) +/* Even with a successful classification, we may not consider a match good if it + is too different from other members of the class. */ +#define FP_NOVELTY_THRESHOLD 10.0 + const unsigned int OSDETECT_FLOW_LABEL = 0x12345;