EventCluster.java

Go to the documentation of this file.

/*
 * Autopsy Forensic Browser
 *
 * Copyright 2013-15 Basis Technology Corp.
 * Contact: carrier <at> sleuthkit <dot> org
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.autopsy.timeline.datamodel;

import com.google.common.collect.ImmutableSet;
import com.google.common.collect.ImmutableSortedSet;
import com.google.common.collect.Sets;
import java.util.Comparator;
import java.util.Objects;
import java.util.Optional;
import java.util.Set;
import java.util.SortedSet;
import javax.annotation.concurrent.Immutable;
import org.joda.time.Interval;
import org.sleuthkit.autopsy.timeline.datamodel.eventtype.EventType;
import org.sleuthkit.autopsy.timeline.utils.IntervalUtils;
import org.sleuthkit.autopsy.timeline.zooming.DescriptionLoD;

@Immutable
public class EventCluster implements EventBundle<EventStripe> {

    public static EventCluster merge(EventCluster cluster1, EventCluster cluster2) {
        if (cluster1.getEventType() != cluster2.getEventType()) {
            throw new IllegalArgumentException("event clusters are not compatible: they have different types");
        }

        if (!cluster1.getDescription().equals(cluster2.getDescription())) {
            throw new IllegalArgumentException("event clusters are not compatible: they have different descriptions");
        }
        Sets.SetView<Long> idsUnion = Sets.union(cluster1.getEventIDs(), cluster2.getEventIDs());
        Sets.SetView<Long> hashHitsUnion = Sets.union(cluster1.getEventIDsWithHashHits(), cluster2.getEventIDsWithHashHits());
        Sets.SetView<Long> taggedUnion = Sets.union(cluster1.getEventIDsWithTags(), cluster2.getEventIDsWithTags());

        return new EventCluster(IntervalUtils.span(cluster1.span, cluster2.span), cluster1.getEventType(), idsUnion, hashHitsUnion, taggedUnion, cluster1.getDescription(), cluster1.lod);
    }

    final private EventStripe parent;

    final private Interval span;

    final private EventType type;

    final private String description;

    private final DescriptionLoD lod;

    final private ImmutableSet<Long> eventIDs;

    private final ImmutableSet<Long> tagged;

    private final ImmutableSet<Long> hashHits;

    private EventCluster(Interval spanningInterval, EventType type, Set<Long> eventIDs, Set<Long> hashHits, Set<Long> tagged, String description, DescriptionLoD lod, EventStripe parent) {

        this.span = spanningInterval;
        this.type = type;
        this.hashHits = ImmutableSet.copyOf(hashHits);
        this.tagged = ImmutableSet.copyOf(tagged);
        this.description = description;
        this.eventIDs = ImmutableSet.copyOf(eventIDs);
        this.lod = lod;
        this.parent = parent;
    }

    public EventCluster(Interval spanningInterval, EventType type, Set<Long> eventIDs, Set<Long> hashHits, Set<Long> tagged, String description, DescriptionLoD lod) {
        this(spanningInterval, type, eventIDs, hashHits, tagged, description, lod, null);
    }

    @Override
    public Optional<EventStripe> getParentBundle() {
        return Optional.ofNullable(parent);
    }

    public Interval getSpan() {
        return span;
    }

    @Override
    public long getStartMillis() {
        return span.getStartMillis();
    }

    @Override
    public long getEndMillis() {
        return span.getEndMillis();
    }

    @Override
    @SuppressWarnings("ReturnOfCollectionOrArrayField")
    public ImmutableSet<Long> getEventIDs() {
        return eventIDs;
    }

    @Override
    @SuppressWarnings("ReturnOfCollectionOrArrayField")
    public ImmutableSet<Long> getEventIDsWithHashHits() {
        return hashHits;
    }

    @Override
    @SuppressWarnings("ReturnOfCollectionOrArrayField")
    public ImmutableSet<Long> getEventIDsWithTags() {
        return tagged;
    }

    @Override
    public String getDescription() {
        return description;
    }

    @Override
    public EventType getEventType() {
        return type;
    }

    @Override
    public DescriptionLoD getDescriptionLoD() {
        return lod;
    }

    public EventCluster withParent(EventStripe parent) {
        if (Objects.nonNull(this.parent)) {
            throw new IllegalStateException("Event Cluster already has a parent!");
        }
        return new EventCluster(span, type, eventIDs, hashHits, tagged, description, lod, parent);
    }

    @Override
    public SortedSet< EventCluster> getClusters() {
        return ImmutableSortedSet.orderedBy(Comparator.comparing(EventCluster::getStartMillis)).add(this).build();
    }

}