Autopsy  4.4.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
EventCluster.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2016 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.timeline.datamodel;
20 
21 import com.google.common.collect.ImmutableSet;
22 import com.google.common.collect.ImmutableSortedSet;
23 import com.google.common.collect.Sets;
24 import java.util.Collection;
25 import java.util.Comparator;
26 import java.util.Objects;
27 import java.util.Optional;
28 import java.util.SortedSet;
29 import javax.annotation.concurrent.Immutable;
30 import org.joda.time.Interval;
34 
40 @Immutable
41 public class EventCluster implements MultiEvent<EventStripe> {
42 
52  public static EventCluster merge(EventCluster cluster1, EventCluster cluster2) {
53  if (cluster1.getEventType() != cluster2.getEventType()) {
54  throw new IllegalArgumentException("event clusters are not compatible: they have different types");
55  }
56 
57  if (!cluster1.getDescription().equals(cluster2.getDescription())) {
58  throw new IllegalArgumentException("event clusters are not compatible: they have different descriptions");
59  }
60  Sets.SetView<Long> idsUnion =
61  Sets.union(cluster1.getEventIDs(), cluster2.getEventIDs());
62  Sets.SetView<Long> hashHitsUnion =
63  Sets.union(cluster1.getEventIDsWithHashHits(), cluster2.getEventIDsWithHashHits());
64  Sets.SetView<Long> taggedUnion =
65  Sets.union(cluster1.getEventIDsWithTags(), cluster2.getEventIDsWithTags());
66 
67  return new EventCluster(IntervalUtils.span(cluster1.span, cluster2.span),
68  cluster1.getEventType(), idsUnion, hashHitsUnion, taggedUnion,
69  cluster1.getDescription(), cluster1.lod);
70  }
71 
72  final private EventStripe parent;
73 
77  final private Interval span;
78 
82  final private EventType type;
83 
87  final private String description;
88 
92  private final DescriptionLoD lod;
93 
97  final private ImmutableSet<Long> eventIDs;
98 
103  private final ImmutableSet<Long> tagged;
104 
109  private final ImmutableSet<Long> hashHits;
110 
111  private EventCluster(Interval spanningInterval, EventType type, Collection<Long> eventIDs,
112  Collection<Long> hashHits, Collection<Long> tagged, String description, DescriptionLoD lod,
113  EventStripe parent) {
114 
115  this.span = spanningInterval;
116  this.type = type;
117  this.hashHits = ImmutableSet.copyOf(hashHits);
118  this.tagged = ImmutableSet.copyOf(tagged);
119  this.description = description;
120  this.eventIDs = ImmutableSet.copyOf(eventIDs);
121  this.lod = lod;
122  this.parent = parent;
123  }
124 
125  public EventCluster(Interval spanningInterval, EventType type, Collection<Long> eventIDs,
126  Collection<Long> hashHits, Collection<Long> tagged, String description, DescriptionLoD lod) {
127  this(spanningInterval, type, eventIDs, hashHits, tagged, description, lod, null);
128  }
129 
136  @Override
137  public Optional<EventStripe> getParent() {
138  return Optional.ofNullable(parent);
139  }
140 
147  @Override
148  public Optional<EventStripe> getParentStripe() {
149  //since this clusters parent must be an event stripe just delegate to getParent();
150  return getParent();
151  }
152 
153  public Interval getSpan() {
154  return span;
155  }
156 
157  @Override
158  public long getStartMillis() {
159  return span.getStartMillis();
160  }
161 
162  @Override
163  public long getEndMillis() {
164  return span.getEndMillis();
165  }
166 
167  @Override
168  public ImmutableSet<Long> getEventIDs() {
169  return eventIDs;
170  }
171 
172  @Override
173  public ImmutableSet<Long> getEventIDsWithHashHits() {
174  return hashHits;
175  }
176 
177  @Override
178  public ImmutableSet<Long> getEventIDsWithTags() {
179  return tagged;
180  }
181 
182  @Override
183  public String getDescription() {
184  return description;
185  }
186 
187  @Override
189  return type;
190  }
191 
192  @Override
194  return lod;
195  }
196 
207  return new EventCluster(span, type, eventIDs, hashHits, tagged, description, lod, parent);
208  }
209 
210  @Override
211  public SortedSet<EventCluster> getClusters() {
212  return ImmutableSortedSet.orderedBy(Comparator.comparing(EventCluster::getStartMillis)).add(this).build();
213  }
214 
215  @Override
216  public String toString() {
217  return "EventCluster{" + "description=" + description + ", eventIDs=" + eventIDs.size() + '}';
218  }
219 
220  @Override
221  public int hashCode() {
222  int hash = 7;
223  hash = 23 * hash + Objects.hashCode(this.type);
224  hash = 23 * hash + Objects.hashCode(this.description);
225  hash = 23 * hash + Objects.hashCode(this.lod);
226  hash = 23 * hash + Objects.hashCode(this.eventIDs);
227  return hash;
228  }
229 
230  @Override
231  public boolean equals(Object obj) {
232  if (this == obj) {
233  return true;
234  }
235  if (obj == null) {
236  return false;
237  }
238  if (getClass() != obj.getClass()) {
239  return false;
240  }
241  final EventCluster other = (EventCluster) obj;
242  if (!Objects.equals(this.description, other.description)) {
243  return false;
244  }
245  if (!Objects.equals(this.type, other.type)) {
246  return false;
247  }
248  if (this.lod != other.lod) {
249  return false;
250  }
251  if (!Objects.equals(this.eventIDs, other.eventIDs)) {
252  return false;
253  }
254  return true;
255  }
256 }
static Interval span(Interval range, final Interval range2)
EventCluster(Interval spanningInterval, EventType type, Collection< Long > eventIDs, Collection< Long > hashHits, Collection< Long > tagged, String description, DescriptionLoD lod, EventStripe parent)
EventCluster(Interval spanningInterval, EventType type, Collection< Long > eventIDs, Collection< Long > hashHits, Collection< Long > tagged, String description, DescriptionLoD lod)
static EventCluster merge(EventCluster cluster1, EventCluster cluster2)

Copyright © 2012-2016 Basis Technology. Generated on: Fri Sep 29 2017
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.