SNIP_CLASSIC_IDSM_SECTION_7_3_3_Buffers

7.3.3 Buffers [SWS_IdsM_00701] Event Buffers configurable Upstream requirements: RS_Ids_00210 ⌈The IdsM shall have a configurable number of event buffers IdsMNumberOfEventBuffers, depending on the amount of configured IdsMEvents that are to be handled.⌋ A recommended number of buffers can be calculated as follows: Number of Event Buffers = Number of Event Aggregation Filter instances + Upper bound of parallel processed events [SWS_IdsM_00702] Event Buffer storage Upstream requirements: RS_Ids_00210 ⌈Upon reception of a SEv, the IdsM shall store the event in an Event Buffer until it can be further processed. Event buffers shall be handled and filtered asynchronously in the IdsM_MainFunction service.⌋ Manager [SWS_IdsM_00703] Availability of Event Buffer Upstream requirements: RS_Ids_00210 ⌈In case no Event Buffer is found. The IdsM internal SEv ’No Event Buffer Available’ shall be triggered, in case it has been configured.⌋ See SEV_IDSM_NO_EVENT_BUFFER_AVAILABLE in [SWS_IdsM_91015]. [SWS_IdsM_00704] Context Data Buffers configurable Upstream requirements: RS_Ids_00210 ⌈The IdsM shall have a configurable number of context data buffers IdsMNumberOfContextDataBuffers with different configurable sizes IdsMContextDataBufferSize in order to satisfy different sensor use cases.⌋ Rationale: There can be significant differences in the size of the context data depending on the type of event being processed. These sizes have to be configured suitably to utilize the memory resources effectively. [SWS_IdsM_00705] Suitable Buffer Size Upstream requirements: RS_Ids_00210 ⌈Upon reception of a SEv with context data, the IdsM shall store the context data in an Context Data Buffer with the most adequate size available. A configured Context Data Buffer Pool shall be searched in order to find a buffer with the same size as the reported context data, or find the next larger buffer. These buffers shall be handled and filtered asynchronously in the IdsM_MainFunction service.⌋ [SWS_IdsM_00706] Link Event to Context Data Buffer Upstream requirements: RS_Ids_00210 ⌈Once an appropriate Context Data Buffer has been found, it shall be linked to the corresponding Event Buffer for further processing.⌋ [SWS_IdsM_00707] No Suitable Buffer Size Upstream requirements: RS_Ids_00210 ⌈In case there is no appropriate Context Data Buffer of the same size or larger than the context data, the event shall be processed as an event without context data. Thus no context data buffer shall be linked to the processed SEv.⌋ [SWS_IdsM_00708] Availability of Context Data Buffer Upstream requirements: RS_Ids_00210 ⌈In case no appropriate Context Data Buffer is found. The IdsM internal SEv ’No Context Data Buffer Available’ shall be triggered, in case it has been configured.⌋ See SEV_IDSM_EVENT_NO_CONTEXT_DATA_BUFFER_AVAILABLE in [SWS_IdsM_91015]. Manager [SWS_IdsM_00709] SEv without Context Data Upstream requirements: RS_Ids_00210 ⌈Upon reception of a SEv with no Context Data, the IdsM shall not use any Context Data Buffer. Thus no Context Data Buffer will be linked to the processed SEv.⌋ [SWS_IdsM_00710] Reception SEv with higher priority Upstream requirements: RS_Ids_00210 ⌈Where IdsMEventDisplacementStrategy is IDSM_BUFFER_DISPLACEMENT_SEVERITY_BASED, when a new SEv is received and no suitable IdsMEventBuffers is found and the severity of the new SEv is higher than the severity of at least one SEv already in the buffer, IdsM shall replace the least severe SEv already in the buffer with the new SEv. Note: In case where multiple events in the IdsMEventBuffers have the same least severity, it is left to the implementer which SEv to discard. Example: Where the IdsMEventBuffers is 5 and all the buffers are full, when a new security event is reported, IdsM shall drop the least severe event amongst all the 6 events. Rationale: Dropping a security event is inevitable when all the IdsMEventBuffers are full. In this case, dropping the least severe event minimizes the values of the security information lost.⌋ [SWS_IdsM_00711] Reception SEv with lower priority Upstream requirements: RS_Ids_00210 ⌈Where IdsMEventDisplacementStrategy is IDSM_BUFFER_DISPLACEMENT_SEVERITY_BASED, when a new SEv is received and no suitable IdsMEventBuffers is found and the severity of the new SEv is lower than or equal to the severity value of the least severe SEvs already in the buffer, IdsM shall drop the newly received SEv.⌋ [SWS_IdsM_00712] Configuration Drop Latest Upstream requirements: RS_Ids_00210 ⌈Where IdsMEventDisplacementStrategy is IDSM_BUFFER_DISPLACEMENT_DROP_LATEST, when a new SEv is received and no suitable IdsMEventBuffers is found, IdsM shall drop the newly received SEv.⌋ Manager Event Data Buffer Filled Optional Context Data Buffer Linked Event Buffer Pool Context Data Buffer Pool Collection of events to be processed asynchronously Unused Unused In Use Unused Unused Size Status Figure 7.4: Use of Event Buffers and Context Data Buffers Figure 7.4 shows how event buffers and context buffers are used when security events are set via the IdsM API as this chapter explains. Upon reception of a SEv, the event is stored in a buffer from the event buffer pool and its corresponding context data is stored in a buffered of the most adequate size from the context data buffer pool. These two buffers are linked and processed together asynchronously in the IdsM_ MainFunction service.