#include "stdafx.h"



std::pair<std::string, std::string> split_word(const std::string & word)
{
	std::vector<std::string> name_list =
	{
		"inject",
		"syscall",
		"filetracer",
		"regmon",
		"procmon",
		"filedelete",
		"socketmon",
		"cpuidmon",
		"finish"
	};
	for (auto & i : name_list)
	{
		if (word.size() >= i.size()
			&& word.substr(word.size() - i.size(), i.size()) == i)
		{
			return std::pair<std::string, std::string>(word.substr(0, word.size() - i.size()), i);
		}
	}
	return std::pair<std::string, std::string>(word, word);
}

std::vector<Event> get_events(const std::vector<std::string> & raw_log)
{
	std::vector<Event> events;
	events.reserve(400000);
	std::string buf;
	std::string name = "";
	std::map<std::string, std::string> parametrs;
	std::string key;
	bool search_value = false;
	for (auto & i : raw_log)
	{
		for (auto & j : i)
		{
			if (j != *"\""
				&& j != *"="
				&& j != *","
				&& (j != *" " || search_value))
			{
				if (j == *" ")
				{
					std::pair<std::string, std::string> buf_pair = split_word(buf);
					if (buf_pair.first != buf)
					{
						parametrs.insert(std::pair<std::string, std::string>(key, buf_pair.first));
						search_value = false;
						Event buf_event(name, parametrs);
						events.push_back(buf_event);
						name = buf_pair.second;
						parametrs.clear();
						buf.clear();
					}
					else
					{
						buf += j;
					}
				}
				else
				{
					buf += j;
				}
			}
			else if (j == *" " && !search_value && !buf.empty() && !name.empty())
			{
				std::pair<std::string, std::string> buf_pair = split_word(buf);
				parametrs.insert(std::pair<std::string, std::string>(key, buf_pair.first));
				search_value = false;
				Event buf_event(name, parametrs);
				events.push_back(buf_event);
				name = buf_pair.second;
				parametrs.clear();
				buf.clear();
			}
			else
			{
				if (name.empty())
				{
					name = buf;
					buf.clear();
				}
				else if (j == *"=" && !search_value)
				{
					key = buf;
					search_value = true;
					buf.clear();
				}
				else if (search_value
					&& (j == *"," || j == *" "))
				{
					parametrs.insert(std::pair<std::string, std::string>(key, buf));
					search_value = false;
					if (j == *" ")
					{
						Event buf_event(name, parametrs);
						events.push_back(buf_event);
						name.clear();
						parametrs.clear();
					}
					buf.clear();
				}
				else if (j == *"," && !search_value)
				{
					parametrs.insert(std::pair<std::string, std::string>(buf, ""));
					buf.clear();
				}
			}
		}
	}
	Event buf_event(name, parametrs);
	events.push_back(buf_event);
	return events;
}

void make_events(const std::string & path, std::vector<Event> & events)
{
	std::ifstream file_raw_log1(path);
	std::string buf;
	std::vector<std::string> raw_log;
	raw_log.reserve(400000);
	while (getline(file_raw_log1, buf))
	{
		raw_log.push_back(buf);
	}
	file_raw_log1.close();
	events = get_events(raw_log);
}

void save_events(const std::string & path, const std::vector<Event> & events)
{
	std::ofstream file_events(path);
	for (auto & i : events)
	{
		file_events << i.GetName() << std::endl;
		for (auto & j : i.GetParametrs())
		{
			file_events << j.first << "=" << j.second << std::endl;
		}
	}
	file_events.close();
}

void read_events(const std::string & path, std::vector<Event> & events)
{
	std::string buf;
	std::string name = "";
	std::map<std::string, std::string> parametrs;
	size_t pos;
	std::ifstream file_events(path);
	while (getline(file_events, buf))
	{
		if (name.empty())
		{
			name = buf;
		}
		else
		{
			pos = buf.find("=");
			if (pos != std::string::npos)
			{
				parametrs.insert(std::pair<std::string, std::string>(buf.substr(0, pos), buf.substr(pos + 1, buf.size() - pos - 1)));
			}
			else
			{
				Event buf_event(name, parametrs);
				events.push_back(buf_event);
				name = buf;
				parametrs.clear();
			}
		}
	}
	Event buf_event(name, parametrs);
	events.push_back(buf_event);
	file_events.close();
}

int main()
{
	std::vector<Event> events;;
	events.reserve(400000);
	//make_events("C:\\Users\\Артём\\Desktop\\raw.log", events);
	//save_events("C:\\Users\\Артём\\Desktop\\events.log", events);
	std::vector<Event> new_events;
	new_events.reserve(400000);
	read_events("C:\\Users\\Артём\\Desktop\\events.log", new_events);
	int counter = 0;
	/*
	int suspects = 0;
	int no_ppid = 0;
	int no_pid = 0;
	int no_pids = 0;
	std::set<std::string> PIDs;
	PIDs.insert(new_events[1].GetValue("PID"));
	for (auto & i : new_events)
	{
		if (i.GetValue("PPID") != "")
		{
			if (PIDs.find(i.GetValue("PPID")) != PIDs.end())
			{
				++suspects;
				if (i.GetValue("PID") != "")
				{
					PIDs.insert(i.GetValue("PID"));
				}
				else
				{
					++no_pid;
				}
			}
		}
		else if (i.GetValue("PID") != "")
		{
			if (PIDs.find(i.GetValue("PID")) != PIDs.end())
			{
				++suspects;
			}
			++no_ppid;
		}
		else
		{
			++no_pids;
		}
	}
	std::cout << "no_pid = " << no_pid << "\n"
		<< "no_ppid = " << no_ppid << "\n"
		<< "no_pids = " << no_pids << "\n"
		<< "suspects = " << suspects << "\n"
		<< 100 * float(suspects) / new_events.size() << "%\n";
	for (auto & i : PIDs)
	{
		std::cout << i << std::endl;
	}
	std::cout << PIDs.size() << std::endl;
	*/

	std::set<std::string> keys;
	for (auto & i : new_events)
	{
		//std::cout << counter++ << std::endl;
		for (auto & j : i.GetKeys())
		{
			if (keys.find(j) == keys.end())
			{
				keys.insert(j);
			}
		}
	}
	for (auto & i : keys)
	{
		std::cout << i << std::endl;
	}
	std::cout << keys.size() << std::endl;

	int mas[200];
	for (int i = 0; i < 200; ++i)
	{
		mas[i] = 0;
	}
	for (auto & i : new_events)
	{
		++mas[i.GetSize()];
	}
	int summ = 0;
	for (int i = 0; i < 200; ++i)
	{
		if (mas[i] != 0)
		{
			std::cout << i << " = " << mas[i] << std::endl;
		}
		summ += mas[i];
	}
	std::cout << new_events.size() << " = " << summ << std::endl;

	system("pause");
}