Architecture and Analogies

Architecture

This application follows Pipes and Filters architecture. In a pipes and filters architecture, data stream or data chunks flow through one or more pipes. Entities known as filters are attached to these pipes at different stages. Filters capture the relevant portion of the data which could be a segment in the stream of data, specific data chunks or even part of those data chunks. This captured data is then analyzed by the corresponding filter.

Compilers and Assembly Line

Motivation for utilization of this architecture in our application is mainly drawn from two scenarios. The first scenario is that of the workflow of a standard compiler. Compilers also utilize pipes and filters approach where the filters perform lexical analysis, parsing, semantic analysis and code generation. Thus at each stage, different analysis is performed on the data with different filters. However, we should note that this analogy is not a complete representation of this application since each filter in this example may concern itself with the whole or parts of data. That doesn't happen in this application.

To complete the analogy we can draw motivation from one more example, which is an assembly line in a car manufacturing plant. To put together a complete car, its skeleton moves from station to station (filters!) on an assembly line. Each station focuses on one or more specific parts of the skeleton and processes it by attaching more components. This example is a perfect analogy for the limited scope of data for each filter in the pipeline. In this analogy, nothing is extracted or analyzed. Instead, components are added at each filter.

We took motivation from both the example above. Filters (analyzers) in our application parse different parts of a captured packet and put together an analysis which is then persisted in the database for performing higher level analysis. This is similar to compilers example except for the scope of the data. Second example provides an analogy concerning the limited scope of the data with which each analyzer works.