PYSURICATA · DOCS FIGURES

Six figures for the algorithms and architecture pages

Every figure runs the real algorithm in the browser with a fixed seed, so what you see is a simulation rather than an illustration. The colour, type and threshold vocabulary follows the house constraints and the existing kmv-unit-interval.svg. Theme colours come from CSS custom properties, so the mkdocs-material light and dark palettes drive them directly.

FIG 3 · GROUP A

The memory curve

Peak memory against dataset size. One streaming pass with fixed-size sketches keeps PySuricata flat; a load-everything profiler rises linearly until the machine runs out. Drag across the chart to read both lines, and change the machine's RAM to move the failure point.

Machine RAM

docs/index.md · docs/why-pysuricata.md — numbers are marked placeholders; generate from benchmarks/end_to_end.py before shipping.

FIG 1 · GROUP A

Reservoir sampling — Algorithm R vs Algorithm L

Both tracks see the same stream and both hold a uniform sample of size k: every element that has arrived is in the reservoir with probability k/n. Algorithm R tests each arrival. Algorithm L draws a geometric skip and jumps straight to the next element it will accept, never touching the ones in between. Watch the two counters diverge.

docs/algorithms/sampling.md — replaces 68 lines that document Algorithm R while the library runs Algorithm L.

FIG 2 · GROUP A

Misra-Gries eviction

The sketch keeps at most k counters. A known key increments. A new key takes a free slot. A new key with every slot full is the interesting case: every counter decrements at once, anything reaching zero is dropped, and the new key takes the freed slot. That is how a bounded structure survives an unbounded number of distinct values. Feed it a key yourself to force the case you want.

feed a key

docs/algorithms/sketches.md — pair with the KMV figure already generated by build_docs_assets.py.

FIG 4 · GROUP B

The chunk lifecycle

What a call graph would not show: which state is bounded. The chunk is transient and released each iteration; the accumulator state inside the dashed boundary is fixed-size sketches that do not grow with rows. Run chunks through and watch the two memory bars.

Mermaid source for the static version

    

merged architecture page — replaces architecture.md, architecture-diagrams.md and sequence-diagrams-complexity.md.

FIG 5 · GROUP B

Welford → Pébay merge

Two partitions each carry a count, a mean and a second central moment. Pébay's formulas combine them into the moments of the union exactly, which is why profiling in one chunk and in fifty gives identical answers. Drag either mean: the simple sum M2a + M2b does not move, and the correction term is the whole difference.

drag either mean on the line

docs/algorithms/streaming.md — M3 and M4 follow the same shape with larger correction terms.

FIG 6 · GROUP A

Annotated report card

A numeric column card with its parts named. Hover or tap a numbered region, or an entry in the legend, to isolate it. The card below is drawn from the report's own stylesheet values, so it stands in for the screenshot until the Playwright capture is scripted.

docs/stats/*.md — regenerate the card with Playwright against a fresh report; the region ids stay in the same script.