Reworked unexpected host behaviour alert

Implements #5128

scripts/lua/modules/alert_definitions/alert_active_flows_anomaly_client.lua

@@ -0,0 +1,66 @@
+--
+-- (C) 2019-21 - ntop.org
+--
+
+-- ##############################################
+
+local alert_keys = require "alert_keys"
+local classes = require "classes"
+local alert = require "alert"
+
+-- ##############################################
+
+local alert_active_flows_anomaly_client = classes.class(alert)
+
+-- ##############################################
+
+alert_active_flows_anomaly_client.meta = {
+   alert_key = alert_keys.ntopng.alert_active_flows_anomaly_client,
+   i18n_title = "alerts_dashboard.unexpected_host_behaviour_title",
+   icon = "fas fa-exclamation",
+}
+
+-- ##############################################
+
+-- @brief Prepare an alert table used to generate the alert
+-- @param value       The value got from the measurement
+-- @param prediction  The value instead predicted
+-- @param lower_bound The lower bound of the measurement
+-- @param upper_bound The upper bound of the measurement
+-- @return A table with the alert built
+function alert_active_flows_anomaly_client:init(value, prediction, upper_bound, lower_bound)
+   -- Call the parent constructor
+   self.super:init()
+
+   self.alert_type_params = {
+      value = value,
+      prediction = prediction,
+      upper_bound = upper_bound,
+      lower_bound = lower_bound,
+   }
+end
+
+-- #######################################################
+
+-- @brief Format an alert into a human-readable string
+-- @param ifid The integer interface id of the generated alert
+-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
+-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
+-- @return A human-readable string
+function alert_active_flows_anomaly_client.format(ifid, alert, alert_type_params)
+   local alert_consts = require("alert_consts")
+   
+   return(i18n("alerts_dashboard.unexpected_host_behavior_description",
+		{
+		   host = firstToUpper(alert_consts.formatAlertEntity(ifid, alert_consts.alertEntityRaw(alert["alert_entity"]), alert["alert_entity_val"])),
+		   type_of_behaviour = i18n("alert.anomalies.active_flows_as_client") or "",
+		   value = alert_type_params.value,
+		   prediction = alert_type_params.prediction or 0,
+		   lower_bound = alert_type_params.lower_bound or 0,
+		   upper_bound = alert_type_params.upper_bound or 0,
+		}))
+end
+
+-- #######################################################
+
+return alert_active_flows_anomaly_client

scripts/lua/modules/alert_definitions/alert_active_flows_anomaly_server.lua

@@ -0,0 +1,66 @@
+--
+-- (C) 2019-21 - ntop.org
+--
+
+-- ##############################################
+
+local alert_keys = require "alert_keys"
+local classes = require "classes"
+local alert = require "alert"
+
+-- ##############################################
+
+local alert_active_flows_anomaly_server = classes.class(alert)
+
+-- ##############################################
+
+alert_active_flows_anomaly_server.meta = {
+   alert_key = alert_keys.ntopng.alert_active_flows_anomaly_server,
+   i18n_title = "alerts_dashboard.unexpected_host_behaviour_title",
+   icon = "fas fa-exclamation",
+}
+
+-- ##############################################
+
+-- @brief Prepare an alert table used to generate the alert
+-- @param value       The value got from the measurement
+-- @param prediction  The value instead predicted
+-- @param lower_bound The lower bound of the measurement
+-- @param upper_bound The upper bound of the measurement
+-- @return A table with the alert built
+function alert_active_flows_anomaly_server:init(value, prediction, upper_bound, lower_bound)
+   -- Call the parent constructor
+   self.super:init()
+
+   self.alert_type_params = {
+      value = value,
+      prediction = prediction,
+      upper_bound = upper_bound,
+      lower_bound = lower_bound,
+   }
+end
+
+-- #######################################################
+
+-- @brief Format an alert into a human-readable string
+-- @param ifid The integer interface id of the generated alert
+-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
+-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
+-- @return A human-readable string
+function alert_active_flows_anomaly_server.format(ifid, alert, alert_type_params)
+   local alert_consts = require("alert_consts")
+   
+   return(i18n("alerts_dashboard.unexpected_host_behavior_description",
+		{
+		   host = firstToUpper(alert_consts.formatAlertEntity(ifid, alert_consts.alertEntityRaw(alert["alert_entity"]), alert["alert_entity_val"])),
+		   type_of_behaviour = i18n("alert.anomalies.active_flows_as_client") or "",
+		   value = alert_type_params.value,
+		   prediction = alert_type_params.prediction or 0,
+		   lower_bound = alert_type_params.lower_bound or 0,
+		   upper_bound = alert_type_params.upper_bound or 0,
+		}))
+end
+
+-- #######################################################
+
+return alert_active_flows_anomaly_server

scripts/lua/modules/alert_definitions/alert_contacts_anomaly.lua

@@ -0,0 +1,66 @@
+--
+-- (C) 2019-21 - ntop.org
+--
+
+-- ##############################################
+
+local alert_keys = require "alert_keys"
+local classes = require "classes"
+local alert = require "alert"
+
+-- ##############################################
+
+local alert_contacts_anomaly = classes.class(alert)
+
+-- ##############################################
+
+alert_contacts_anomaly.meta = {
+   alert_key = alert_keys.ntopng.alert_contacts_anomaly,
+   i18n_title = "alerts_dashboard.unexpected_host_behaviour_title",
+   icon = "fas fa-exclamation",
+}
+
+-- ##############################################
+
+-- @brief Prepare an alert table used to generate the alert
+-- @param value       The value got from the measurement
+-- @param prediction  The value instead predicted
+-- @param lower_bound The lower bound of the measurement
+-- @param upper_bound The upper bound of the measurement
+-- @return A table with the alert built
+function alert_contacts_anomaly:init(value, prediction, upper_bound, lower_bound)
+   -- Call the parent constructor
+   self.super:init()
+
+   self.alert_type_params = {
+      value = value,
+      prediction = prediction,
+      upper_bound = upper_bound,
+      lower_bound = lower_bound,
+   }
+end
+
+-- #######################################################
+
+-- @brief Format an alert into a human-readable string
+-- @param ifid The integer interface id of the generated alert
+-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
+-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
+-- @return A human-readable string
+function alert_contacts_anomaly.format(ifid, alert, alert_type_params)
+   local alert_consts = require("alert_consts")
+   
+   return(i18n("alerts_dashboard.unexpected_host_behavior_description",
+		{
+		   host = firstToUpper(alert_consts.formatAlertEntity(ifid, alert_consts.alertEntityRaw(alert["alert_entity"]), alert["alert_entity_val"])),
+		   type_of_behaviour = i18n("alert.anomalies.contacts") or "",
+		   value = alert_type_params.value,
+		   prediction = alert_type_params.prediction or 0,
+		   lower_bound = alert_type_params.lower_bound or 0,
+		   upper_bound = alert_type_params.upper_bound or 0,
+		}))
+end
+
+-- #######################################################
+
+return alert_contacts_anomaly

scripts/lua/modules/alert_definitions/alert_score_anomaly_client.lua

@@ -10,12 +10,12 @@ local alert = require "alert"
 
 -- ##############################################
 
-local alert_unexpected_behaviour = classes.class(alert)
+local alert_score_anomaly_client = classes.class(alert)
 
 -- ##############################################
 
-alert_unexpected_behaviour.meta = {
-   alert_key = alert_keys.ntopng.alert_unexpected_behaviour,
+alert_score_anomaly_client.meta = {
+   alert_key = alert_keys.ntopng.alert_score_anomaly_client,
    i18n_title = "alerts_dashboard.unexpected_host_behaviour_title",
    icon = "fas fa-exclamation",
 }
@@ -28,12 +28,11 @@ alert_unexpected_behaviour.meta = {
 -- @param lower_bound The lower bound of the measurement
 -- @param upper_bound The upper bound of the measurement
 -- @return A table with the alert built
-function alert_unexpected_behaviour:init(type_of_behaviour, value, prediction, upper_bound, lower_bound)
+function alert_score_anomaly_client:init(value, prediction, upper_bound, lower_bound)
    -- Call the parent constructor
    self.super:init()
 
    self.alert_type_params = {
-      type_of_behaviour = type_of_behaviour,
       value = value,
       prediction = prediction,
       upper_bound = upper_bound,
@@ -48,13 +47,13 @@ end
 -- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
 -- @param alert_type_params Table `alert_type_params` as built in the `:init` method
 -- @return A human-readable string
-function alert_unexpected_behaviour.format(ifid, alert, alert_type_params)
+function alert_score_anomaly_client.format(ifid, alert, alert_type_params)
    local alert_consts = require("alert_consts")
    
    return(i18n("alerts_dashboard.unexpected_host_behavior_description",
 		{
 		   host = firstToUpper(alert_consts.formatAlertEntity(ifid, alert_consts.alertEntityRaw(alert["alert_entity"]), alert["alert_entity_val"])),
-		   type_of_behaviour = alert_type_params.type_of_behaviour,
+		   type_of_behaviour = i18n("alert.anomalies.score_as_client") or "",
 		   value = alert_type_params.value,
 		   prediction = alert_type_params.prediction or 0,
 		   lower_bound = alert_type_params.lower_bound or 0,
@@ -64,4 +63,4 @@ end
 
 -- #######################################################
 
-return alert_unexpected_behaviour
+return alert_score_anomaly_client

scripts/lua/modules/alert_definitions/alert_score_anomaly_server.lua

@@ -0,0 +1,66 @@
+--
+-- (C) 2019-21 - ntop.org
+--
+
+-- ##############################################
+
+local alert_keys = require "alert_keys"
+local classes = require "classes"
+local alert = require "alert"
+
+-- ##############################################
+
+local alert_score_anomaly_server = classes.class(alert)
+
+-- ##############################################
+
+alert_score_anomaly_server.meta = {
+   alert_key = alert_keys.ntopng.alert_score_anomaly_server,
+   i18n_title = "alerts_dashboard.unexpected_host_behaviour_title",
+   icon = "fas fa-exclamation",
+}
+
+-- ##############################################
+
+-- @brief Prepare an alert table used to generate the alert
+-- @param value       The value got from the measurement
+-- @param prediction  The value instead predicted
+-- @param lower_bound The lower bound of the measurement
+-- @param upper_bound The upper bound of the measurement
+-- @return A table with the alert built
+function alert_score_anomaly_server:init(value, prediction, upper_bound, lower_bound)
+   -- Call the parent constructor
+   self.super:init()
+
+   self.alert_type_params = {
+      value = value,
+      prediction = prediction,
+      upper_bound = upper_bound,
+      lower_bound = lower_bound,
+   }
+end
+
+-- #######################################################
+
+-- @brief Format an alert into a human-readable string
+-- @param ifid The integer interface id of the generated alert
+-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
+-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
+-- @return A human-readable string
+function alert_score_anomaly_server.format(ifid, alert, alert_type_params)
+   local alert_consts = require("alert_consts")
+   
+   return(i18n("alerts_dashboard.unexpected_host_behavior_description",
+		{
+		   host = firstToUpper(alert_consts.formatAlertEntity(ifid, alert_consts.alertEntityRaw(alert["alert_entity"]), alert["alert_entity_val"])),
+		   type_of_behaviour = i18n("alert.anomalies.score_as_client") or "",
+		   value = alert_type_params.value,
+		   prediction = alert_type_params.prediction or 0,
+		   lower_bound = alert_type_params.lower_bound or 0,
+		   upper_bound = alert_type_params.upper_bound or 0,
+		}))
+end
+
+-- #######################################################
+
+return alert_score_anomaly_server