Added script for checking flow number anomalies

scripts/lua/modules/alert_definitions/host/host_alert_flow_anomaly.lua

@@ -0,0 +1,71 @@
+--
+-- (C) 2019-21 - ntop.org
+--
+
+-- ##############################################
+
+local host_alert_keys = require "host_alert_keys"
+package.path = dirs.installdir .. "/scripts/lua/modules/?.lua;" .. package.path
+
+local alert_creators = require "alert_creators"
+local format_utils = require "format_utils"
+local json = require("dkjson")
+-- Import the classes library.
+local classes = require "classes"
+-- Make sure to import the Superclass!
+local alert = require "alert"
+
+-- ##############################################
+
+local host_alert_flow_anomaly = classes.class(alert)
+
+-- ##############################################
+
+host_alert_flow_anomaly.meta = {
+  alert_key = host_alert_keys.host_alert_flows_anomaly,
+  i18n_title = "alerts_dashboard.flow_anomaly",
+  icon = "fas fa-life-ring",
+  has_attacker = true,
+}
+
+-- ##############################################
+
+-- @brief Prepare an alert table used to generate the alert
+-- @return A table with the alert built
+function host_alert_flow_anomaly:init()
+   -- Call the parent constructor
+   self.super:init()
+
+   self.alert_type_params = {}
+end
+
+-- #######################################################
+
+-- @brief Format an alert into a human-readable string
+-- @param ifid The integer interface id of the generated alert
+-- @param alert The alert description table, including alert data such as the generating entity, timestamp, granularity, type
+-- @param alert_type_params Table `alert_type_params` as built in the `:init` method
+-- @return A human-readable string
+function host_alert_flow_anomaly.format(ifid, alert, alert_type_params)
+  local alert_consts = require("alert_consts")
+  local entity = alert_consts.formatAlertEntity(ifid, alert_consts.alertEntityRaw(alert["alert_entity"]), alert["alert_entity_val"])
+  local value = alert_type_params.value
+  local i18n_key
+
+  if alert_type_params.is_attacker then
+    i18n_key = "alert_messages.flow_anomaly_attacker"
+  else
+    i18n_key = "alert_messages.flow_anomaly_victim"
+  end
+
+  return i18n(i18n_key, {
+    entity = firstToUpper(entity),
+    host_category = format_utils.formatAddressCategory((json.decode(alert.alert_json)).alert_generation.host_info),
+    value = string.format("%u", math.ceil(value)),
+    threshold = alert_type_params.threshold,
+  })
+end
+
+-- #######################################################
+
+return host_alert_flow_anomaly