MISP
/
MISP
mirror of https://github.com/MISP/MISP
2
2
Fork 0
Code Issues Releases Wiki Activity

chg: [peridioc_notification] Compute event score instead of event base_score taking into account publish_timestamp

pull/8580/head
Sami Mokaddem 2022-09-12 09:16:06 +02:00
parent 219d0bba92
commit ed6dc118c4
No known key found for this signature in database
GPG Key ID: 164C473F627A06FA
5 changed files with 34 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
app/Model/DecayingModel.php
View File

@ -638,7 +638,7 @@ class DecayingModel extends AppModel
return $attribute;
}
public function attachBaseScoresToEvent($user, $event, $model_id=false, $model_overrides=array(), $include_full_model=0)
public function attachScoresToEvent($user, $event, $model_id=false, $model_overrides=array(), $include_full_model=0)
{
$models = [];
if ($model_id === false) { // fetch all allowed and associated models
@ -650,10 +650,11 @@ class DecayingModel extends AppModel
if (!empty($model_overrides)) {
$model = $this->overrideModelParameters($model, $model_overrides);
}
$basescore = $this->getBaseScoreForEvent($event, $model, $user);
$decayed = $this->isBaseScoreDecayed($model, $basescore);
$eventScore = $this->getScoreForEvent($event, $model);
$decayed = $this->isEventDecayed($model, $eventScore['score']);
$to_attach = [
'base_score' => $basescore,
'score' => $eventScore['score'],
'base_score' => $eventScore['base_score'],
'decayed' => $decayed,
'DecayingModel' => [
'id' => $model['DecayingModel']['id'],
@ -663,7 +664,7 @@ class DecayingModel extends AppModel
if ($include_full_model) {
$to_attach['DecayingModel'] = $model['DecayingModel'];
}
$event['event_base_score'][] = $to_attach;
$event['event_scores'][] = $to_attach;
}
return $event;
}
@ -687,16 +688,16 @@ class DecayingModel extends AppModel
return $this->Computation->computeCurrentScore($user, $model, $attribute);
}
public function getBaseScoreForEvent(array $event, array $model): float
public function getScoreForEvent($event, $model): array
{
$this->Computation = $this->getModelClass($model);
return $this->Computation->computeBasescore($model, $event)['base_score'];
return $this->Computation->computeEventScore($model, $event);
}
public function isBaseScoreDecayed(array $model, float $basescore): bool
public function isEventDecayed(array $model, float $score): bool
{
$threshold = $model['DecayingModel']['parameters']['threshold'];
return $threshold > $basescore;
return $threshold > $score;
}
public function isDecayed($attribute, $model, $score=false, $user=false)

12
app/Model/DecayingModelsFormulas/Base.php
View File

@ -157,6 +157,18 @@ abstract class DecayingModelBase
return $scores;
}
final public function computeEventScore($model, $event, $base_score = false)
{
$base_score = $this->computeBasescore($model, $event)['base_score'];
$last_timestamp = $event['Event']['publish_timestamp'];
$timestamp = time();
$scores = array(
'score' => $this->computeScore($model, $event, $base_score, $timestamp - $last_timestamp),
'base_score' => $base_score
);
return $scores;
}
// Compute the score for the provided attribute according to the elapsed time with the provided model
abstract public function computeScore($model, $attribute, $base_score, $elapsed_time);
// Return a True if the attribute should be marked as decayed

9
app/Model/Event.php
View File

@ -1621,7 +1621,7 @@ class Event extends AppModel
'includeRelatedTags',
'excludeLocalTags',
'includeDecayScore',
'includeBaseScoresOnEvent',
'includeScoresOnEvent',
'includeSightingdb',
'includeFeedCorrelations',
'includeServerCorrelations',
@ -1930,7 +1930,7 @@ class Event extends AppModel
$sharingGroupData = $sharingGroupReferenceOnly ? [] : $this->__cacheSharingGroupData($user, $useCache);
// Initialize classes that will be necessary during event fetching
if ((!empty($options['includeDecayScore']) || !empty($options['includeBaseScoresOnEvent'])) && !isset($this->DecayingModel)) {
if ((!empty($options['includeDecayScore']) || !empty($options['includeScoresOnEvent'])) && !isset($this->DecayingModel)) {
$this->DecayingModel = ClassRegistry::init('DecayingModel');
}
if ($options['includeServerCorrelations'] && !$isSiteAdmin && $user['org_id'] != Configure::read('MISP.host_org_id')) {
@ -2027,8 +2027,9 @@ class Event extends AppModel
}
//$event['RelatedShadowAttribute'] = $this->getRelatedAttributes($user, $event['Event']['id'], true);
}
if (!empty($options['includeBaseScoresOnEvent'])) {
$event = $this->DecayingModel->attachBaseScoresToEvent($user, $event);
if (!empty($options['includeScoresOnEvent'])) {
// $event = $this->DecayingModel->attachBaseScoresToEvent($user, $event);
$event = $this->DecayingModel->attachScoresToEvent($user, $event);
}
$shadowAttributeByOldId = [];
if (!empty($event['ShadowAttribute'])) {

2
app/Model/User.php
View File

@ -1837,7 +1837,7 @@ class User extends AppModel
$filters = [
'last' => $this->__genTimerangeFilter($period),
'published' => true,
'includeBaseScoresOnEvent' => true,
'includeScoresOnEvent' => true,
];
if (!empty($period_filters['orgc_id'])) {
$filters['orgc_id'] = $period_filters['orgc_id'];

12
app/View/Emails/notification_common.ctp
View File

@ -315,7 +315,7 @@ array_splice($all_tag_amount, 10);
<?= $this->fetch('detailed-summary-events'); ?>
<?php else : ?>
<?php if (!empty($events)) : ?>
<h4><?= __('Event list') ?></h4>
<h4><?= __('Event list') ?> <small style="color: #999999;"><?= sprintf(' (%s)', count($event)) ?></small></h4>
<table class="table table-condensed">
<thead>
<tr>
@ -328,7 +328,7 @@ array_splice($all_tag_amount, 10);
<th><?= h($taxonomy_name) ?></th>
<?php endforeach; ?>
<?php if (!empty($vars['event_table_include_basescore'])) : ?>
<th><?= __('Decaying Base Score') ?></th>
<th><?= __('Decaying Event Score') ?></th>
<?php endif; ?>
<th><?= __('Event Info') ?></th>
</tr>
@ -358,12 +358,12 @@ array_splice($all_tag_amount, 10);
<?php endforeach; ?>
<?php if (!empty($vars['event_table_include_basescore'])) : ?>
<td>
<?php if (isset($event['event_base_score'])) : ?>
<?php if (isset($event['event_scores'])) : ?>
<table class="table-xcondensed no-border">
<?php foreach ($event['event_base_score'] as $bs) : ?>
<?php foreach ($event['event_scores'] as $score) : ?>
<tr>
<td style="line-height: 14px;"><i class="no-overflow" style="max-width: 12em;" title="<?= h($bs['DecayingModel']['name']); ?>"><?= h($bs['DecayingModel']['name']); ?>:</i></td>
<td style="line-height: 14px;"><b style="color: <?= !empty($bs['decayed']) ? '#b94a48' : '#468847' ?>;"><?= round($bs['base_score'], 2) ?></b></td>
<td style="line-height: 14px;"><i class="no-overflow" style="max-width: 12em;" title="<?= h($score['DecayingModel']['name']); ?>"><?= h($score['DecayingModel']['name']); ?>:</i></td>
<td style="line-height: 14px;"><b style="color: <?= !empty($score['decayed']) ? '#b94a48' : '#468847' ?>;"><?= round($score['score'], 2) ?></b></td>
</tr>
<?php endforeach; ?>
</table>