/src/ntopng/include/BlacklistUsageStats.h
Line | Count | Source |
1 | | /* |
2 | | * |
3 | | * (C) 2019-26 - ntop.org |
4 | | * |
5 | | * |
6 | | * This program is free software; you can redistribute it and/or modify |
7 | | * it under the terms of the GNU General Public License as published by |
8 | | * the Free Software Foundation; either version 3 of the License, or |
9 | | * (at your option) any later version. |
10 | | * |
11 | | * This program is distributed in the hope that it will be useful, |
12 | | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
13 | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
14 | | * GNU General Public License for more details. |
15 | | * |
16 | | * You should have received a copy of the GNU General Public License |
17 | | * along with this program; if not, write to the Free Software Foundation, |
18 | | * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. |
19 | | * |
20 | | */ |
21 | | |
22 | | #ifndef _BLACKLIST_USAGE_STATS_H_ |
23 | | #define _BLACKLIST_USAGE_STATS_H_ |
24 | | |
25 | | class BlacklistUsageStats { |
26 | | private: |
27 | | u_int32_t num_hits, num_total_hits; |
28 | | |
29 | | #ifdef FULL_BL_STATS |
30 | | u_int32_t num_true_positives, /* the number of IPs that attack and are in the |
31 | | blacklist */ |
32 | | num_false_positives, /* the number IPs that are in the blacklist but |
33 | | didn't attack */ |
34 | | num_false_negatives, /* the number of IPs that attacked but are not in the |
35 | | blacklist */ |
36 | | num_true_negatives; /* the number of IPs that didn't attack and are not in |
37 | | the blacklist, or 2^32 */ |
38 | | #endif |
39 | | |
40 | | public: |
41 | 0 | BlacklistUsageStats() { |
42 | 0 | num_hits = num_total_hits = 1; |
43 | | #ifdef FULL_BL_STATS |
44 | | num_true_positives = num_false_positives = num_false_negatives = |
45 | | num_true_negatives = 0; |
46 | | #endif |
47 | 0 | } |
48 | | |
49 | | #ifdef FULL_BL_STATS |
50 | | inline float correlationCoefficient() { |
51 | | /* https://en.wikipedia.org/wiki/Phi_coefficient */ |
52 | | u_int32_t num = (num_true_positives + num_true_negatives) - |
53 | | (num_false_positives * num_false_negatives); |
54 | | u_int32_t den = (num_true_positives + cnum_true_positives) * |
55 | | (num_true_positives + num_false_negatives) * |
56 | | (num_true_negatives + num_false_positives) * |
57 | | (num_true_negatives + num_false_negatives); |
58 | | |
59 | | return ((den == 0) ? 0. : ((float)num / sqrt(num))); |
60 | | } |
61 | | |
62 | | inline void inc(u_int32_t tp, u_int32_t fp, u_int32_t fn, u_int32_t tn) { |
63 | | num_true_positives += tp, num_false_positives += fp, |
64 | | num_false_negatives += fn, num_true_negatives += tn; |
65 | | } |
66 | | |
67 | | inline void get(u_int32_t* tp, u_int32_t* fp, u_int32_t* fn, u_int32_t* tn) { |
68 | | *tp = num_true_positives, *fp = num_false_positives, |
69 | | *fn = num_false_negatives, *tn = num_true_negatives; |
70 | | } |
71 | | #endif |
72 | | |
73 | 0 | inline void incHits() { num_hits++, num_total_hits++; } |
74 | 0 | inline u_int32_t getNumHits() { return (num_hits); } |
75 | 0 | inline u_int32_t getNumTotalHits() { return (num_total_hits); } |
76 | 0 | inline void resetNumHits() { num_hits = 0; } |
77 | | }; |
78 | | |
79 | | #endif /* _BLACKLIST_USAGE_STATS_H_ */ |