<?php

declare(strict_types=1);

namespace App\Framework\Waf\MachineLearning;

/**
 * Types of behavioral anomalies detected by ML analysis
 */
enum AnomalyType: string
{
    case FREQUENCY_SPIKE = 'frequency_spike';
    case UNUSUAL_PATTERN = 'unusual_pattern';
    case GEOGRAPHIC_ANOMALY = 'geographic_anomaly';
    case TEMPORAL_ANOMALY = 'temporal_anomaly';
    case BEHAVIORAL_DRIFT = 'behavioral_drift';
    case OUTLIER_DETECTION = 'outlier_detection';
    case CLUSTERING_DEVIATION = 'clustering_deviation';
    case STATISTICAL_ANOMALY = 'statistical_anomaly';
    case SEQUENCE_ANOMALY = 'sequence_anomaly';
    case CORRELATION_BREAK = 'correlation_break';
    case CLUSTER_DEVIATION = 'cluster_deviation';
    case DENSITY_ANOMALY = 'density_anomaly';
    case GROUP_ANOMALY = 'group_anomaly';

    /**
     * Get human-readable description
     */
    public function getDescription(): string
    {
        return match ($this) {
            self::FREQUENCY_SPIKE => 'Unusual spike in request frequency',
            self::UNUSUAL_PATTERN => 'Deviation from established behavior patterns',
            self::GEOGRAPHIC_ANOMALY => 'Unusual geographic access patterns',
            self::TEMPORAL_ANOMALY => 'Abnormal timing or temporal patterns',
            self::BEHAVIORAL_DRIFT => 'Gradual shift in behavioral baseline',
            self::OUTLIER_DETECTION => 'Statistical outlier in behavior metrics',
            self::CLUSTERING_DEVIATION => 'Deviation from normal clustering patterns',
            self::STATISTICAL_ANOMALY => 'Statistical significance in behavior change',
            self::SEQUENCE_ANOMALY => 'Unusual sequence or order of actions',
            self::CORRELATION_BREAK => 'Break in normal correlation patterns',
            self::CLUSTER_DEVIATION => 'Deviation from cluster patterns',
            self::DENSITY_ANOMALY => 'Abnormal density in feature space',
            self::GROUP_ANOMALY => 'Anomalous group behavior patterns'
        };
    }

    /**
     * Get default confidence threshold for this anomaly type
     */
    public function getConfidenceThreshold(): float
    {
        return match ($this) {
            self::FREQUENCY_SPIKE => 0.85,
            self::UNUSUAL_PATTERN => 0.75,
            self::GEOGRAPHIC_ANOMALY => 0.80,
            self::TEMPORAL_ANOMALY => 0.70,
            self::BEHAVIORAL_DRIFT => 0.60,
            self::OUTLIER_DETECTION => 0.85,
            self::CLUSTERING_DEVIATION => 0.75,
            self::STATISTICAL_ANOMALY => 0.90,
            self::SEQUENCE_ANOMALY => 0.80,
            self::CORRELATION_BREAK => 0.75,
            self::CLUSTER_DEVIATION => 0.80,
            self::DENSITY_ANOMALY => 0.85,
            self::GROUP_ANOMALY => 0.75
        };
    }

    /**
     * Get severity level for this anomaly type
     */
    public function getSeverityLevel(): string
    {
        return match ($this) {
            self::FREQUENCY_SPIKE => 'high',
            self::UNUSUAL_PATTERN => 'medium',
            self::GEOGRAPHIC_ANOMALY => 'medium',
            self::TEMPORAL_ANOMALY => 'low',
            self::BEHAVIORAL_DRIFT => 'low',
            self::OUTLIER_DETECTION => 'medium',
            self::CLUSTERING_DEVIATION => 'medium',
            self::STATISTICAL_ANOMALY => 'high',
            self::SEQUENCE_ANOMALY => 'medium',
            self::CORRELATION_BREAK => 'medium',
            self::CLUSTER_DEVIATION => 'medium',
            self::DENSITY_ANOMALY => 'high',
            self::GROUP_ANOMALY => 'medium'
        };
    }

    /**
     * Check if this anomaly requires immediate action
     */
    public function requiresImmediateAction(): bool
    {
        return match ($this) {
            self::FREQUENCY_SPIKE,
            self::STATISTICAL_ANOMALY => true,
            default => false
        };
    }

    /**
     * Get recommended action for this anomaly type
     */
    public function getRecommendedAction(): string
    {
        return match ($this) {
            self::FREQUENCY_SPIKE => 'Rate limiting, temporary blocking',
            self::UNUSUAL_PATTERN => 'Enhanced monitoring, pattern analysis',
            self::GEOGRAPHIC_ANOMALY => 'Geographic verification, location analysis',
            self::TEMPORAL_ANOMALY => 'Schedule analysis, time-based rules',
            self::BEHAVIORAL_DRIFT => 'Baseline update, long-term monitoring',
            self::OUTLIER_DETECTION => 'Detailed analysis, manual review',
            self::CLUSTERING_DEVIATION => 'Cluster analysis, behavior profiling',
            self::STATISTICAL_ANOMALY => 'Immediate investigation, possible blocking',
            self::SEQUENCE_ANOMALY => 'Sequence analysis, flow monitoring',
            self::CORRELATION_BREAK => 'Correlation analysis, relationship mapping',
            self::CLUSTER_DEVIATION => 'Cluster reanalysis, pattern adjustment',
            self::DENSITY_ANOMALY => 'Density analysis, space examination',
            self::GROUP_ANOMALY => 'Group analysis, collective behavior review'
        };
    }

    /**
     * Get analysis complexity for this anomaly type
     */
    public function getAnalysisComplexity(): string
    {
        return match ($this) {
            self::FREQUENCY_SPIKE => 'low',
            self::UNUSUAL_PATTERN => 'high',
            self::GEOGRAPHIC_ANOMALY => 'medium',
            self::TEMPORAL_ANOMALY => 'medium',
            self::BEHAVIORAL_DRIFT => 'high',
            self::OUTLIER_DETECTION => 'medium',
            self::CLUSTERING_DEVIATION => 'high',
            self::STATISTICAL_ANOMALY => 'medium',
            self::SEQUENCE_ANOMALY => 'high',
            self::CORRELATION_BREAK => 'high',
            self::CLUSTER_DEVIATION => 'high',
            self::DENSITY_ANOMALY => 'high',
            self::GROUP_ANOMALY => 'medium'
        };
    }
}
