It's required to unify the terminology of the detection event structures.

[syncpark]

The detection event structures used by Hog and review-database often use different terms.

For example, BlockListBootpFields uses orig_addr, orig_port, resp_addr, resp_port terms in Hog, but src_addr, src_port, dst_addr, dst_port in review-database.

And also, DnsCovertChannelFields of Hog is same structure with DnsEventFields of review-database, but last_time is used in DnsCovertChannelFields and session_end_time in DnsEventFields.

It's required to unify the terminology of the detection event structures.