149 lines
14 KiB
Plaintext
149 lines
14 KiB
Plaintext
|
Êþº¾ 4>
|
|||
|
|
¢() *+
|
|||
|
|
,-
|
|||
|
|
./
|
|||
|
|
,01 *23
|
|||
|
|
|
|||
|
|
(4
|
|||
|
|
|
|||
|
|
5
|
|||
|
|
6
|
|||
|
|
|
|||
|
|
7
|
|||
|
|
89:
|
|||
|
|
; A jBC
|
|||
|
|
D
|
|||
|
|
EFGH jI
|
|||
|
|
|
|||
|
|
JK
|
|||
|
|
L M
|
|||
|
|
žNO
|
|||
|
|
"(P
|
|||
|
|
Q
|
|||
|
|
"RS
|
|||
|
|
"TU
|
|||
|
|
"VW
|
|||
|
|
"XY
|
|||
|
|
"Z[
|
|||
|
|
"\]
|
|||
|
|
^_
|
|||
|
|
`
|
|||
|
|
"ab
|
|||
|
|
"cd
|
|||
|
|
"ef
|
|||
|
|
"gh
|
|||
|
|
"ij
|
|||
|
|
"kl
|
|||
|
|
"mn
|
|||
|
|
"op
|
|||
|
|
"qr
|
|||
|
|
"st
|
|||
|
|
"uv
|
|||
|
|
"wx
|
|||
|
|
"y
|
|||
|
|
z{
|
|||
|
|
"|
|
|||
|
|
‚}
|
|||
|
|
‚~€
|
|||
|
|
Q�
|
|||
|
|
‚‚
|
|||
|
|
^ƒ
|
|||
|
|
^„
|
|||
|
|
^…
|
|||
|
|
^7
|
|||
|
|
ž†‡
|
|||
|
|
Z(
|
|||
|
|
ˆ‰Š‹
|
|||
|
|
_(
|
|||
|
|
žŒ�
|
|||
|
|
Ž �� ‘’“”
|
|||
|
|
g•– j— ˜™ š› šœ� ož
|
|||
|
|
¢7
|
|||
|
|
‚Ÿ o¡¢ u£¤
|
|||
|
|
|
|||
|
|
¥¦ u§ j¨©ª
|
|||
|
|
ž«¬
|
|||
|
|
®¯°
|
|||
|
|
±²³´µ
|
|||
|
|
‚¶
|
|||
|
|
ˆ�
|
|||
|
|
·¸
|
|||
|
|
ˆ¹
|
|||
|
|
ˆº»
|
|||
|
|
¼
|
|||
|
|
Z¨½
|
|||
|
|
’(
|
|||
|
|
�¾
|
|||
|
|
�§ u¿
|
|||
|
|
ÀÁÂ
|
|||
|
|
‚Ã
|
|||
|
|
‚Ä
|
|||
|
|
ÀÅ
|
|||
|
|
Æ
|
|||
|
|
ÀÇÈ
|
|||
|
|
ž(É
|
|||
|
|
ÊËÌ InnerClasses objectMapper -Lcom/fasterxml/jackson/databind/ObjectMapper; logger Lorg/slf4j/Logger; <init> ()V Code LineNumberTable LocalVariableTable this Lcom/common/util/JsonParser; main ([Ljava/lang/String;)V xdrHoneypot Lcom/common/entity/XdrHoneypot; e Ljava/lang/Exception; args [Ljava/lang/String;
|
|||
|
|
logMessage Ljava/lang/String; complexJson flatMap Ljava/util/Map; nestedMap LocalVariableTypeTable 5Ljava/util/Map<Ljava/lang/String;Ljava/lang/Object;>;
|
|||
|
|
StackMapTable ¶¯1 MethodParameters parseLogMessageToXdrHoneypot 3(Ljava/lang/String;)Lcom/common/entity/XdrHoneypot;
|
|||
|
|
jsonString jsonNode )Lcom/fasterxml/jackson/databind/JsonNode;
|
|||
|
|
Exceptions extractJsonFromLogMessage &(Ljava/lang/String;)Ljava/lang/String;
|
|||
|
|
startIndex I endIndex getStringValue O(Lcom/fasterxml/jackson/databind/JsonNode;Ljava/lang/String;)Ljava/lang/String; fieldName fieldNodeÍ getExtraAsString =(Lcom/fasterxml/jackson/databind/JsonNode;)Ljava/lang/String; extraNode parseJsonToFlatMap -(Ljava/lang/String;)Ljava/util/LinkedHashMap; resultMap Ljava/util/LinkedHashMap; typeRef /Lcom/fasterxml/jackson/core/type/TypeReference;
|
|||
|
|
jsonObject Ljava/lang/Object; jsonStr ?Ljava/util/LinkedHashMap<Ljava/lang/String;Ljava/lang/Object;>; fLcom/fasterxml/jackson/core/type/TypeReference<Ljava/util/Map<Ljava/lang/String;Ljava/lang/Object;>;>;‡ Signature S(Ljava/lang/String;)Ljava/util/LinkedHashMap<Ljava/lang/String;Ljava/lang/Object;>; flattenJson 6(Ljava/lang/String;Ljava/lang/Object;Ljava/util/Map;)V key newPath entry Entry Ljava/util/Map$Entry; map i list Ljava/util/List; currentPath Ljava/util/Map$Entry<**>; Ljava/util/Map<**>; Ljava/util/List<*>;–Î�Ì¢ \(Ljava/lang/String;Ljava/lang/Object;Ljava/util/Map<Ljava/lang/String;Ljava/lang/Object;>;)V parseJsonToNestedMap #(Ljava/lang/String;)Ljava/util/Map; I(Ljava/lang/String;)Ljava/util/Map<Ljava/lang/String;Ljava/lang/Object;>; printMap (Ljava/util/Map;)V 8(Ljava/util/Map<Ljava/lang/String;Ljava/lang/Object;>;)V %(Ljava/lang/String;Ljava/util/Map;I)V value fullKey prefix indent sb Ljava/lang/StringBuilder; indentStr ;Ljava/util/Map$Entry<Ljava/lang/String;Ljava/lang/Object;>;3 K(Ljava/lang/String;Ljava/util/Map<Ljava/lang/String;Ljava/lang/Object;>;I)V printList &(Ljava/lang/String;Ljava/util/List;I)V itemKey $Ljava/util/List<Ljava/lang/Object;>; :(Ljava/lang/String;Ljava/util/List<Ljava/lang/Object;>;I)V jsonToMap Lorg/json/JSONObject; toMap 0(Lorg/json/JSONObject;)Ljava/util/LinkedHashMap; keys Ljava/util/Iterator; (Ljava/util/Iterator<Ljava/lang/String;>; V(Lorg/json/JSONObject;)Ljava/util/LinkedHashMap<Ljava/lang/String;Ljava/lang/Object;>; toList &(Lorg/json/JSONArray;)Ljava/util/List; array Lorg/json/JSONArray; :(Lorg/json/JSONArray;)Ljava/util/List<Ljava/lang/Object;>; preprocessJson ((Ljava/lang/String;)Ljava/util/Optional; trimmed <(Ljava/lang/String;)Ljava/util/Optional<Ljava/lang/String;>; isValidJson (Ljava/lang/String;)Z
|
|||
|
|
lambda$main$0 '(Ljava/lang/String;Ljava/lang/Object;)V <clinit>
|
|||
|
|
SourceFile JsonParser.java ¨ ©ž<15>Sep 24 12:06:59 LAPTOP-ARDUR3N0 <15>2025-09-24T11:52:26Z 5f46d3be75e1 supermario 128 honeypot_event - {"source":"honeypot","id":"f6a13c35-bf9d-4da6-a181-50ce23e7ef6a","start_time":"2023-09-03T11:07:02.50167643Z","time":"2023-09-03T11:16:18.883885281Z","risk_level":4,"connection":"b18f3fbe-3fbf-4495-815f-ff26f6fb0bdf","file_info":null,"extra":{"payload":{"format":"line","name":{"cn":"攻击载è�·","en":"payload"},"value":""},"uid":{"format":"line","name":{"cn":"","en":""},"uid":"b4cbc73c-25d0-4429-ae1b-a856cdf1a651","value":""}},"type":"WEB_ATTACK_SCANNER","agent_sn":"caa7da42-0cca-4cb1-b501-1f1eb2b588d5","agent_name":" 教育局蜜ç½�探针","honeypot_id":"11a9ac6bdf38ae2aaa49ec4f1b4a921bff71952cb9f175bdd8ee1f0497057bc6","honeypot_name":"茂å��市ä¸å°�å¦ç®¡ç�†å¹³å�°ç®¡ç�†å�Žå�°","src_ip":"117.50.189.7","src_port":58512,"src_mac":"","dest_ip":"192.168.222.2","dest_port":9200,"proxy_ip":null,"node":"WRx3"}Ï ÐÑÒ ÓÔ Ä Å è§£æž�æˆ�功ï¼� ÓÕ java/lang/Exception ÖÑ java/lang/StringBuilder 解æž�失败: ×Ø ÙÚ ÛÚ Ü ©2{"source":"honeypot1","id":"f6a13c35-bf9d-4da6-a181-50ce23e7ef6a","start_time":"2023-09-03T11:07:02.50167643Z","time":"2023-09-03T11:16:18.883885281Z","risk_level":4,"connection":"b18f3fbe-3fbf-4495-815f-ff26f6fb0bdf","file_info":null,"extra":{"payload":{"format":"line","name":{"cn":"攻击载è�·","en":"payload"},"value":""},"uid":{"format":"line","name":{"cn":"","en":""},"uid":"b4cbc73c-25d0-4429-ae1b-a856cdf1a651","value":""}},"type":"WEB_ATTACK_SCANNER","agent_sn":"caa7da42-0cca-4cb1-b501-1f1eb2b588d5","agent_name":" 教育局蜜ç½�探针","honeypot_id":"11a9ac6bdf38ae2aaa49ec4f1b4a921bff71952cb9f175bdd8ee1f0497057bc6","honeypot_name":"茂å��市ä¸å°�å¦ç®¡ç�†å¹³å�°ç®¡ç�†å�Žå�°","src_ip":"117.50.189.7","src_port":58512,"src_mac":"","dest_ip":"192.168.222.2","dest_port":9200,"proxy_ip":null,"node":"WRx3"} "=== æ‰�平化 Map 解æž�结果 === × Ø BootstrapMethodsÝÞß$ àá âã &
|
|||
|
|
=== 嵌套结构 Map 解æž�结果 === ú û ý þ
|
|||
|
|
=== 特定值访问示例 === extra.payload.format: extra.payload.format äå ×æ extra.payload.name.cn Ê Ë ¤ ¥ çè com/common/entity/XdrHoneypot source Ï Ð éÔ
|
|||
|
|
start_time êÔ time ëÔ
|
|||
|
|
risk_level ìÔ
|
|||
|
|
connection íÔ file_info îÔ extraÍ äè Ô Õ ïÔ type ðÔ agent_sn ñÔ
|
|||
|
|
agent_name òÔ honeypot_id óÔ
|
|||
|
|
honeypot_name ôÔ src_ip õÔ src_port öÔ src_mac ÷Ô dest_ip øÔ dest_port ùÔ proxy_ip úÔ node ûÔü ýþ ÿ "java/lang/IllegalArgumentException -日志消æ�¯ä¸æœªæ‰¾åˆ°æœ‰æ•ˆçš„ JSON 内容 ¨Ô Ú
|
|||
|
|
java/util/LinkedHashMap !" parseJsonToFlatMap() json str: isValidJson(string) is false com/common/util/JsonParser$1
|
|||
|
|
å æ ¦ § !parseJsonToFlatMap ex.message:{} $ java/lang/RuntimeException $parseJsonToFlatMap JSON 解æž�失败 ¨
|
|||
|
|
java/util/Map Î java/util/Map$Entry . java/util/List [ × ] ä ! Exception ex.message: flattenJson 处ç�†å¼‚常 " (parseJsonToNestedMap() JSON 解æž�失败 ý java/lang/String : = ]: ] = org/json/JSONObject #Ú jsonToMap 转æ�¢å¤±è´¥: ä$ org/json/JSONArray java/util/ArrayList % &'( )*  +" , -. / +com/fasterxml/jackson/databind/ObjectMapper com/common/util/JsonParser0 12 java/lang/Object 'com/fasterxml/jackson/databind/JsonNode java/util/Iterator java/lang/System out Ljava/io/PrintStream; java/io/PrintStream println (Ljava/lang/String;)V (Ljava/lang/Object;)V err append -(Ljava/lang/String;)Ljava/lang/StringBuilder;
|
|||
|
|
getMessage ()Ljava/lang/String; toString printStackTrace
|
|||
|
|
34 '(Ljava/lang/Object;Ljava/lang/Object;)V
|
|||
|
|
5 accept !()Ljava/util/function/BiConsumer; forEach "(Ljava/util/function/BiConsumer;)V get &(Ljava/lang/Object;)Ljava/lang/Object; -(Ljava/lang/Object;)Ljava/lang/StringBuilder; readTree =(Ljava/lang/String;)Lcom/fasterxml/jackson/databind/JsonNode; setVcsource
|
|||
|
|
setDstartTime setDtime setRiskLevel setVcconnection setFileInfo setExtra setVctype
|
|||
|
|
setAgentSn setAgentName
|
|||
|
|
setHoneypotId setHoneypotName setSrcIp
|
|||
|
|
setSrcPort setSrcMac setDestIp setDestPort
|
|||
|
|
setProxyIp setNode java/time/LocalDateTime now ()Ljava/time/LocalDateTime;
|
|||
|
|
setCreateTime (Ljava/time/LocalDateTime;)V indexOf (I)I lastIndexOf substring (II)Ljava/lang/String; isNull ()Z isTextual asText writeValueAsString &(Ljava/lang/Object;)Ljava/lang/String; readValue U(Ljava/lang/String;Lcom/fasterxml/jackson/core/type/TypeReference;)Ljava/lang/Object; org/slf4j/Logger error *(Ljava/lang/String;Ljava/lang/Throwable;)V entrySet ()Ljava/util/Set;
|
|||
|
|
java/util/Set iterator ()Ljava/util/Iterator; hasNext next ()Ljava/lang/Object; getKey isEmpty getValue size ()I (I)Ljava/lang/StringBuilder; (I)Ljava/lang/Object; put 8(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object; 7(Ljava/lang/String;Ljava/lang/Class;)Ljava/lang/Object; trim &(Ljava/lang/String;)Ljava/lang/Object; length add (Ljava/lang/Object;)Z java/util/Optional empty ()Ljava/util/Optional;
|
|||
|
|
startsWith (I)Ljava/lang/String; of ((Ljava/lang/Object;)Ljava/util/Optional; isPresent org/slf4j/LoggerFactory getLogger %(Ljava/lang/Class;)Lorg/slf4j/Logger;6 7: #$ "java/lang/invoke/LambdaMetafactory metafactory< Lookup Ì(Ljava/lang/invoke/MethodHandles$Lookup;Ljava/lang/String;Ljava/lang/invoke/MethodType;Ljava/lang/invoke/MethodType;Ljava/lang/invoke/MethodHandle;Ljava/lang/invoke/MethodType;)Ljava/lang/invoke/CallSite;= %java/lang/invoke/MethodHandles$Lookup java/lang/invoke/MethodHandles ! ¢ ¤ ¥ ¦ § ¨ © ª / *· ± « ¬ ® ¯ ° ª ¨ ¹L² +¶ +¸ M² ¶ ² ,¶ § $M² »
|
|||
|
|
Y· ¶
|
|||
|
|
,¶ ¶
|
|||
|
|
¶ ¶ ,¶ M² ¶ ,¸ N-º ¹ ² ¶ ,¸ :¸ ² ¶ ² »
|
|||
|
|
Y· ¶
|
|||
|
|
-¹ ¶ ¶ ¶ ² »
|
|||
|
|
Y· ¶
|
|||
|
|
- ¹ ¶ ¶ ¶ ±
|
|||
|
|
! « R
|
|||
|
|
! " > B # E % M & R ' ] ) e * k + p - x / ˜ 0 ¸ 1 ¬ H ± ² " ³ ´ ¹ µ ¶ ¶ · ¸ E t ¹ ¸ R g º » k N ¼ » ½ R g º ¾ k N ¼ ¾ ¿ ÿ ! À Á Â Ã µ Ä Å ª ƒ ß*¸ L² +¶ !M» "Y· #N-,$¸ %¶ &-,'¸ %¶ (-,)¸ %¶ *-,+¸ %¶ ,-,-¸ %¶ .-,/¸ %¶ 0-,1¶ 2¸ 3¶ 4-,5¸ %¶ 6-,7¸ %¶ 8-,9¸ %¶ :-,;¸ %¶ <-,=¸ %¶ >-,?¸ %¶ @-,A¸ %¶ B-,C¸ %¶ D-,E¸ %¶ F-,G¸ %¶ H-,I¸ %¶ J-,K¸ %¶ L-¸ M¶ N-° « b 8 ;
|
|||
|
|
> A B ) C 3 D = E G F Q G ^ H h I r J | K † L � M š N ¤ O ® P ¸ Q Â R Ì S Ö T Ý V ¬ * ß · ¸ Ú Æ ¸
|
|||
|
|
Ò Ç È Ê ± ² É Ã · Ê Ë ª Œ 0*{¶ O<*}¶ P=Ÿ
|
|||
|
|
Ÿ £
|
|||
|
|
» QYR· S¿* `¶ T° « ^ _ a b ' d ¬ 0 · ¸ ) Ì Í " Î Í ¿ ý Ã ·
|
|||
|
|
Ï Ð ª † $*+¶ 2M,Æ
|
|||
|
|
,¶ U™ °,¶ V™ ,¶ W°,¶ X° « l m n q r u ¬ $ Ç È $ Ñ ¸ Ò È ¿
|
|||
|
|
ü Ó Ã Ç Ñ
|
|||
|
|
Ô Õ ª u *Æ
|
|||
|
|
*¶ U™ °² *¶ Y°L*¶ X°
|
|||
|
|
« } ~
|
|||
|
|
� ‚ „ ¬ ³ ´ Ö È ¿ G Â Ã Ö × Ø ª + f» ZY· [L*¸ \š &² »
|
|||
|
|
Y· ]¶
|
|||
|
|
*¶
|
|||
|
|
¶ ¶ ² ^¶ °» _Y· `M² *,¶ aNb-+¸ c+°L² de+¶ ¹ f » gYh+· i¿ 1 L 2 K L « 2 � ‘ “ ( ” 0 • 2 ˜ : ™ C › J œ L � M Ÿ [ ¬ 4 D Ù Ú : Û Ü C Ý Þ M ³ ´ f ß ¸ ½ D Ù à : Û á ¿ ü 2 âÿ Á Â Ã ß ã ä
|
|||
|
|
å æ ª K ù+Á j™ p+À jN-¹ k ¹ l :¹ m ™ Q¹ n À o:¹ p ¶ q:*¶ r™ § »
|
|||
|
|
Y· *¶
|
|||
|
|
s¶
|
|||
|
|
¶
|
|||
|
|
¶ :¹ t ,¸ c§ÿ«§ \+Á u™ L+À uN6-¹ v ¢ 6»
|
|||
|
|
Y· *¶
|
|||
|
|
w¶
|
|||
|
|
¶ xy¶
|
|||
|
|
¶ :-¹ z ,¸ c„§ÿŧ ,*+¹ { W§ +N² »
|
|||
|
|
Y· |¶
|
|||
|
|
-¶ ¶
|
|||
|
|
¶ ¶ » gY}-· i¿± Í Ð « R ª ¬ / ® ; ¯ a ° n ± q ² { ´ € µ Ž ¶ · » µ Á ¹ Ä » Í Â Ð ¾ Ñ ¿ í Á ø Ã ¬ p ; 3 ç ¸ a
|