210 lines
11 KiB
Plaintext
210 lines
11 KiB
Plaintext
|
Êþº¾ 4š
|
|||
|
|
Æ
|
|||
|
|
|
|||
|
|
Ï! "
|
|||
|
|
Ï#
|
|||
|
|
$%
|
|||
|
|
&'
|
|||
|
|
&(
|
|||
|
|
)*
|
|||
|
|
+,
|
|||
|
|
)-
|
|||
|
|
.
|
|||
|
|
)/
|
|||
|
|
0
|
|||
|
|
Ï1
|
|||
|
|
)2
|
|||
|
|
3
|
|||
|
|
4
|
|||
|
|
Ï5
|
|||
|
|
)6
|
|||
|
|
7
|
|||
|
|
)8
|
|||
|
|
)9
|
|||
|
|
&:
|
|||
|
|
);
|
|||
|
|
<
|
|||
|
|
)=
|
|||
|
|
>
|
|||
|
|
)?
|
|||
|
|
@
|
|||
|
|
)AB
|
|||
|
|
)C
|
|||
|
|
D
|
|||
|
|
)E
|
|||
|
|
)F
|
|||
|
|
ÏG
|
|||
|
|
)H
|
|||
|
|
I
|
|||
|
|
)J
|
|||
|
|
)K
|
|||
|
|
)L
|
|||
|
|
)MN
|
|||
|
|
)O
|
|||
|
|
ÏP
|
|||
|
|
)Q
|
|||
|
|
)R
|
|||
|
|
S
|
|||
|
|
ÏT
|
|||
|
|
)U
|
|||
|
|
)V
|
|||
|
|
W
|
|||
|
|
)X
|
|||
|
|
Y
|
|||
|
|
)Z
|
|||
|
|
)[
|
|||
|
|
)\
|
|||
|
|
]
|
|||
|
|
)^
|
|||
|
|
_
|
|||
|
|
)`
|
|||
|
|
a
|
|||
|
|
Ïb
|
|||
|
|
)c
|
|||
|
|
d
|
|||
|
|
)e
|
|||
|
|
)f
|
|||
|
|
)g
|
|||
|
|
)h
|
|||
|
|
)i
|
|||
|
|
)j
|
|||
|
|
)k
|
|||
|
|
)l
|
|||
|
|
)m
|
|||
|
|
)n
|
|||
|
|
)o
|
|||
|
|
)p
|
|||
|
|
)q
|
|||
|
|
)r
|
|||
|
|
)s
|
|||
|
|
)t
|
|||
|
|
)u
|
|||
|
|
)v
|
|||
|
|
)w
|
|||
|
|
)x
|
|||
|
|
)y
|
|||
|
|
)z
|
|||
|
|
){|
|
|||
|
|
)}
|
|||
|
|
)~
|
|||
|
|
|
|||
|
|
€�
|
|||
|
|
)‚
|
|||
|
|
)ƒ
|
|||
|
|
„…
|
|||
|
|
)†
|
|||
|
|
)‡
|
|||
|
|
)ˆ
|
|||
|
|
‰
|
|||
|
|
)Š
|
|||
|
|
‹
|
|||
|
|
)Œ
|
|||
|
|
�
|
|||
|
|
)Ž
|
|||
|
|
�
|
|||
|
|
)�
|
|||
|
|
)‘’ Ï“” •–
|
|||
|
|
—˜
|
|||
|
|
™š
|
|||
|
|
™›
|
|||
|
|
™œ
|
|||
|
|
™�
|
|||
|
|
™ž
|
|||
|
|
™Ÿ
|
|||
|
|
™
|
|||
|
|
™¡
|
|||
|
|
™¢
|
|||
|
|
™£
|
|||
|
|
™¤
|
|||
|
|
™¥
|
|||
|
|
™¦
|
|||
|
|
™§
|
|||
|
|
™¨
|
|||
|
|
™©
|
|||
|
|
™ª
|
|||
|
|
™«
|
|||
|
|
™¬
|
|||
|
|
™
|
|||
|
|
™®
|
|||
|
|
™¯
|
|||
|
|
™°
|
|||
|
|
™±
|
|||
|
|
™²
|
|||
|
|
™³
|
|||
|
|
™´
|
|||
|
|
™µ
|
|||
|
|
™¶
|
|||
|
|
™·
|
|||
|
|
™¸
|
|||
|
|
™¹
|
|||
|
|
™º
|
|||
|
|
™»
|
|||
|
|
™¼
|
|||
|
|
™½
|
|||
|
|
™¾
|
|||
|
|
™¿
|
|||
|
|
™À
|
|||
|
|
™Á
|
|||
|
|
™Â
|
|||
|
|
™Ã
|
|||
|
|
™Ä
|
|||
|
|
™Å
|
|||
|
|
™Æ
|
|||
|
|
™Ç
|
|||
|
|
™È
|
|||
|
|
™É
|
|||
|
|
™Ê
|
|||
|
|
™Ë
|
|||
|
|
™Ì
|
|||
|
|
™Í
|
|||
|
|
™Î
|
|||
|
|
™Ï
|
|||
|
|
™Ð
|
|||
|
|
™Ñ
|
|||
|
|
™Ò
|
|||
|
|
™Ó
|
|||
|
|
™Ô
|
|||
|
|
™Õ
|
|||
|
|
™Ö
|
|||
|
|
™×
|
|||
|
|
™Ø
|
|||
|
|
™Ù
|
|||
|
|
™Ú
|
|||
|
|
™Û
|
|||
|
|
ÜÝÞ
|
|||
|
|
ß
|
|||
|
|
à
|
|||
|
|
á
|
|||
|
|
â
|
|||
|
|
ãäå
|
|||
|
|
Üæçèé
|
|||
|
|
Ïê
|
|||
|
|
Üë
|
|||
|
|
&�ìíîïðñ
|
|||
|
|
òó log Lorg/slf4j/Logger; <init> ()V Code LineNumberTable LocalVariableTable this $Lcom/common/service/DataTransformer; transformGroupedData "(Ljava/util/List;)Ljava/util/List; alarm Lcom/common/entity/Alarm; groupedData %Lcom/common/entity/GroupedSyslogData; groupedDataList Ljava/util/List; alarmList LocalVariableTypeTable 7Ljava/util/List<Lcom/common/entity/GroupedSyslogData;>; +Ljava/util/List<Lcom/common/entity/Alarm;>;
|
|||
|
|
StackMapTableôõ MethodParameters Signature d(Ljava/util/List<Lcom/common/entity/GroupedSyslogData;>;)Ljava/util/List<Lcom/common/entity/Alarm;>; transformGroupedDataVisit Lcom/common/entity/AlarmVisit; 0Ljava/util/List<Lcom/common/entity/AlarmVisit;>; i(Ljava/util/List<Lcom/common/entity/GroupedSyslogData;>;)Ljava/util/List<Lcom/common/entity/AlarmVisit;>; transformSingleGroupedData @(Lcom/common/entity/GroupedSyslogData;)Lcom/common/entity/Alarm; e Ljava/lang/Exception;’ transformSingleGroupedDataVisit E(Lcom/common/entity/GroupedSyslogData;)Lcom/common/entity/AlarmVisit; getAlarmType 8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String; firstEventType Ljava/lang/String; eventTypeö determineAttackResult :(Lcom/common/entity/GroupedSyslogData;)Ljava/lang/Integer; result Ljava/lang/Integer;÷ extractPayloadSample ([[B)[B payloadSamples [[B buildComment 9(Lcom/common/entity/GroupedSyslogData;)Ljava/lang/String; victimIpsStr convertAlarmLevel '(Ljava/lang/Integer;)Ljava/lang/String;
|
|||
|
|
eventLevel convertHttpStatus '([Ljava/lang/String;)Ljava/lang/String; httpStatusCodes [Ljava/lang/String; convertAttackIps attackIps <clinit>
|
|||
|
|
SourceFile DataTransformer.java RuntimeVisibleAnnotations *Lorg/springframework/stereotype/Component; Ó Ô java/util/ArrayListô øù Óú ûüõ ýþ ÿ #com/common/entity/GroupedSyslogData ð ñ õ ö
|
|||
|
|
|
|||
|
|
|
|||
|
|
÷ ø ! "# $% &' (% )' *% +' java/lang/Integer ,- ./ 0- 1' 2 3% 4' 5 6# 7# ç ”åˆ¤å�Žå¤„ç½® 8 ý þ 9# :# ;< => ?- @/ A- B/ C- D E F G H I J%
|
|||
|
|
K L M N O P Q R S T U V W X Y Z [ \ ]# ^ _ ` a b c other d e fgh iù j# k#l m no po qo r% s' t% u' v% w' x% y' z{ java/lang/Exception Ñ Ò è½¬æ�¢åˆ†ç»„æ•°æ�®å¤±è´¥: {}| }~ �‚ ƒ „ ƒ ƒ ƒ ƒ ƒ "… &† )† +† ,‡ 0‡ 1† 2ƒ 4† 5ƒ 6… 7… 8ƒ 9… :… =ˆ ?‡ A‡ C‡ Dƒ Eƒ G„ I„ Kƒ Mƒ Nƒ Oƒ Pƒ Qƒ Rƒ Sƒ Tƒ Uƒ Vƒ Wƒ Xƒ Yƒ Zƒ [ƒ \ƒ ]… ^ƒ _„ `ƒ aƒ bƒ c„ dƒ e„ j… k… n‰ p‰ q‰ s† u† w† y† zŠö ‹þ Œ � Ž/ � � ‘’ , “” 未知 _24å°�时内，检测到%s上产生%så‘Šè¦ï¼š
|
|||
|
|
å‘Šè¦å��称：%s
|
|||
|
|
攻击IP：%s
|
|||
|
|
攻击结果：%d java/lang/Object
|
|||
|
|
•– 安全(æ— å¨�èƒ�) 低å�± ä¸å�± 高å�± 超å�± "com/common/service/DataTransformer— ˜™ java/util/List java/util/Iterator java/lang/String [Ljava/lang/Integer; size ()I (I)V iterator ()Ljava/util/Iterator; hasNext ()Z next ()Ljava/lang/Object; add (Ljava/lang/Object;)Z com/common/entity/Alarm builder AlarmBuilder InnerClasses (()Lcom/common/entity/Alarm$AlarmBuilder; java/util/UUID
|
|||
|
|
randomUUID ()Ljava/util/UUID; toString ()Ljava/lang/String; $com/common/entity/Alarm$AlarmBuilder id :(Ljava/lang/String;)Lcom/common/entity/Alarm$AlarmBuilder; java/time/LocalDateTime now ()Ljava/time/LocalDateTime; createdAt A(Ljava/time/LocalDateTime;)Lcom/common/entity/Alarm$AlarmBuilder; getOriginEventName alarmName getMaxEventLevel ()Ljava/lang/Integer;
|
|||
|
|
alarmLevel getFirstEventType getMinEventType alarmType getEventType alarmMajorType alarmMinorType valueOf (I)Ljava/lang/Integer; alarmAreaId ;(Ljava/lang/Integer;)Lcom/common/entity/Alarm$AlarmBuilder; getAttackIps ()[Ljava/lang/String; attackIp ;([Ljava/lang/String;)Lcom/common/entity/Alarm$AlarmBuilder; getVictimIps victimIp getVictimWebUrls victimWebUrl attackChainPhase <([Ljava/lang/Integer;)Lcom/common/entity/Alarm$AlarmBuilder; getDeviceIds ()[Ljava/lang/Integer; deviceId tag comment getOriginLogIds originLogIds queryId judgedState
|
|||
|
|
disposedState dispositionAdvice attackResult fall getPayloadSamples ()[[B payload *([B)Lcom/common/entity/Alarm$AlarmBuilder; operateEvent getAttackPorts
|
|||
|
|
attackPort getVictimPorts
|
|||
|
|
victimPort attackMethod businessExt
|
|||
|
|
getMinLogTime
|
|||
|
|
logStartAt
|
|||
|
|
getMaxLogTime logEndAt getHttpStatusCodes
|
|||
|
|
httpStatus
|
|||
|
|
getDnsInfo dnsInfo accountInfo attackerInfo
|
|||
|
|
victimInfo suspiciousAction vulnInfo weakPwd complianceBaseline fileInfo fileTags endpointInfo endpointProtection
|
|||
|
|
originInfo protocolInfo emailInfo
|
|||
|
|
sensitiveData hitIntelligence
|
|||
|
|
windowTime updatedAt
|
|||
|
|
engineType attackIpPic victimIpPic operationAt attackDirection etlTime getLogCount ()Ljava/lang/Long; java/lang/Long intValue logCount
|