109 lines
10 KiB
Plaintext
109 lines
10 KiB
Plaintext
|
Êþº¾ 4(
|
|||
|
|
µ
|
|||
|
|
¬
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
¬ ¬
|
|||
|
|
!"
|
|||
|
|
# $%
|
|||
|
|
&
|
|||
|
|
'(
|
|||
|
|
')
|
|||
|
|
¬*
|
|||
|
|
+
|
|||
|
|
,
|
|||
|
|
¬-
|
|||
|
|
.
|
|||
|
|
/0
|
|||
|
|
1
|
|||
|
|
23
|
|||
|
|
45
|
|||
|
|
¬6
|
|||
|
|
78
|
|||
|
|
9:
|
|||
|
|
;
|
|||
|
|
<
|
|||
|
|
=>
|
|||
|
|
?@
|
|||
|
|
AB
|
|||
|
|
CD È
|
|||
|
|
EF
|
|||
|
|
¬G
|
|||
|
|
HI
|
|||
|
|
J
|
|||
|
|
K
|
|||
|
|
L
|
|||
|
|
M
|
|||
|
|
NO
|
|||
|
|
PQ
|
|||
|
|
R
|
|||
|
|
ST
|
|||
|
|
UV
|
|||
|
|
WX
|
|||
|
|
YZ
|
|||
|
|
[
|
|||
|
|
¬\]^ _`
|
|||
|
|
4a
|
|||
|
|
4bc
|
|||
|
|
4d
|
|||
|
|
e
|
|||
|
|
¬f
|
|||
|
|
g
|
|||
|
|
4hij
|
|||
|
|
kl
|
|||
|
|
mn
|
|||
|
|
o
|
|||
|
|
p
|
|||
|
|
qrstu
|
|||
|
|
vwx
|
|||
|
|
4yz{|}~€�‚ƒ„…†‡ˆ‰Š‹Œ�Ž��‘’“”•–—˜™š›œ�žŸ ¡¢£¤¥¦§¨©ª«¬ ¬
|
|||
|
|
/®¯ ®°
|
|||
|
|
4±
|
|||
|
|
4²³
|
|||
|
|
¡
|
|||
|
|
¡´µ
|
|||
|
|
¡)
|
|||
|
|
/¶· ¸
|
|||
|
|
¹º
|
|||
|
|
¹»
|
|||
|
|
¹¼½
|
|||
|
|
¾¿ÀÁ
|
|||
|
|
®ÂÃÄÅÆÇ log Lorg/slf4j/Logger; DATE_FORMATTERS %[Ljava/time/format/DateTimeFormatter; <init> ()V Code LineNumberTable LocalVariableTable this 'Lcom/common/util/AlgorithmResultParser; buildNewLogsFromExample ()Ljava/util/List; exampleJson Ljava/lang/String; Signature 8()Ljava/util/List<Lcom/common/entity/SyslogNormalData;>; parseJsonToLogs $(Ljava/lang/String;)Ljava/util/List; jsonObj !Lcom/alibaba/fastjson/JSONObject; logData $Lcom/common/entity/SyslogNormalData; i I jsonArray Lcom/alibaba/fastjson/JSONArray; e Ljava/lang/Exception; jsonStr logs Ljava/util/List; LocalVariableTypeTable 6Ljava/util/List<Lcom/common/entity/SyslogNormalData;>;
|
|||
|
|
StackMapTableÈɽÊ! MethodParameters J(Ljava/lang/String;)Ljava/util/List<Lcom/common/entity/SyslogNormalData;>; convertJsonObject G(Lcom/alibaba/fastjson/JSONObject;)Lcom/common/entity/SyslogNormalData; logTime Ljava/time/LocalDateTime; now
|
|||
|
|
accessTime originFieldË%Ì extractAdditionalInfo 9(Lcom/common/entity/SyslogNormalData;Ljava/lang/String;)V fileInfo parts [Ljava/lang/String; maliciousRequest î determineFileType &(Ljava/lang/String;)Ljava/lang/String; fileName
|
|||
|
|
parseDateTime -(Ljava/lang/String;)Ljava/time/LocalDateTime; formatter $Ljava/time/format/DateTimeFormatter; datePart timeStr ¹À getString G(Lcom/alibaba/fastjson/JSONObject;Ljava/lang/String;)Ljava/lang/String; key Y(Lcom/alibaba/fastjson/JSONObject;Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String; value defaultValue getLong U(Lcom/alibaba/fastjson/JSONObject;Ljava/lang/String;Ljava/lang/Long;)Ljava/lang/Long; Ljava/lang/Long;Í
|
|||
|
|
getInteger [(Lcom/alibaba/fastjson/JSONObject;Ljava/lang/String;Ljava/lang/Integer;)Ljava/lang/Integer; Ljava/lang/Integer;Î <clinit>
|
|||
|
|
SourceFile AlgorithmResultParser.java RuntimeVisibleAnnotations *Lorg/springframework/stereotype/Component; º » [
|
|||
|
|
{
|
|||
|
|
"_index": "es:skyeye-weblog-2025.09.30",
|
|||
|
|
"access_time": "2025-09-30 12:05:00",
|
|||
|
|
"dip": "10.20.30.51",
|
|||
|
|
"dname": "网页木马��",
|
|||
|
|
"dtype": "疑似木马活动",
|
|||
|
|
"host": "",
|
|||
|
|
"log_id": "hidden-002",
|
|||
|
|
"origin_field": "匹�到文件�: shell.php:.jpg 与 匹�到��请求: exec=dir",
|
|||
|
|
"reason": "�IP 203.0.113.51 访问 目的IP 10.20.30.51 异常，入度=0, 出度=0, 独立访客=1，匹�到文件�: shell.php:.jpg，匹�到��请求: exec=dir",
|
|||
|
|
"referer": "",
|
|||
|
|
"sip": "203.0.113.51",
|
|||
|
|
"status_code": 200,
|
|||
|
|
"url": "/admin/shell.php:.jpg"
|
|||
|
|
}
|
|||
|
|
] Ç È java/util/ArrayListÏ ÐÑÉ ÒÓ ÔÕ à áÈ Ö× ¶ · æˆ�功解æž� {} æ�¡æ—¥å¿—æ•°æ�®Î ØÙÚ ÛÜ java/lang/Exception 解æž�JSON失败: {} ÝÞ ßà "com/common/entity/SyslogNormalData log_idá âã äÞ ü ÿ åæ çæ ü ý èæÌ äé êë ìë access_timeÊ íî ô õ ïë sip ðæ dip ñæ òæ óæ url ôæ host õæ referer öæ status_codeÍ Ø÷ øù GET úæ ûü ýü þü ÿü dtype æ dname æ æ reason æ origin_field æ http æ algorithm_detection æ ê ë _index 转æ�¢JSON对象失败: {} ßÜ
|
|||
|
|
文件�:
|
|||
|
|
与 Þ æ ñ ò
|
|||
|
|
æ Þ shell ç–‘ä¼¼Webshell æ 网页å�Žé—¨ æ
|
|||
|
|
æ�¶æ„�请求: æ æ æ exec= cmd= system( 命令执行 æ .php .php: php .jsp jsp .asp .aspx asp .jpg .jpeg image .png .gif .bmp .exe
|
|||
|
|
executable .dll library .bat .cmd batch .sh .py python .js
|
|||
|
|
javascript .html .htm html .css css .xml xml .json json .txt text .pdf pdf .doc .docx document .xls .xlsx spreadsheet .zip .rar .7z .tar .gz archive unknown ¸ ¹ T ÷ Ó java/lang/StringBuilder T00:00:00 3æ— æ³•è§£æž�时间å—符串: {}, 使用当å‰�时间 ÜË ü ò ! " %com/common/util/AlgorithmResultParser# $% "java/time/format/DateTimeFormatter yyyy-MM-dd HH:mm:ss &' yyyy/MM/dd HH:mm:ss yyyy-MM-dd HH:mm:ss.SSS yyyy-MM-dd'T'HH:mm:ss yyyy-MM-dd'T'HH:mm:ss.SSS java/lang/Object java/util/List com/alibaba/fastjson/JSONArray java/lang/String com/alibaba/fastjson/JSONObject java/time/LocalDateTime java/lang/Long java/lang/Integer com/alibaba/fastjson/JSON
|
|||
|
|
parseArray 4(Ljava/lang/String;)Lcom/alibaba/fastjson/JSONArray; size ()I
|
|||
|
|
getJSONObject $(I)Lcom/alibaba/fastjson/JSONObject; add (Ljava/lang/Object;)Z valueOf (I)Ljava/lang/Integer; org/slf4j/Logger info '(Ljava/lang/String;Ljava/lang/Object;)V
|
|||
|
|
getMessage ()Ljava/lang/String; error 9(Ljava/lang/String;Ljava/lang/Object;Ljava/lang/Object;)V java/util/UUID
|
|||
|
|
randomUUID ()Ljava/util/UUID; toString setId (Ljava/lang/String;)V
|
|||
|
|
setSyslogUuid setLogId ()Ljava/time/LocalDateTime; setCreatedAt (Ljava/time/LocalDateTime;)V setEventDate isEmpty ()Z
|
|||
|
|
setLogTime setSrcIp setDestIp setSrcIpStr setDestIpStr
|
|||
|
|
setHttpUrl setHttpHost setHttpReferer (J)Ljava/lang/Long; setHttpStatusCode (Ljava/lang/Long;)V
|
|||
|
|
setHttpMethod setAttackResult (Ljava/lang/Integer;)V setEventCategory setEventType
|
|||
|
|
setEventLevel
|