109 lines
10 KiB
Plaintext
109 lines
10 KiB
Plaintext
|
Êþº¾ 4'
|
|||
|
|
µ
|
|||
|
|
¬
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
¬ ¬
|
|||
|
|
!
|
|||
|
|
" #$
|
|||
|
|
%
|
|||
|
|
&'
|
|||
|
|
&(
|
|||
|
|
¬)
|
|||
|
|
*
|
|||
|
|
+
|
|||
|
|
¬,
|
|||
|
|
-
|
|||
|
|
./
|
|||
|
|
0
|
|||
|
|
12
|
|||
|
|
34
|
|||
|
|
¬5
|
|||
|
|
67
|
|||
|
|
89
|
|||
|
|
:
|
|||
|
|
;
|
|||
|
|
<=
|
|||
|
|
>?
|
|||
|
|
@A
|
|||
|
|
BC È
|
|||
|
|
DE
|
|||
|
|
¬F
|
|||
|
|
GH
|
|||
|
|
I
|
|||
|
|
J
|
|||
|
|
K
|
|||
|
|
L
|
|||
|
|
MN
|
|||
|
|
OP
|
|||
|
|
Q
|
|||
|
|
RS
|
|||
|
|
TU
|
|||
|
|
VW
|
|||
|
|
XY
|
|||
|
|
Z
|
|||
|
|
¬[\] ^_
|
|||
|
|
3`
|
|||
|
|
3ab
|
|||
|
|
3c
|
|||
|
|
d
|
|||
|
|
¬e
|
|||
|
|
f
|
|||
|
|
3ghi
|
|||
|
|
jk
|
|||
|
|
lm
|
|||
|
|
n
|
|||
|
|
o
|
|||
|
|
pqrst
|
|||
|
|
uvw
|
|||
|
|
3xyz{|}~€�‚ƒ„…†‡ˆ‰Š‹Œ�Ž��‘’“”•–—˜™š›œ�žŸ ¡¢£¤¥¦§¨©ª« ¬¬
|
|||
|
|
.® ®¯
|
|||
|
|
3°
|
|||
|
|
3±²
|
|||
|
|
¡
|
|||
|
|
¡³´
|
|||
|
|
¡(
|
|||
|
|
.µ¶ ·
|
|||
|
|
¸¹
|
|||
|
|
¸º
|
|||
|
|
¸»¼
|
|||
|
|
½¾¿À
|
|||
|
|
®ÁÂÃÄÅÆ log Lorg/slf4j/Logger; DATE_FORMATTERS %[Ljava/time/format/DateTimeFormatter; <init> ()V Code LineNumberTable LocalVariableTable this 'Lcom/common/util/AlgorithmResultParser; buildNewLogsFromExample ()Ljava/util/List; exampleJson Ljava/lang/String; Signature 8()Ljava/util/List<Lcom/common/entity/SyslogNormalData;>; parseJsonToLogs $(Ljava/lang/String;)Ljava/util/List; jsonObj !Lcom/alibaba/fastjson/JSONObject; logData $Lcom/common/entity/SyslogNormalData; i I jsonArray Lcom/alibaba/fastjson/JSONArray; e Ljava/lang/Exception; jsonStr logs Ljava/util/List; LocalVariableTypeTable 6Ljava/util/List<Lcom/common/entity/SyslogNormalData;>;
|
|||
|
|
StackMapTableÇÈ¼É J(Ljava/lang/String;)Ljava/util/List<Lcom/common/entity/SyslogNormalData;>; convertJsonObject G(Lcom/alibaba/fastjson/JSONObject;)Lcom/common/entity/SyslogNormalData; logTime Ljava/time/LocalDateTime; now
|
|||
|
|
accessTime originFieldÊ$Ë extractAdditionalInfo 9(Lcom/common/entity/SyslogNormalData;Ljava/lang/String;)V fileInfo parts [Ljava/lang/String; maliciousRequest í determineFileType &(Ljava/lang/String;)Ljava/lang/String; fileName
|
|||
|
|
parseDateTime -(Ljava/lang/String;)Ljava/time/LocalDateTime; formatter $Ljava/time/format/DateTimeFormatter; datePart timeStr ¹¿ getString G(Lcom/alibaba/fastjson/JSONObject;Ljava/lang/String;)Ljava/lang/String; key Y(Lcom/alibaba/fastjson/JSONObject;Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String; value defaultValue getLong U(Lcom/alibaba/fastjson/JSONObject;Ljava/lang/String;Ljava/lang/Long;)Ljava/lang/Long; Ljava/lang/Long;Ì
|
|||
|
|
getInteger [(Lcom/alibaba/fastjson/JSONObject;Ljava/lang/String;Ljava/lang/Integer;)Ljava/lang/Integer; Ljava/lang/Integer;Í <clinit>
|
|||
|
|
SourceFile AlgorithmResultParser.java RuntimeVisibleAnnotations *Lorg/springframework/stereotype/Component; º » [
|
|||
|
|
{
|
|||
|
|
"_index": "es:skyeye-weblog-2025.09.30",
|
|||
|
|
"access_time": "2025-09-30 12:05:00",
|
|||
|
|
"dip": "10.20.30.51",
|
|||
|
|
"dname": "网页木马��",
|
|||
|
|
"dtype": "疑似木马活动",
|
|||
|
|
"host": "",
|
|||
|
|
"log_id": "hidden-002",
|
|||
|
|
"origin_field": "匹�到文件�: shell.php:.jpg 与 匹�到��请求: exec=dir",
|
|||
|
|
"reason": "�IP 203.0.113.51 访问 目的IP 10.20.30.51 异常，入度=0, 出度=0, 独立访客=1，匹�到文件�: shell.php:.jpg，匹�到��请求: exec=dir",
|
|||
|
|
"referer": "",
|
|||
|
|
"sip": "203.0.113.51",
|
|||
|
|
"status_code": 200,
|
|||
|
|
"url": "/admin/shell.php:.jpg"
|
|||
|
|
}
|
|||
|
|
] Ç È java/util/ArrayListÎ ÏÐÈ ÑÒ ÓÔ ß àÇ ÕÖ ¶ · æˆ�功解æž� {} æ�¡æ—¥å¿—æ•°æ�®Í ×ØÙ ÚÛ java/lang/Exception 解æž�JSON失败: {} ÜÝ Þß "com/common/entity/SyslogNormalData log_idà áâ ãÝ û þ äå æå û ü çåË ãè éê ëê access_timeÉ ìí ó ô îê sip ïå dip ðå ñå òå url óå host ôå referer õå status_codeÌ ×ö ÷ø GET ùå úû üû ýû þû dtype ÿå dname å å reason å origin_field å http å algorithm_detection å é ê _index 转æ�¢JSON对象失败: {} ÞÛ
|
|||
|
|
文件�: 与
|
|||
|
|
Ý å ð ñ å
|
|||
|
|
Ý shell ç–‘ä¼¼Webshell å 网页å�Žé—¨ å
|
|||
|
|
æ�¶æ„�请求: å å å exec= cmd= system( 命令执行 å .php .php: php .jsp jsp .asp .aspx asp .jpg .jpeg image .png .gif .bmp .exe
|
|||
|
|
executable .dll library .bat .cmd batch .sh .py python .js
|
|||
|
|
javascript .html .htm html .css css .xml xml .json json .txt text .pdf pdf .doc .docx document .xls .xlsx spreadsheet .zip .rar .7z .tar .gz archive unknown ¸ ¹ T ö Ò java/lang/StringBuilder T00:00:00 3æ— æ³•è§£æž�时间å—符串: {}, 使用当å‰�时间 ÛÊ û ñ ! %com/common/util/AlgorithmResultParser" #$ "java/time/format/DateTimeFormatter yyyy-MM-dd HH:mm:ss %& yyyy/MM/dd HH:mm:ss yyyy-MM-dd HH:mm:ss.SSS yyyy-MM-dd'T'HH:mm:ss yyyy-MM-dd'T'HH:mm:ss.SSS java/lang/Object java/util/List com/alibaba/fastjson/JSONArray java/lang/String com/alibaba/fastjson/JSONObject java/time/LocalDateTime java/lang/Long java/lang/Integer com/alibaba/fastjson/JSON
|
|||
|
|
parseArray 4(Ljava/lang/String;)Lcom/alibaba/fastjson/JSONArray; size ()I
|
|||
|
|
getJSONObject $(I)Lcom/alibaba/fastjson/JSONObject; add (Ljava/lang/Object;)Z valueOf (I)Ljava/lang/Integer; org/slf4j/Logger info '(Ljava/lang/String;Ljava/lang/Object;)V
|
|||
|
|
getMessage ()Ljava/lang/String; error 9(Ljava/lang/String;Ljava/lang/Object;Ljava/lang/Object;)V java/util/UUID
|
|||
|
|
randomUUID ()Ljava/util/UUID; toString setId (Ljava/lang/String;)V
|
|||
|
|
setSyslogUuid setLogId ()Ljava/time/LocalDateTime; setCreatedAt (Ljava/time/LocalDateTime;)V setEventDate isEmpty ()Z
|
|||
|
|
setLogTime setSrcIp setDestIp setSrcIpStr setDestIpStr
|
|||
|
|
setHttpUrl setHttpHost setHttpReferer (J)Ljava/lang/Long; setHttpStatusCode (Ljava/lang/Long;)V
|
|||
|
|
setHttpMethod setAttackResult (Ljava/lang/Integer;)V setEventCategory setEventType
|
|||
|
|
setEventLevel
|