187 lines
21 KiB
Plaintext
187 lines
21 KiB
Plaintext
|
Êþº¾ 4¤
|
|||
|
|
-¥¦
|
|||
|
|
¥ §¨
|
|||
|
|
© ª
|
|||
|
|
«¬
|
|||
|
|
« ® ¯° ±²
|
|||
|
|
³ ´ µ¶ ·¸ ¹º »¼ »½¾
|
|||
|
|
¿ ·ÀÁ ·Â
|
|||
|
|
ÃÄÅ
|
|||
|
|
Æ ±Ç
|
|||
|
|
È
|
|||
|
|
É
|
|||
|
|
ÊË ±ÌÍ ±Î ·ÏÐ Ñ ÒÓ ¹ÏÔÕÖ ¹Â ±× ·Ø Ùº
|
|||
|
|
ÚÛ
|
|||
|
|
Ü ±ÝÞßà ±á
|
|||
|
|
â
|
|||
|
|
HÏã
|
|||
|
|
ä
|
|||
|
|
åæ
|
|||
|
|
çèé
|
|||
|
|
êë
|
|||
|
|
åìí
|
|||
|
|
îïð
|
|||
|
|
ñò
|
|||
|
|
H¥óô
|
|||
|
|
K¥õ
|
|||
|
|
Jö÷
|
|||
|
|
Køùú
|
|||
|
|
R¥û
|
|||
|
|
Rüý
|
|||
|
|
þÿ
|
|||
|
|
«
|
|||
|
|
R
|
|||
|
|
J
|
|||
|
|
|
|||
|
|
þ
|
|||
|
|
|
|||
|
|
|
|||
|
|
J
|
|||
|
|
J
|
|||
|
|
J
|
|||
|
|
|
|||
|
|
|
|||
|
|
J
|
|||
|
|
J
|
|||
|
|
J
|
|||
|
|
J
|
|||
|
|
J !"
|
|||
|
|
J#$
|
|||
|
|
J%&
|
|||
|
|
J'
|
|||
|
|
J(
|
|||
|
|
J)
|
|||
|
|
J*
|
|||
|
|
J+
|
|||
|
|
J,-./
|
|||
|
|
J01
|
|||
|
|
J23
|
|||
|
|
J45
|
|||
|
|
R6
|
|||
|
|
R78
|
|||
|
|
J9:
|
|||
|
|
J;<=>
|
|||
|
|
J?@
|
|||
|
|
JAB
|
|||
|
|
CD
|
|||
|
|
C
|
|||
|
|
DEFG
|
|||
|
|
�¥
|
|||
|
|
�HI
|
|||
|
|
JJK
|
|||
|
|
JLM
|
|||
|
|
JNO
|
|||
|
|
JP
|
|||
|
|
DQR
|
|||
|
|
JST
|
|||
|
|
DU
|
|||
|
|
CVWXYZ
|
|||
|
|
H[\
|
|||
|
|
³¥ ¸]
|
|||
|
|
³^_`a
|
|||
|
|
³bc
|
|||
|
|
d
|
|||
|
|
Def
|
|||
|
|
Hgh
|
|||
|
|
Ài j kl
|
|||
|
|
mn
|
|||
|
|
Ào kpq
|
|||
|
|
HÂ
|
|||
|
|
Hr
|
|||
|
|
st
|
|||
|
|
uv
|
|||
|
|
uwx
|
|||
|
|
Ky
|
|||
|
|
uz{
|
|||
|
|
u|
|
|||
|
|
}
|
|||
|
|
u~{
|
|||
|
|
u€
|
|||
|
|
�
|
|||
|
|
u‚ƒ
|
|||
|
|
u„…
|
|||
|
|
u†‡
|
|||
|
|
uˆ‰Š‹
|
|||
|
|
uŒ�
|
|||
|
|
uŽ�
|
|||
|
|
u�
|
|||
|
|
u‘
|
|||
|
|
u’
|
|||
|
|
u“
|
|||
|
|
u”•
|
|||
|
|
u–
|
|||
|
|
u—
|
|||
|
|
u˜
|
|||
|
|
™š
|
|||
|
|
u›
|
|||
|
|
uœ
|
|||
|
|
u�
|
|||
|
|
už
|
|||
|
|
uŸ
|
|||
|
|
u¡¢
|
|||
|
|
u£
|
|||
|
|
u¤
|
|||
|
|
¥ ¦ §¨©ª«¬
|
|||
|
|
ÿ
|
|||
|
|
DÏ
|
|||
|
|
«®¯
|
|||
|
|
«°
|
|||
|
|
«±² ±³´
|
|||
|
|
Kµ
|
|||
|
|
K϶
|
|||
|
|
sö
|
|||
|
|
s· ±¸¹
|
|||
|
|
Kº
|
|||
|
|
s»
|
|||
|
|
s¼
|
|||
|
|
s½
|
|||
|
|
s¾¿ À ÁÂà ±Ä ¹ÅÆ
|
|||
|
|
Ç
|
|||
|
|
ÈÉ
|
|||
|
|
ÊË log Lorg/slf4j/Logger; deviceDeviceService (Lcom/common/service/DeviceDeviceService; RuntimeVisibleAnnotations 8Lorg/springframework/beans/factory/annotation/Autowired; algorithmResultParser 'Lcom/common/util/AlgorithmResultParser; restTemplate -Lorg/springframework/web/client/RestTemplate; syslogNormalDataMapper *Lcom/common/mapper/SyslogNormalDataMapper; secExceptionAlgorithmMapper /Lcom/common/mapper/SecExceptionAlgorithmMapper; alarmVisitMapper $Lcom/common/mapper/AlarmVisitMapper; lastProcessTime Ljava/time/LocalDateTime; DATE_TIME_FORMATTER $Ljava/time/format/DateTimeFormatter; algorithmCache Ljava/util/Map; Signature JLjava/util/Map<Ljava/lang/Long;Lcom/common/entity/SecExceptionAlgorithm;>;
|
|||
|
|
processing +Ljava/util/concurrent/atomic/AtomicBoolean; <init> ()V Code LineNumberTable LocalVariableTable this *Lcom/common/service/AccessLogAlertService; init Ljavax/annotation/PostConstruct; loadAlgorithmConfigs algorithm )Lcom/common/entity/SecExceptionAlgorithm; enabledAlgorithms Ljava/util/List; e Ljava/lang/Exception; LocalVariableTypeTable ;Ljava/util/List<Lcom/common/entity/SecExceptionAlgorithm;>;
|
|||
|
|
StackMapTableÌÍÉÄ safeProcessTaskÎ 5Lorg/springframework/scheduling/annotation/Scheduled; cron
|
|||
|
|
0 */1 * * * ? processAccessLogAlert currentTime newLogs 6Ljava/util/List<Lcom/common/entity/SyslogNormalData;>;Ͼ 1Lorg/springframework/scheduling/annotation/Async; processAlgorithm <(Lcom/common/entity/SecExceptionAlgorithm;Ljava/util/List;)V logs requestBody Lcom/alibaba/fastjson/JSONArray; response )Lorg/springframework/http/ResponseEntity; results =Lorg/springframework/http/ResponseEntity<Ljava/lang/String;>;òÐÑíÖ b(Lcom/common/entity/SecExceptionAlgorithm;Ljava/util/List<Lcom/common/entity/SyslogNormalData;>;)V buildRequestBody 2(Ljava/util/List;)Lcom/alibaba/fastjson/JSONArray; logObject !Lcom/alibaba/fastjson/JSONObject; geoDip geoSip logData $Lcom/common/entity/SyslogNormalData; requestArrayóô X(Ljava/util/List<Lcom/common/entity/SyslogNormalData;>;)Lcom/alibaba/fastjson/JSONArray; callAlgorithmApi t(Lcom/common/entity/SecExceptionAlgorithm;Lcom/alibaba/fastjson/JSONArray;)Lorg/springframework/http/ResponseEntity; url Ljava/lang/String;
|
|||
|
|
requestEntity %Lorg/springframework/http/HttpEntity; headers &Lorg/springframework/http/HttpHeaders; 9Lorg/springframework/http/HttpEntity<Ljava/lang/String;>;\ ˆ(Lcom/common/entity/SecExceptionAlgorithm;Lcom/alibaba/fastjson/JSONArray;)Lorg/springframework/http/ResponseEntity<Ljava/lang/String;>; processApiResponse N(Lcom/common/entity/SecExceptionAlgorithm;Ljava/lang/String;Ljava/util/List;)V alarmResult
|
|||
|
|
alarmVisit Lcom/common/entity/AlarmVisit; i I
|
|||
|
|
alarmCount responseBody t(Lcom/common/entity/SecExceptionAlgorithm;Ljava/lang/String;Ljava/util/List<Lcom/common/entity/SyslogNormalData;>;)V :Lorg/springframework/transaction/annotation/Transactional;
|
|||
|
|
parseDateTime -(Ljava/lang/String;)Ljava/time/LocalDateTime;
|
|||
|
|
localDateTime timeStr AddOriginLogField T(Ljava/lang/String;Lcom/common/entity/AlarmVisit;Lcom/alibaba/fastjson/JSONObject;)Z originLogObject deviceIp
|
|||
|
|
AlgorithmNameÒ getDeviceID (Ljava/lang/String;)I source_ip deviceId
|
|||
|
|
deviceList 2Ljava/util/List<Lcom/common/entity/DeviceDevice;>; <clinit>
|
|||
|
|
SourceFile AccessLogAlertService.java (Lorg/springframework/stereotype/Service; <Lorg/springframework/scheduling/annotation/EnableScheduling; 7Lorg/springframework/scheduling/annotation/EnableAsync; ;< &java/util/concurrent/ConcurrentHashMap 56 )java/util/concurrent/atomic/AtomicBoolean ;Ó 9:Ï ÔÕ Ö× 12 !" 7åˆ�始化AccessLogAlertService，上次处ç�†æ—¶é—´: {}Ñ ØÙ D< -.Ú ÛÜÝ Þ<Ì ßàÍ áâ ãä 'com/common/entity/SecExceptionAlgorithm åæ çè %åŠ è½½äº† {} 个å�¯ç”¨çš„算法é…�ç½® éê ëì java/lang/Exception åŠ è½½ç®—æ³•é…�置失败: {} íî ïð ñò W< óÓ 3上一个任务ä»�在执行ä¸ï¼Œè·³è¿‡æœ¬æ¬¡æ‰§è¡Œ ôõ *开始执行访问日志告è¦å¤„ç�†ä»»åŠ¡ Øõ öâ 0没有å�¯ç”¨çš„算法é…�置，跳过本次处ç�† +,÷ øù 7没有å�‘现新的日志数æ�®ï¼Œä¸Šæ¬¡å¤„ç�†æ—¶é—´: {} <获å�–到 {} æ�¡æ–°çš„日志数æ�®ï¼Œæ—¶é—´èŒƒå›´: {} 到 {} java/lang/Object Øú ûüý ^_ =处ç�†ç®—法é…�置失败 [算法ID: {}, 算法å��称: {}]: {} þî ïú C访问日志告è¦å¤„ç�†ä»»åŠ¡å®Œæˆ�，下次将从 {} 开始处ç�† (访问日志告è¦å¤„ç�†ä»»åŠ¡å¼‚常: {} 开始处ç�†ç®—法: {} (ID: {}) Øð mn +算法 {} æ— æœ‰æ•ˆçš„è¯·æ±‚å�‚数，跳过 yzÐ ÿ â 调用算法API失败: {} - {} î æ— å“�应 ä java/lang/String 算法 {} æœªæ£€æµ‹åˆ°å‘Šè¦ „… com/alibaba/fastjson/JSONArray "com/common/entity/SyslogNormalData com/alibaba/fastjson/JSONObject _id åî ç _index java/lang/StringBuilder es1:skyeye-file-
|
|||
|
|
|
|||
|
|
yyyy.MM.dd
|
|||
|
|
î _source.@timestamp Õ 4 _source.@version 6 _source.access_time 34 _source.device_ip î _source.dip î
|
|||
|
|
_source.dport æ ë _source.dst_mac î _source.file_dir !î _source.file_md5 "î _source.filename #î city_name $î continent_code
|
|||
|
|
country_code2 country_name %î latitude &î longitude 'î (î )î *î +î ,î _source.geo_dip _source.geo_sip _source.host -î _source.host_md5 .î _source.host_raw /î _source.host_reraw ;õ 01 _source.method 2î _source.mime_type 3î _source.priv_info {"product_type": "sensor"}
|
|||
|
|
_source.proto 4î _source.referer 5î _source.serial_num6 78 9: _source.sess_key java/util/Random ;ê _source.sip <î
|
|||
|
|
_source.sport =æ _source.src_mac >î _source.status ?æ ë@ _source.uri Aî _source.uri_md5 BC DE _source.vendor_id _source.vlan_id _type skyeye-file FG $org/springframework/http/HttpHeaders HI JK Accept "org/springframework/http/MediaType application/json óL GET Mî NO ?data= Pî #org/springframework/http/HttpEntity ;Q )*R cST UV ;W XS #调用算法API异常 [URL: {}]: {} YZÒ [^_ `a bc dname de fa 未知 ga hî ia jk access_time �� lc sip mk dip nk status_code oa reason - origin_field pa log_id qk Pythonç®—å� ra st uv wt xt other ya zc {t| ë} ~ € � ‚t ƒt ç ”åˆ¤å�Žå¤„ç½® „a host …a †‡ “” /0ˆ ‰Š #算法 {} 生æˆ� {} æ�¡å‘Šè¦è®°å½• 处ç�†APIå“�应异常: {} java/lang/RuntimeException 处ç�†APIå“�应失败 ;‹ Œ� yyyy-MM-dd HH:mm:ss.SSS ŒŽ Ô� *时间解æž�失败: {}, 使用当å‰�时间 ôÙ
|
|||
|
|
origin_log Y� =算法：{},ID:{} ,AlarmNme:{} 没有返回 origin_log节点. ‘î ’ú java/lang/Integer “” •– —– ˜õ ™õ <算法：{} 补充原始记录日志å—段异常。error:{} #$š ›œ L设备请求的Host IP注册超过一æ�¡è®°å½•ï¼Œè¯·è�”系管ç�†å‘˜å¤„ç�†ï¼� ïõ �ž com/common/entity/DeviceDevice åŸ ê (com/common/service/AccessLogAlertService¡ ¢£ java/util/List java/util/Iterator java/lang/Throwable java/time/LocalDateTime 'org/springframework/http/ResponseEntity org/slf4j/Logger com/common/entity/AlarmVisit (Z)V now ()Ljava/time/LocalDateTime; minusMinutes (J)Ljava/time/LocalDateTime; info '(Ljava/lang/String;Ljava/lang/Object;)V -com/common/mapper/SecExceptionAlgorithmMapper findEnabledAlgorithms ()Ljava/util/List;
|
|||
|
|
java/util/Map clear iterator ()Ljava/util/Iterator; hasNext ()Z next ()Ljava/lang/Object; getId ()Ljava/lang/Long; put 8(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object; size ()I valueOf (I)Ljava/lang/Integer;
|
|||
|
|
getMessage ()Ljava/lang/String; error 9(Ljava/lang/String;Ljava/lang/Object;Ljava/lang/Object;)V
|
|||
|
|
compareAndSet (ZZ)Z set warn (Ljava/lang/String;)V isEmpty (com/common/mapper/SyslogNormalDataMapper findRequiredFieldsAfterTime +(Ljava/time/LocalDateTime;)Ljava/util/List; ((Ljava/lang/String;[Ljava/lang/Object;)V values ()Ljava/util/Collection; java/util/Collection getAlgorithmName
|
|||
|
|
getStatusCode '()Lorg/springframework/http/HttpStatus; #org/springframework/http/HttpStatus is2xxSuccessful getApiUrl getBody com/alibaba/fastjson/JSON
|
|||
|
|
parseArray 4(Ljava/lang/String;)Lcom/alibaba/fastjson/JSONArray; 8(Ljava/lang/String;Ljava/lang/Object;)Ljava/lang/Object; append -(Ljava/lang/String;)Ljava/lang/StringBuilder; "java/time/format/DateTimeFormatter ofPattern 8(Ljava/lang/String;)Ljava/time/format/DateTimeFormatter; format 8(Ljava/time/format/DateTimeFormatter;)Ljava/lang/String; toString
|
|||
|
|
getLogTime java/time/ZoneId
|
|||
|
|
systemDefault ()Ljava/time/ZoneId; java/time/ZonedDateTime of F(Ljava/time/LocalDateTime;Ljava/time/ZoneId;)Ljava/time/ZonedDateTime; ISO_OFFSET_DATE_TIME getDeviceIp getDestIp getDestPort java/lang/Long longValue ()J (J)Ljava/lang/Long;
|
|||
|
|
getDestMac getHostFilePath
|
|||
|
|
getFileMd5 getFileName getDestCity getDestCountry
|
|||
|
|
getDestLat
|
|||
|
|
getDestLon
|
|||
|
|
getSrcCity getSrcCountryCode
|
|||
|
|
getSrcCountry getSrcLat getSrcLon getHttpHost getHostFileMd5 getHttpReqHeaderRaw reverse ()Ljava/lang/StringBuilder;
|
|||
|
|
getHttpMethod getHttpRespContentType getProto getHttpReferer java/util/UUID
|
|||
|
|
randomUUID ()Ljava/util/UUID; substring (II)Ljava/lang/String; nextInt getSrcIp
|
|||
|
|
getSrcPort getSrcMac getHttpStatusCode &(Ljava/lang/Object;)Ljava/lang/String;
|
|||
|
|
getHttpUrl getBytes ()[B nameUUIDFromBytes ([B)Ljava/util/UUID; add (Ljava/lang/Object;)Z APPLICATION_JSON $Lorg/springframework/http/MediaType; setContentType '(Lorg/springframework/http/MediaType;)V '(Ljava/lang/String;Ljava/lang/String;)V getApiMethod equalsIgnoreCase (Ljava/lang/String;)Z toJSONString +(Lorg/springframework/util/MultiValueMap;)V #org/springframework/http/HttpMethod %Lorg/springframework/http/HttpMethod; +org/springframework/web/client/RestTemplate exchange «(Ljava/lang/String;Lorg/springframework/http/HttpMethod;Lorg/springframework/http/HttpEntity;Ljava/lang/Class;[Ljava/lang/Object;)Lorg/springframework/http/ResponseEntity; =(Ljava/lang/Object;Lorg/springframework/util/MultiValueMap;)V POST
|
|||
|
|
getJSONObject $(I)Lcom/alibaba/fastjson/JSONObject; builder AlarmVisitBuilder InnerClasses 2()Lcom/common/entity/AlarmVisit$AlarmVisitBuilder; .com/common/entity/AlarmVisit$AlarmVisitBuilder id D(Ljava/lang/String;)Lcom/common/entity/AlarmVisit$AlarmVisitBuilder; createdAt K(Ljava/time/LocalDateTime;)Lcom/common/entity/AlarmVisit$AlarmVisitBuilder; getString &(Ljava/lang/String;)Ljava/lang/String; alarmName
|
|||
|
|
alarmLevel getExceptionType alarmType victimWebUrl E([Ljava/lang/String;)Lcom/common/entity/AlarmVisit$AlarmVisitBuilder;
|
|||
|
|
logStartAt attackIp victimIp
|
|||
|
|
httpStatus comment originLogIds
|
|||
|
|
engineType logCount E(Ljava/lang/Integer;)Lcom/common/entity/AlarmVisit$AlarmVisitBuilder; alarmSource 3(I)Lcom/common/entity/AlarmVisit$AlarmVisitBuilder; attackResult fall attackDirection etlTime
|
|||
|
|
isAssetHit java/lang/Boolean (Z)Ljava/lang/Boolean; focused E(Ljava/lang/Boolean;)Lcom/common/entity/AlarmVisit$AlarmVisitBuilder; baseFocused isUpdated judgedState
|
|||
|
|
disposedState dispositionAdvice dnsInfo build ()Lcom/common/entity/AlarmVisit; "com/common/mapper/AlarmVisitMapper insert !(Lcom/common/entity/AlarmVisit;)V *(Ljava/lang/String;Ljava/lang/Throwable;)V parse 3(Ljava/lang/CharSequence;)Ljava/time/LocalDateTime; W(Ljava/lang/CharSequence;Ljava/time/format/DateTimeFormatter;)Ljava/time/LocalDateTime; -(Ljava/time/ZoneId;)Ljava/time/LocalDateTime; 5(Ljava/lang/String;)Lcom/alibaba/fastjson/JSONObject; getAlarmName debug
|
|||
|
|
getInteger '(Ljava/lang/String;)Ljava/lang/Integer;
|
|||
|
|
setAttackPort ([Ljava/lang/Integer;)V
|
|||
|
|
setVictimPort setAttackMethod
|