初次提交代码

2026-01-11 15:33:22 +08:00
commit 6603c6f4a1
455 changed files with 32175 additions and 0 deletions
@@ -0,0 +1,78 @@
+import com.common.entity.*;
+import com.common.util.SyslogParser;
+import java.util.Locale;
+import java.util.Optional;
+
+public class SyslogParserDemo {
+    public static void main(String[] args) {
+        // RFC 5424 测试用例
+        String[] rfc5424Logs = {
+                "<4>2025-09-14T16:27:09+08:00 hcss-ecs-9dc5 HFish[2946163]: {\"title\":\"HFish Threat Alert\",\"client\":\"内置节点\"}",
+                "<34>1 2023-10-27T14:30:15.123Z web-server-01 myapp 1234 ID47 - This is a test message",
+                "<165>1 2023-10-27T15:45:30.000+08:00 firewall01 sshd 5678 - [event source=\"auth\" result=\"failure\"] Failed password for user",
+                "<14>1 2023-10-27T16:20:45.789Z db-server-01 postgres 9012 DB01 [metrics query_time=\"150ms\" rows=100] SELECT completed",
+                "<14>1 2025-09-24T11:52:26Z 5f46d3be75e1 supermario 128 honeypot_event - {\"source\":\"honeypot1\",\"id\":\"f6a13c35-bf9d-4da6-a181-50ce23e7ef6a\",\"start_time\":\"2023-09-03T11:07:02.50167643Z\",\"time\":\"2023-09-03T11:16:18.883885281Z\",\"risk_level\":4,\"connection\":\"b18f3fbe-3fbf-4495-815f-ff26f6fb0bdf\",\"file_info\":null,\"extra\":{\"payload\":{\"format\":\"line\",\"name\":{\"cn\":\"攻击载荷\",\"en\":\"payload\"},\"value\":\"\"},\"uid\":{\"format\":\"line\",\"name\":{\"cn\":\"\",\"en\":\"\"},\"uid\":\"b4cbc73c-25d0-4429-ae1b-a856cdf1a651\",\"value\":\"\"}},\"type\":\"WEB_ATTACK_SCANNER\",\"agent_sn\":\"caa7da42-0cca-4cb1-b501-1f1eb2b588d5\",\"agent_name\":\" 教育局蜜罐探针\",\"honeypot_id\":\"11a9ac6bdf38ae2aaa49ec4f1b4a921bff71952cb9f175bdd8ee1f0497057bc6\",\"honeypot_name\":\"茂名市中小学管理平台管理后台\",\"src_ip\":\"117.50.189.7\",\"src_port\":58512,\"src_mac\":\"\",\"dest_ip\":\"192.168.222.2\",\"dest_port\":9200,\"proxy_ip\":null,\"node\":\"WRx3\"}",
+                "<4>2025-09-14T16:27:09+08:00 hcss-ecs-9dc5 HFish[2946163]: {\"title\":\"HFish Threat Alert\",\"client\":\"内置节点\",\"client_ip\":\"192.168.11.133\",\"attack_type\":\"attack\",\"scan_type\":\"\",\"scan_port\":\"\",\"class\":\"端口监听\",\"type\":\"TCP\",\"name\":\"TCP端口监听\",\"account\":\"\",\"src_ip\":\"36.154.189.226\",\"src_port\":\"29604\",\"dst_ip\":\"192.168.11.133\",\"dst_port\":\"445\",\"geo\":\"中国-江苏\",\"time\":\"2025-09-14 16:27:09\",\"threat_name\":\"\",\"threat_level\":\"other\",\"info\":\"36.154.189.226:29604 already connected.\",\"labels\":\"\",\"labels_cn\":\"\",\"AuthInfo\":null}"
+        };
+
+        // RFC 3164 测试用例
+        String[] rfc3164Logs = {
+                "<15>Oct 9 21:15:55 LAPTOP-ARDUR3N0  alan:  honeypot_event",
+                "<34>Oct 27 14:30:15 web01 sshd[1234]: Failed password for root",
+                "<13>Oct 27 15:45:30 firewall01 %ASA-6-302013: Built outbound TCP connection",
+                "<7>Oct 27 16:20:45 appserver kernel: USB device disconnected"
+        };
+
+
+        System.out.println("=== RFC 5424 格式解析 ===");
+        for (String log : rfc5424Logs) {
+
+            try {
+                SyslogMessage msg = SyslogParser.parse(log);
+                System.out.println("原始日志: " + log);
+                System.out.println("解析结果: " + msg);
+
+                System.out.println("---");
+
+
+            } catch (Exception e) {
+                System.err.println("解析失败: " + log);
+                System.err.println("错误: " + e.getMessage());
+               //Optional msg1=SyslogParser.extractJsonString(log);
+                // System.err.println("内容解析结果: " +   msg1.toString());
+            }
+        }
+
+        System.out.println("\n=== RFC 3164 格式解析 ===");
+        for (String log : rfc3164Logs) {
+            try {
+                SyslogMessage msg = SyslogParser.parse(log);
+                System.out.println("原始日志: " + log);
+                System.out.println("解析结果: " + msg);
+                System.out.println("---");
+            } catch (Exception e) {
+                System.err.println("解析失败: " + log);
+                System.err.println("错误: " + e.getMessage());
+            }
+        }
+
+        // 测试自动检测
+        System.out.println("\n=== 混合格式自动检测 ===");
+        String[] mixedLogs = {
+                "<34>1 2023-10-27T14:30:15.123Z web01 myapp 1234 - - Test RFC5424",
+                "<13>Oct 27 15:45:30 web02 kernel: Test RFC3164"
+        };
+
+        for (String log : mixedLogs) {
+            try {
+                SyslogMessage msg = SyslogParser.parse(log);
+                System.out.println("检测到格式: " + msg.getClass().getSimpleName());
+                System.out.println("解析结果: " + msg);
+                System.out.println("---");
+            } catch (Exception e) {
+                System.err.println("解析失败: " + log);
+                System.err.println("错误: " + e.getMessage());
+            }
+        }
+    }
+}
@@ -0,0 +1,2 @@
+public class syslogMainTest {
+}