关联分析规则-数据降噪

haobang-security-xdr/syslog-consumer/src/main/java/com/common/service/AccessLogAlertService.java

@@ -6,6 +6,7 @@ import com.alibaba.fastjson.JSON;
 import com.alibaba.fastjson.JSONArray;
 import com.alibaba.fastjson.JSONObject;
 import com.common.entity.AlarmVisit;
+import com.common.entity.DeviceDevice;
 import com.common.entity.SecExceptionAlgorithm;
 import com.common.entity.SyslogNormalData;
 import lombok.extern.slf4j.Slf4j;
@@ -36,6 +37,10 @@ import com.common.util.AlgorithmResultParser;
 @EnableScheduling
 @EnableAsync
 public class AccessLogAlertService {
+
+    @Autowired
+    public static DeviceDeviceService  deviceDeviceService  ;
+
     @Autowired
     private AlgorithmResultParser algorithmResultParser;
     @Autowired
@@ -63,7 +68,7 @@ public class AccessLogAlertService {
     @PostConstruct
     public void init() {
         // 初始化时设置为当前时间减2分钟
-        lastProcessTime = LocalDateTime.now().minusMinutes(2);
+        lastProcessTime = LocalDateTime.now().minusMinutes(1);
         log.info("初始化AccessLogAlertService，上次处理时间: {}", lastProcessTime);
 
         // 加载启用的算法配置到缓存
@@ -93,7 +98,7 @@ public class AccessLogAlertService {
     /**
      * 安全的定时任务入口
      */
-    @Scheduled(cron = "0 */2 * * * ?")
+    @Scheduled(cron = "0 */1 * * * ?")
     public void safeProcessTask() {
         if (processing.compareAndSet(false, true)) {
             try {
@@ -108,7 +113,7 @@ public class AccessLogAlertService {
     /**
      * 定时任务入口 - 每2分钟执行一次
      */
-    @Scheduled(cron = "0 */2 * * * ?")
+    @Scheduled(cron = "0 */1 * * * ?")
     @Async
     public void processAccessLogAlert() {
         log.info("开始执行访问日志告警处理任务");
@@ -351,8 +356,11 @@ public class AccessLogAlertService {
                         .judgedState(0)
                         .disposedState(0)
                         .dispositionAdvice("研判后处置")
+                        .dnsInfo(alarmResult.getString("host"))
                         .build();
 
+                //补充返回结果的原始日志字段
+                AddOriginLogField(algorithm.getAlgorithmName(),alarmVisit,alarmResult);
                 // 保存告警记录
                 alarmVisitMapper.insert(alarmVisit);
                 alarmCount++;
@@ -366,6 +374,8 @@ public class AccessLogAlertService {
         }
     }
 
+
+
     /**
      * 解析时间字符串
      */
@@ -374,7 +384,6 @@ public class AccessLogAlertService {
             if (timeStr == null || timeStr.isEmpty()) {
                 return LocalDateTime.now();
             }
-
             // 尝试多种时间格式
             try {
                 return LocalDateTime.parse(timeStr);
@@ -392,6 +401,54 @@ public class AccessLogAlertService {
     }
 
 
+    /**
+     *  补充返回结果的原始日志字段
+     * @param  AlgorithmName
+     * @param alarmVisit
+     * @param alarmResult
+     * @return
+     */
+    private boolean AddOriginLogField(String AlgorithmName, AlarmVisit alarmVisit ,JSONObject alarmResult )
+    {
+        try {
+        JSONObject originLogObject= alarmResult.getJSONObject("origin_log");
+        if(originLogObject.isEmpty()) {
+            log.debug("算法：{},ID:{} ,AlarmNme:{} 没有返回 origin_log节点.",AlgorithmName, alarmVisit.getId(), alarmVisit.getAlarmName());
+            return false;
+        }
+            alarmVisit.setAttackPort( new Integer[]{alarmResult.getInteger("_source.sport")}  );
+            alarmVisit.setVictimPort( new Integer[]{alarmResult.getInteger("_source.dport")}  );
+            alarmVisit.setAttackMethod(alarmResult.getString("_source.method") );
+            String deviceIp= alarmResult.getString("_source.device_ip");
+            //alarmVisit.setDeviceId(  new Integer[]{ getDeviceID(deviceIp)}  );
+            alarmVisit.setHttpStatus( alarmResult.getString("_source.status"));
+        return true;
+        } catch (Exception e) {
+            log.error("算法：{} 补充原始记录日志字段异常。error:{} ",AlgorithmName,e.getMessage(), e );
+            return false;
+        }
+    }
+
+    public  int getDeviceID(String source_ip)
+    {
+        //默认deviceId =-1
+        int  deviceId=-1 ;
+        List<DeviceDevice>  deviceList=  deviceDeviceService.getByIpSafely(source_ip);
+        if(deviceList.isEmpty()) {
+            return deviceId;
+        }
+        if(deviceList.size()>1)
+        {
+            log.error("设备请求的Host IP注册超过一条记录，请联系管理员处理！");
+            return deviceId;
+        }
+        return   deviceList.get(0).getId();
+    }
+
+
+
+
+
 
 
 }