|
|
|
package com.monitor.other.maliciousip.service.impl;
|
|
|
|
|
|
|
|
import com.alibaba.fastjson.JSON;
|
|
|
|
import com.alibaba.fastjson.JSONArray;
|
|
|
|
import com.alibaba.fastjson.JSONObject;
|
|
|
|
import com.contants.AlarmGroupContants;
|
|
|
|
import com.model.MalIpRule;
|
|
|
|
import com.model.MaliciousIpsRecord;
|
|
|
|
import com.model.MaliciousIpsRecordBanned;
|
|
|
|
import com.model.MaliciousIpsRecordForbid;
|
|
|
|
import com.monitor.common.service.AlarmMsgService;
|
|
|
|
import com.monitor.model.domain.PageBean;
|
|
|
|
import com.monitor.model.page.PageRequest;
|
|
|
|
import com.monitor.model.page.PageResponse;
|
|
|
|
import com.monitor.model.request.MaliciousIpRecordReq;
|
|
|
|
import com.monitor.model.response.BaseResponse;
|
|
|
|
import com.monitor.mysql.mapper.MalIpRuleMapper;
|
|
|
|
import com.monitor.mysql.mapper.MaliciousIpsRecordBannedMapper;
|
|
|
|
import com.monitor.mysql.mapper.MaliciousIpsRecordForbidMapper;
|
|
|
|
import com.monitor.mysql.mapper.MaliciousIpsRecordMapper;
|
|
|
|
import com.monitor.other.maliciousip.contants.MaliciousIpModel;
|
|
|
|
import com.monitor.other.maliciousip.model.MaliciousDetailIp;
|
|
|
|
import com.monitor.other.maliciousip.model.MaliciousIp;
|
|
|
|
import com.monitor.other.maliciousip.service.MaliciousIpService;
|
|
|
|
import com.monitor.other.maliciousip.util.HbasePool;
|
|
|
|
import com.monitor.other.maliciousip.util.HbasePoolAws;
|
|
|
|
import com.monitor.other.maliciousip.util.RedisDataByApiUtil;
|
|
|
|
import com.util.GetUsersInfoUtil;
|
|
|
|
import org.apache.commons.collections.CollectionUtils;
|
|
|
|
import org.apache.commons.lang.math.NumberUtils;
|
|
|
|
import org.apache.commons.lang3.StringUtils;
|
|
|
|
import org.apache.hadoop.hbase.TableName;
|
|
|
|
import org.apache.hadoop.hbase.client.*;
|
|
|
|
import org.apache.hadoop.hbase.util.Bytes;
|
|
|
|
import org.slf4j.Logger;
|
|
|
|
import org.slf4j.LoggerFactory;
|
|
|
|
import org.springframework.beans.factory.annotation.Autowired;
|
|
|
|
import org.springframework.beans.factory.annotation.Value;
|
|
|
|
import org.springframework.stereotype.Service;
|
|
|
|
|
|
|
|
import java.util.*;
|
|
|
|
import java.util.stream.Collectors;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* 恶意ip
|
|
|
|
* @author hui.xu
|
|
|
|
*
|
|
|
|
*/
|
|
|
|
@Service
|
|
|
|
public class MaliciousIpServiceImpl implements MaliciousIpService {
|
|
|
|
/**
|
|
|
|
* 日志接口
|
|
|
|
*/
|
|
|
|
private Logger logger = LoggerFactory.getLogger(getClass());
|
|
|
|
|
|
|
|
@Autowired
|
|
|
|
private RedisDataByApiUtil redisDataByApiUtil;
|
|
|
|
|
|
|
|
@Autowired
|
|
|
|
private MalIpRuleMapper malIpRuleMapper;
|
|
|
|
|
|
|
|
@Autowired
|
|
|
|
private MaliciousIpsRecordMapper maliciousIpsRecordMapper;
|
|
|
|
|
|
|
|
@Autowired
|
|
|
|
private MaliciousIpsRecordForbidMapper maliciousIpsRecordForbidMapper;
|
|
|
|
|
|
|
|
@Autowired
|
|
|
|
private MaliciousIpsRecordBannedMapper maliciousIpsRecordBannedMapper;
|
|
|
|
|
|
|
|
@Value("${system.envi.cloud.name}")
|
|
|
|
private String cloudName;
|
|
|
|
|
|
|
|
@Autowired
|
|
|
|
public AlarmMsgService alarmMsgService;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* 根据报警组名称取成员的手机号码
|
|
|
|
*/
|
|
|
|
@Autowired
|
|
|
|
private GetUsersInfoUtil getUsersInfoUtil;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Redis String 类型
|
|
|
|
*/
|
|
|
|
//private static final String MALICIOUS_IP_SET = "yh:mip:mipset";
|
|
|
|
//private static final String MALICIOUS_IP_SET = "yhmipset";
|
|
|
|
|
|
|
|
/**
|
|
|
|
* 黑名单失效时间7*24小时
|
|
|
|
*/
|
|
|
|
//private static final int MALICIOUS_IP_EXPIRE = 7*24 * 60 * 60;
|
|
|
|
|
|
|
|
/**
|
|
|
|
*捕获的恶意ipsObj写入运维系统的redis
|
|
|
|
* ipsObj:json格式数据，包括 ip reason duration
|
|
|
|
*/
|
|
|
|
@Override
|
|
|
|
public void writeMipsObjToOpsReids(String ipsObjs){
|
|
|
|
logger.info("begin writeMipsObjToOpsReids :"+ipsObjs);
|
|
|
|
if(StringUtils.isBlank(ipsObjs)){
|
|
|
|
return ;
|
|
|
|
}
|
|
|
|
JSONObject joWithData=JSON.parseObject(ipsObjs);
|
|
|
|
String type=joWithData.getString("type");
|
|
|
|
JSONArray ipsObjArray=joWithData.getJSONArray("data");
|
|
|
|
if(ipsObjArray==null){
|
|
|
|
return ;
|
|
|
|
}
|
|
|
|
if("alarm".equalsIgnoreCase(type)){
|
|
|
|
writeAlarmMipsInfoToOpsDb(ipsObjArray);
|
|
|
|
}else{
|
|
|
|
//发送拦截短信
|
|
|
|
String mobile_yunwei = getUsersInfoUtil.getMobileByAlarmGroup(AlarmGroupContants.GROUP_NAME_MALICIOUS_IP);
|
|
|
|
|
|
|
|
for(int i=0;i<ipsObjArray.size();i++){
|
|
|
|
JSONObject jo= ipsObjArray.getJSONObject(i);
|
|
|
|
String ip=jo.getString("ip");
|
|
|
|
String reason=jo.getString("reason");
|
|
|
|
String duration=jo.get("duration")==null?"":""+jo.get("duration");
|
|
|
|
String hbaseTime=String.valueOf(jo.getLongValue("timestamp"));
|
|
|
|
if(StringUtils.isNotBlank(ip)){
|
|
|
|
try{
|
|
|
|
MaliciousIpsRecordBanned record=new MaliciousIpsRecordBanned();
|
|
|
|
record.setIp(ip);
|
|
|
|
record.setReason(reason);
|
|
|
|
record.setHbaseTime(hbaseTime);
|
|
|
|
record.setDur(duration);
|
|
|
|
record.setForbidStatus("1");
|
|
|
|
record.setHbaseSource(cloudName);
|
|
|
|
maliciousIpsRecordBannedMapper.insert(record);
|
|
|
|
|
|
|
|
logger.info("MaliciousIpServiceImpl writeBannedMipsOpsDB - "+ip);
|
|
|
|
}catch (Exception e){
|
|
|
|
logger.error("MaliciousIpServiceImpl writeBannedMipsOpsDB failed", e);
|
|
|
|
}
|
|
|
|
|
|
|
|
String smsStr = "成功捕获恶意ip--->" + ip + ",接口列表[";
|
|
|
|
JSONObject json = JSONObject.parseObject(reason);
|
|
|
|
if (json != null && !json.isEmpty()) {
|
|
|
|
JSONObject methodDetail = json.getJSONObject("methodDetail");
|
|
|
|
if (methodDetail != null && !methodDetail.isEmpty()) {
|
|
|
|
for (Map.Entry<String, Object> entry : methodDetail.entrySet()) {
|
|
|
|
smsStr += entry.getKey() + ":" + entry.getValue() + "次,";
|
|
|
|
}
|
|
|
|
smsStr = smsStr.substring(0, smsStr.length() - 1);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
smsStr += "]";
|
|
|
|
|
|
|
|
alarmMsgService.sendSms("MaliciousIp", smsStr, mobile_yunwei);
|
|
|
|
logger.info("MaliciousIpServiceImpl writeBannedMipsOpsDB - "+ip);
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
public static void main(String[] args) {
|
|
|
|
String reason="{\"deviceTypeCount\":1,\"difMethodCount\":6,\"impApiPrecent\":100,\"impCount\":221,\"ip\":\"39.107.73.223\",\"ipPrecent\":0,\"loginApiCount\":61,\"methodDetail\":{\"smart.forward.go\":61,\"app.Seckill.payment\":20,\"user.instalment.activate\":19,\"app.Shopping.payment\":41,\"app.Shopping.easySubmit\":20,\"app.shopping.depositPayment\":60},\"notExistUdidPercent\":0,\"notExsitUdidCount\":0,\"qps\":221,\"timestamp\":1519969986974,\"udidCount\":1,\"uidCount\":1,\"whiteIpFlag\":false}";
|
|
|
|
String smsStr = "成功捕获恶意ip--->" + "12.2.2.2" + ",接口列表[";
|
|
|
|
JSONObject json = JSONObject.parseObject(reason);
|
|
|
|
if (json != null && !json.isEmpty()) {
|
|
|
|
JSONObject methodDetail = json.getJSONObject("methodDetail");
|
|
|
|
if (methodDetail != null && !methodDetail.isEmpty()) {
|
|
|
|
for (Map.Entry<String, Object> entry : methodDetail.entrySet()) {
|
|
|
|
smsStr += entry.getKey() + ":" + entry.getValue() + ",";
|
|
|
|
}
|
|
|
|
smsStr = smsStr.substring(0, smsStr.length() - 1);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
smsStr += "]";
|
|
|
|
System.out.println(smsStr);
|
|
|
|
}
|
|
|
|
|
|
|
|
private void writeAlarmMipsInfoToOpsDb(JSONArray ipsObjArray){
|
|
|
|
logger.info("begin writeAlarmMipsInfoToOpsDb :"+ipsObjArray);
|
|
|
|
for(int i=0;i<ipsObjArray.size();i++){
|
|
|
|
JSONObject jo= ipsObjArray.getJSONObject(i);
|
|
|
|
String ip=jo.getString("ip");
|
|
|
|
String reason=jo.getString("reason");
|
|
|
|
String hbaseTime=String.valueOf(jo.getLongValue("timestamp"));
|
|
|
|
String duration=jo.get("duration")==null?"":""+jo.get("duration");
|
|
|
|
if(StringUtils.isNotBlank(ip)){
|
|
|
|
|
|
|
|
MaliciousIpsRecordForbid record=new MaliciousIpsRecordForbid();
|
|
|
|
record.setIp(ip);
|
|
|
|
record.setReason(reason);
|
|
|
|
record.setHbaseTime(hbaseTime);
|
|
|
|
record.setDur(duration);
|
|
|
|
record.setHbaseSource(cloudName);
|
|
|
|
maliciousIpsRecordForbidMapper.insert(record);
|
|
|
|
|
|
|
|
logger.info("MaliciousIpServiceImpl writeMipsObjToOpsReids - "+ip);
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
public void writeMipsInfoToOpsDb(String ipsObjs){
|
|
|
|
//logger.info("begin writeMipsInfoToOpsDb :"+ipsObjs);
|
|
|
|
if(StringUtils.isNotBlank(ipsObjs)){
|
|
|
|
JSONArray ipsObjArray=JSON.parseArray(ipsObjs);
|
|
|
|
Calendar cal = Calendar.getInstance();
|
|
|
|
Date currDate=cal.getTime();
|
|
|
|
for(int i=0;i<ipsObjArray.size();i++){
|
|
|
|
JSONObject jo= ipsObjArray.getJSONObject(i);
|
|
|
|
String ip=jo.getString("ip");
|
|
|
|
String reason=jo.toJSONString();
|
|
|
|
|
|
|
|
//写入mysql
|
|
|
|
MaliciousIpsRecord record=new MaliciousIpsRecord();
|
|
|
|
record.setIp(ip);
|
|
|
|
record.setReason(reason);
|
|
|
|
record.setCreateTime(currDate);
|
|
|
|
record.setHbaseTime(""+cal.getTimeInMillis());
|
|
|
|
record.setHbaseSource(cloudName);
|
|
|
|
maliciousIpsRecordMapper.insert(record);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
public void updateForbidStatus(int id ,String status){
|
|
|
|
MaliciousIpsRecordForbid recordForbid=new MaliciousIpsRecordForbid();
|
|
|
|
recordForbid.setId(id);
|
|
|
|
recordForbid.setForbidStatus(status);
|
|
|
|
maliciousIpsRecordForbidMapper.updateForbidStatusByPrimaryKey(recordForbid);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
public BaseResponse getMipsInfoToOpsDb(MaliciousIpRecordReq request){
|
|
|
|
PageBean page = PageBean.initPageInfo(request.getCurrentPage(), request.getPageSize(), request);
|
|
|
|
// 先查询符合条件的总数量
|
|
|
|
int total = maliciousIpsRecordMapper.selectCount(page);
|
|
|
|
// 数量为0 直接返回
|
|
|
|
if (total == 0) {
|
|
|
|
return new BaseResponse<>();
|
|
|
|
}
|
|
|
|
// 获取列表
|
|
|
|
List<MaliciousIpsRecord> ls = maliciousIpsRecordMapper.selectByPage(page);
|
|
|
|
if (org.springframework.util.CollectionUtils.isEmpty(ls)) {
|
|
|
|
return new BaseResponse<>();
|
|
|
|
}
|
|
|
|
//解析reason到汉字
|
|
|
|
for(MaliciousIpsRecord record:ls){
|
|
|
|
String reason=record.getReason();
|
|
|
|
if(StringUtils.isNotBlank(reason)){
|
|
|
|
try{
|
|
|
|
MaliciousIpModel model=JSON.parseObject(reason,MaliciousIpModel.class);
|
|
|
|
reason=model.toHtmlString4DB();
|
|
|
|
record.setReason(reason);
|
|
|
|
}catch (Exception e){
|
|
|
|
///查询异常就不管了
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
PageResponse<MaliciousIpsRecord> pageResp = new PageResponse<>();
|
|
|
|
pageResp.setCurrentPage(request.getCurrentPage());
|
|
|
|
pageResp.setPageSize(request.getPageSize());
|
|
|
|
pageResp.setTotal(total);
|
|
|
|
pageResp.setRows(ls);
|
|
|
|
return new BaseResponse<>(pageResp);
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* 获取大于当前时间的ip数量
|
|
|
|
* @param beginTime
|
|
|
|
* @return
|
|
|
|
*/
|
|
|
|
public int getAlarmCountMipsInfoToOpsDb(String beginTime){
|
|
|
|
if(StringUtils.isBlank(beginTime)){
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
return maliciousIpsRecordForbidMapper.getAlarmCountMipsInfoToOpsDb(beginTime);
|
|
|
|
}
|
|
|
|
|
|
|
|
public BaseResponse getAlarmMipsInfoToOpsDb(MaliciousIpRecordReq request){
|
|
|
|
PageBean page = PageBean.initPageInfo(request.getCurrentPage(), request.getPageSize(), request);
|
|
|
|
// 先查询符合条件的总数量
|
|
|
|
int total = maliciousIpsRecordForbidMapper.selectCount(page);
|
|
|
|
// 数量为0 直接返回
|
|
|
|
if (total == 0) {
|
|
|
|
return new BaseResponse<>();
|
|
|
|
}
|
|
|
|
// 获取列表
|
|
|
|
List<MaliciousIpsRecordForbid> ls = maliciousIpsRecordForbidMapper.selectByPage(page);
|
|
|
|
if (org.springframework.util.CollectionUtils.isEmpty(ls)) {
|
|
|
|
return new BaseResponse<>();
|
|
|
|
}
|
|
|
|
//解析reason到汉字
|
|
|
|
for(MaliciousIpsRecordForbid record:ls){
|
|
|
|
String reasonForbid=record.getReason();
|
|
|
|
if(StringUtils.isNotBlank(reasonForbid)){
|
|
|
|
try{
|
|
|
|
MaliciousIpModel model=JSON.parseObject(reasonForbid,MaliciousIpModel.class);
|
|
|
|
reasonForbid=model.toHtmlString();
|
|
|
|
record.setReason(reasonForbid);
|
|
|
|
}catch (Exception e){
|
|
|
|
///查询异常就不管了
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
PageResponse<MaliciousIpsRecordForbid> pageResp = new PageResponse<>();
|
|
|
|
pageResp.setCurrentPage(request.getCurrentPage());
|
|
|
|
pageResp.setPageSize(request.getPageSize());
|
|
|
|
pageResp.setTotal(total);
|
|
|
|
pageResp.setRows(ls);
|
|
|
|
return new BaseResponse<>(pageResp);
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
*从运维系统的redis查询恶意ip,并且从influxdb中取对应的ip信息
|
|
|
|
*/
|
|
|
|
@Override
|
|
|
|
public BaseResponse getMipsFromOpsReids(MaliciousIpRecordReq request){
|
|
|
|
PageBean page = PageBean.initPageInfo(request.getCurrentPage(), request.getPageSize(), request);
|
|
|
|
// 先查询符合条件的总数量
|
|
|
|
int total = maliciousIpsRecordBannedMapper.selectCount(page);
|
|
|
|
// 数量为0 直接返回
|
|
|
|
if (total == 0) {
|
|
|
|
return new BaseResponse<>();
|
|
|
|
}
|
|
|
|
// 获取列表
|
|
|
|
List<MaliciousIpsRecordBanned> ls = maliciousIpsRecordBannedMapper.selectByPage(page);
|
|
|
|
if (org.springframework.util.CollectionUtils.isEmpty(ls)) {
|
|
|
|
return new BaseResponse<>();
|
|
|
|
}
|
|
|
|
//解析reason到汉字
|
|
|
|
for(MaliciousIpsRecordBanned record:ls){
|
|
|
|
String reason=record.getReason();
|
|
|
|
if(StringUtils.isNotBlank(reason)){
|
|
|
|
try{
|
|
|
|
MaliciousIpModel model=JSON.parseObject(reason,MaliciousIpModel.class);
|
|
|
|
reason=model.toHtmlString();
|
|
|
|
record.setReason(reason);
|
|
|
|
}catch (Exception e){
|
|
|
|
///查询异常就不管了
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
PageResponse<MaliciousIpsRecordBanned> pageResp = new PageResponse<>();
|
|
|
|
pageResp.setCurrentPage(request.getCurrentPage());
|
|
|
|
pageResp.setPageSize(request.getPageSize());
|
|
|
|
pageResp.setTotal(total);
|
|
|
|
pageResp.setRows(ls);
|
|
|
|
return new BaseResponse<>(pageResp);
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* 从运维系统的redis删除恶意ip，并调用相关系统提供的接口从正式封杀环境中删除
|
|
|
|
* @return
|
|
|
|
*/
|
|
|
|
@Override
|
|
|
|
public void delMipsFromOpsRedis(String ip){
|
|
|
|
logger.info(" delMipsFromOpsRedis mip "+ip);
|
|
|
|
maliciousIpsRecordBannedMapper.deleteByIp(ip);
|
|
|
|
}
|
|
|
|
|
|
|
|
@Override
|
|
|
|
public void addMipsToOpsRedis(String ip){
|
|
|
|
logger.info(" addMipsToOpsRedis mip "+ip);
|
|
|
|
try {
|
|
|
|
MaliciousIpsRecordBanned addRecord=new MaliciousIpsRecordBanned();
|
|
|
|
addRecord.setIp(ip);
|
|
|
|
addRecord.setForbidStatus("ADD");//手工添加的封杀
|
|
|
|
addRecord.setHbaseSource(cloudName);
|
|
|
|
maliciousIpsRecordBannedMapper.insert(addRecord);
|
|
|
|
} catch (Exception e) {
|
|
|
|
logger.error("insert mip into redis failed", e);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/* (non-Javadoc)
|
|
|
|
* @see com.monitor.other.maliciousip.service.MaliciousIpService#getIps()
|
|
|
|
* 从Redis中获取恶意ip集合
|
|
|
|
*/
|
|
|
|
@Override
|
|
|
|
public BaseResponse<List<MaliciousIp>> getIps(String timeType) {
|
|
|
|
BaseResponse<List<MaliciousIp>> response = new BaseResponse<>();
|
|
|
|
List<MaliciousIp> listMaliciousIp;
|
|
|
|
try{
|
|
|
|
String ips_json = null;
|
|
|
|
ips_json = redisDataByApiUtil.getIpsByUrl(timeType);
|
|
|
|
if(StringUtils.isBlank(ips_json)){
|
|
|
|
return response;
|
|
|
|
}
|
|
|
|
listMaliciousIp = (List<MaliciousIp>) JSON.parseArray(ips_json, MaliciousIp.class);
|
|
|
|
|
|
|
|
if(listMaliciousIp!=null&&listMaliciousIp.size()>1){
|
|
|
|
listMaliciousIp.sort(Comparator.comparing(MaliciousIp::getQps).reversed());
|
|
|
|
}
|
|
|
|
|
|
|
|
response.setData(listMaliciousIp);
|
|
|
|
|
|
|
|
}catch(Exception e){
|
|
|
|
logger.error(" - MaliciousIpServiceImpl - getIps - error", e);
|
|
|
|
}
|
|
|
|
return response;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* (non-Javadoc)
|
|
|
|
* @see com.monitor.other.maliciousip.service.MaliciousIpService#getDetail(java.lang.String)
|
|
|
|
* 从Redis中获取恶意ip的内容
|
|
|
|
*/
|
|
|
|
@Override
|
|
|
|
public BaseResponse<List<MaliciousDetailIp>> getDetail(String ip, String count, String timeType, String timestamp) {
|
|
|
|
BaseResponse<List<MaliciousDetailIp>> response = new BaseResponse<>();
|
|
|
|
List<MaliciousDetailIp> listMaliciousDetailIp;
|
|
|
|
try{
|
|
|
|
String detail_json = null;
|
|
|
|
detail_json = redisDataByApiUtil.getDetailByUrl(ip, timeType, timestamp);
|
|
|
|
if(StringUtils.isBlank(detail_json)){
|
|
|
|
return response;
|
|
|
|
}
|
|
|
|
listMaliciousDetailIp = (List<MaliciousDetailIp>) JSON.parseArray(detail_json, MaliciousDetailIp.class);
|
|
|
|
if(NumberUtils.isNumber(count) && CollectionUtils.isNotEmpty(listMaliciousDetailIp)){
|
|
|
|
for (MaliciousDetailIp maliciousDetailIp : listMaliciousDetailIp) {
|
|
|
|
maliciousDetailIp.setPercent(maliciousDetailIp.getCount() * 100 / Integer.parseInt(count));
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if(listMaliciousDetailIp!=null&&listMaliciousDetailIp.size()>1){
|
|
|
|
listMaliciousDetailIp.sort(Comparator.comparing(MaliciousDetailIp::getCount).reversed());
|
|
|
|
}
|
|
|
|
response.setData(listMaliciousDetailIp);
|
|
|
|
}catch(Exception e){
|
|
|
|
logger.error(" - MaliciousIpServiceImpl - getDetail - error", e);
|
|
|
|
}
|
|
|
|
return response;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* 恶意ip规则列表**/
|
|
|
|
public PageResponse<MalIpRule> getIpRules(PageRequest req) {
|
|
|
|
logger.info("getMalIpRules with param is {}", req);
|
|
|
|
// 组装分页对象
|
|
|
|
PageBean page = PageBean.initPageInfo(req.getCurrentPage(), req.getPageSize(), req);
|
|
|
|
// 先查询符合条件的总数量
|
|
|
|
int total = malIpRuleMapper.selectCount(page);
|
|
|
|
logger.info("getMalIpRules selectCount num is {}, with param is {}", total, req);
|
|
|
|
// 数量为0 直接返回
|
|
|
|
if (total == 0) {
|
|
|
|
// 返回初始page对象
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
// 获取列表
|
|
|
|
List<MalIpRule> malIpRules = malIpRuleMapper.selectMalIpRulesByPage(page);
|
|
|
|
if (CollectionUtils.isEmpty(malIpRules)) {
|
|
|
|
logger.debug("getMalIpRules is null with param is {}", req);
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
PageResponse<MalIpRule> response = new PageResponse<MalIpRule>();
|
|
|
|
response.setCurrentPage(req.getCurrentPage());
|
|
|
|
response.setPageSize(req.getPageSize());
|
|
|
|
response.setTotal(total);
|
|
|
|
response.setRows(malIpRules);
|
|
|
|
return response;
|
|
|
|
}
|
|
|
|
|
|
|
|
@Override
|
|
|
|
public BaseResponse<Integer> saveMalIpRule(MalIpRule malIpRule){
|
|
|
|
try{
|
|
|
|
int result = 0;
|
|
|
|
logger.info("saveIpRules with param is {}", malIpRule);
|
|
|
|
result = malIpRuleMapper.insert(malIpRule);
|
|
|
|
return new BaseResponse<>(result);
|
|
|
|
}catch(Exception e){
|
|
|
|
logger.error("saveMalIpRule error!",e);
|
|
|
|
return new BaseResponse<>(e.getMessage());
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
@Override
|
|
|
|
public BaseResponse<Integer> delIpRule(int id) {
|
|
|
|
try {
|
|
|
|
logger.info("delIpRule id : " + id);
|
|
|
|
int result = 0;
|
|
|
|
result = malIpRuleMapper.deleteById(id);
|
|
|
|
return new BaseResponse<>(result);
|
|
|
|
}catch(Exception e){
|
|
|
|
logger.error("delIpRule error! ", e);
|
|
|
|
return new BaseResponse<>(e.getMessage());
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* 以规定格式返回所有的恶意ip规则
|
|
|
|
*/
|
|
|
|
@Override
|
|
|
|
public String getAllIpRules(){
|
|
|
|
|
|
|
|
List<MalIpRule> ruleList = malIpRuleMapper.selectAll();
|
|
|
|
if(ruleList == null || ruleList.size() == 0){
|
|
|
|
return "[]";
|
|
|
|
}
|
|
|
|
|
|
|
|
List<String> lists = ruleList.stream().map(o->"\""+o.getRule()+"\"").collect(Collectors.toList());
|
|
|
|
String rules = String.join(",",lists);
|
|
|
|
rules = "[" + rules + "]";
|
|
|
|
logger.info("getAllIpRules:" + rules);
|
|
|
|
return rules;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@Override
|
|
|
|
public List<String> getMaliciousDetection(String ip,long timestamp,String type,String cloudType){
|
|
|
|
|
|
|
|
List<String> list = new ArrayList<>();
|
|
|
|
String tableName="malicious_detection";
|
|
|
|
try {
|
|
|
|
if("aws".equalsIgnoreCase(cloudType)){
|
|
|
|
getMaliciousDetectionFromCloud(HbasePoolAws.getConnection(),tableName,ip,timestamp,timestamp,type,list);
|
|
|
|
}else if("qcloud".equalsIgnoreCase(cloudType)){
|
|
|
|
getMaliciousDetectionFromCloud(HbasePool.getConnection(),tableName,ip,timestamp,timestamp,type,list);
|
|
|
|
}else{
|
|
|
|
getMaliciousDetectionFromCloud(HbasePoolAws.getConnection(),tableName,ip,timestamp,timestamp,type,list);
|
|
|
|
getMaliciousDetectionFromCloud(HbasePool.getConnection(),tableName,ip,timestamp,timestamp,type,list);
|
|
|
|
}
|
|
|
|
|
|
|
|
}catch(Exception e){
|
|
|
|
e.printStackTrace();
|
|
|
|
}
|
|
|
|
return list;
|
|
|
|
}
|
|
|
|
|
|
|
|
@Override
|
|
|
|
public List<String> getMaliciousDetectionMin(String ip,long timestamp,String type,String cloudType){
|
|
|
|
|
|
|
|
List<String> list = new ArrayList<>();
|
|
|
|
long minInMill=5*60*1000; //5分钟
|
|
|
|
long timestampEnd=timestamp;
|
|
|
|
long timestampBegin=timestampEnd-minInMill;
|
|
|
|
String tableName="all_detection";
|
|
|
|
type="message";
|
|
|
|
try {
|
|
|
|
if("aws".equalsIgnoreCase(cloudType)){
|
|
|
|
getMaliciousDetectionFromCloud(HbasePoolAws.getConnection(),tableName,ip,timestampBegin,timestampEnd,type,list);
|
|
|
|
}else if("qcloud".equalsIgnoreCase(cloudType)){
|
|
|
|
getMaliciousDetectionFromCloud(HbasePool.getConnection(),tableName,ip,timestampBegin,timestampEnd,type,list);
|
|
|
|
}else{
|
|
|
|
getMaliciousDetectionFromCloud(HbasePoolAws.getConnection(),tableName,ip,timestampBegin,timestampEnd,type,list);
|
|
|
|
getMaliciousDetectionFromCloud(HbasePool.getConnection(),tableName,ip,timestampBegin,timestampEnd,type,list);
|
|
|
|
}
|
|
|
|
|
|
|
|
}catch(Exception e){
|
|
|
|
e.printStackTrace();
|
|
|
|
}
|
|
|
|
return list;
|
|
|
|
}
|
|
|
|
|
|
|
|
private void getMaliciousDetectionFromCloud(Connection connection,String tableName,String ip,long timestampBegin,long timestampEnd,String type,List<String> list){
|
|
|
|
if(connection==null){
|
|
|
|
return ;
|
|
|
|
}
|
|
|
|
try {
|
|
|
|
Table maliciousDetectionTable = connection.getTable(TableName.valueOf(tableName));
|
|
|
|
Scan scan = new Scan();
|
|
|
|
scan.setStartRow((ip + ":" + timestampBegin + ":").getBytes());
|
|
|
|
scan.setStopRow((ip + ":" + timestampEnd + ":a").getBytes());
|
|
|
|
ResultScanner result = maliciousDetectionTable.getScanner(scan);
|
|
|
|
|
|
|
|
for (Result r : result) {
|
|
|
|
byte[] dataBytes = r.getValue(Bytes.toBytes("data"), Bytes.toBytes(type));
|
|
|
|
if(dataBytes != null && dataBytes.length>0){
|
|
|
|
String info = new String((dataBytes));
|
|
|
|
list.add(info);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}catch(Exception e){
|
|
|
|
e.printStackTrace();
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
} |
|
|
\ No newline at end of file |
