gfwleak/galaxy-tsg-olap-dos-detection-job
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

修改获取基线值策略，当基线type=3且基线值小于静态敏感阈值时，将其替换。

Browse Source
This commit is contained in:
wanglihui
2021-10-29 18:43:05 +08:00
parent 0125b031dd
commit 0617b1e614
3 changed files with 13 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/main/java/com/zdjizhi/etl/DosDetection.java
View File

@@ -35,6 +35,8 @@ public class DosDetection extends RichMapFunction<DosSketchLog, DosEventLog> {
private final static int BASELINE_CONDITION_TYPE = 2;
private final static int SENSITIVITY_CONDITION_TYPE = 3;
private final static int OTHER_BASELINE_TYPE = 3;
@Override
public void open(Configuration parameters) {
ScheduledExecutorService executorService = new ScheduledThreadPoolExecutor(2,
@@ -162,6 +164,7 @@ public class DosDetection extends RichMapFunction<DosSketchLog, DosEventLog> {
if (dosBaselineThreshold != null) {
ArrayList<Integer> baselines = dosBaselineThreshold.getSession_rate();
Integer defaultVaule = dosBaselineThreshold.getSession_rate_default_value();
Integer sessionRateBaselineType = dosBaselineThreshold.getSession_rate_baseline_type();
if (baselines != null && baselines.size() == BASELINE_SIZE) {
int timeIndex = getCurrentTimeIndex(value.getSketch_start_time());
base = baselines.get(timeIndex);
@@ -169,6 +172,9 @@ public class DosDetection extends RichMapFunction<DosSketchLog, DosEventLog> {
logger.debug("获取到当前IP: {},类型: {} baseline值为0,替换为P95观测值{}", value.getDestination_ip(), value.getAttack_type(), defaultVaule);
base = defaultVaule;
}
if (sessionRateBaselineType == OTHER_BASELINE_TYPE && base < CommonConfig.STATIC_SENSITIVITY_THRESHOLD){
base = CommonConfig.STATIC_SENSITIVITY_THRESHOLD;
}
}
}
} catch (Exception e) {