fix:Modify the method of obtaining DoS Detection task knowledge base(TSG-17971)

2.适配bifang23.11接口（TSG-17675）。
3.移除广播流。
4.修复静态阈值判断部分的BUG。

pom.xml

@@ -6,13 +6,18 @@
 
     <groupId>com.zdjizhi</groupId>
     <artifactId>flink-dos-detection</artifactId>
-    <version>1.0-SNAPSHOT</version>
+    <version>23.12</version>
+
+    <name>flink-dos-detection</name>
+    <url>http://www.example.com</url>
+
 
     <properties>
+        <galaxy.tools.version>1.2.1</galaxy.tools.version>
         <flink.version>1.13.1</flink.version>
         <hive.version>2.1.1</hive.version>
         <hadoop.version>2.7.1</hadoop.version>
-        <scala.binary.version>2.11</scala.binary.version>
+        <scala.binary.version>2.12</scala.binary.version>
         <jsonpath.version>2.4.0</jsonpath.version>
     </properties>
 
@@ -20,7 +25,7 @@
         <repository>
             <id>nexus</id>
             <name>Team Nexus Repository</name>
-            <url>http://192.168.40.125:8099/content/groups/public</url>
+            <url>http://192.168.40.153:8099/content/groups/public</url>
         </repository>
 
         <repository>
@@ -131,15 +136,15 @@
         </dependency>
 
         <!--<dependency>-->
-            <!--<groupId>org.slf4j</groupId>-->
-            <!--<artifactId>slf4j-api</artifactId>-->
-            <!--<version>1.7.21</version>-->
+        <!--<groupId>org.slf4j</groupId>-->
+        <!--<artifactId>slf4j-api</artifactId>-->
+        <!--<version>1.7.21</version>-->
         <!--</dependency>-->
 
         <!--<dependency>-->
-            <!--<groupId>org.slf4j</groupId>-->
-            <!--<artifactId>slf4j-log4j12</artifactId>-->
-            <!--<version>1.7.21</version>-->
+        <!--<groupId>org.slf4j</groupId>-->
+        <!--<artifactId>slf4j-log4j12</artifactId>-->
+        <!--<version>1.7.21</version>-->
         <!--</dependency>-->
 
         <dependency>
@@ -152,7 +157,6 @@
             <groupId>org.apache.flink</groupId>
             <artifactId>flink-connector-kafka_2.12</artifactId>
             <version>${flink.version}</version>
-            <!--<scope>provided</scope>-->
         </dependency>
 
         <!-- CLI dependencies -->
@@ -160,13 +164,13 @@
             <groupId>org.apache.flink</groupId>
             <artifactId>flink-clients_2.12</artifactId>
             <version>${flink.version}</version>
-            <!--<scope>provided</scope>-->
+            <scope>provided</scope>
         </dependency>
         <dependency>
             <groupId>org.apache.hadoop</groupId>
             <artifactId>hadoop-common</artifactId>
             <version>2.7.1</version>
-            <!--<scope>provided</scope>-->
+            <scope>provided</scope>
             <exclusions>
                 <exclusion>
                     <artifactId>zookeeper</artifactId>
@@ -184,22 +188,26 @@
                     <artifactId>slf4j-api</artifactId>
                     <groupId>org.slf4j</groupId>
                 </exclusion>
+                <exclusion>
+                    <groupId>org.apache.hadoop</groupId>
+                    <artifactId>hadoop-auth</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
 
 
-        <dependency>
-            <groupId>org.apache.hadoop</groupId>
-            <artifactId>hadoop-hdfs</artifactId>
-            <version>${hadoop.version}</version>
-        </dependency>
+        <!--        <dependency>-->
+        <!--            <groupId>org.apache.hadoop</groupId>-->
+        <!--            <artifactId>hadoop-hdfs</artifactId>-->
+        <!--            <version>${hadoop.version}</version>-->
+        <!--        </dependency>-->
 
         <!-- https://mvnrepository.com/artifact/org.apache.hbase/hbase-client -->
         <dependency>
             <groupId>org.apache.hbase</groupId>
             <artifactId>hbase-client</artifactId>
             <version>2.2.3</version>
-            <!--<scope>provided</scope>-->
+            <scope>provided</scope>
             <exclusions>
                 <exclusion>
                     <artifactId>slf4j-log4j12</artifactId>
@@ -254,24 +262,11 @@
             <version>5.3.3</version>
         </dependency>
 
+
         <dependency>
-            <groupId>com.zdjizhi</groupId>
-            <artifactId>galaxy</artifactId>
-            <version>1.1.1</version>
-            <exclusions>
-                <exclusion>
-                    <artifactId>slf4j-log4j12</artifactId>
-                    <groupId>org.slf4j</groupId>
-                </exclusion>
-                <exclusion>
-                    <artifactId>log4j-over-slf4j</artifactId>
-                    <groupId>org.slf4j</groupId>
-                </exclusion>
-                <exclusion>
-                    <groupId>com.google.guava</groupId>
-                    <artifactId>guava</artifactId>
-                </exclusion>
-            </exclusions>
+            <groupId>com.alibaba.fastjson2</groupId>
+            <artifactId>fastjson2</artifactId>
+            <version>2.0.32</version>
         </dependency>
 
         <dependency>
@@ -342,8 +337,12 @@
             <version>${flink.version}</version>
         </dependency>
 
-
+        <dependency>
+            <groupId>com.geedgenetworks</groupId>
+            <artifactId>galaxy</artifactId>
+            <version>${galaxy.tools.version}</version>
+        </dependency>
     </dependencies>
 
 
-</project>
+</project>

src/main/java/com/zdjizhi/common/CustomFile.java

@@ -1,26 +0,0 @@
-package com.zdjizhi.common;
-
-import java.io.Serializable;
-
-public class CustomFile implements Serializable {
-
-    String fileName;
-
-    byte[] content;
-
-    public String getFileName() {
-        return fileName;
-    }
-
-    public void setFileName(String fileName) {
-        this.fileName = fileName;
-    }
-
-    public byte[] getContent() {
-        return content;
-    }
-
-    public void setContent(byte[] content) {
-        this.content = content;
-    }
-}

src/main/java/com/zdjizhi/common/DosDetectionThreshold.java

@@ -9,110 +9,110 @@ import java.util.Objects;
  * @author wlh
  */
 public class DosDetectionThreshold implements Serializable {
-    private String profileId;
-    private String attackType;
-    private ArrayList<String> serverIpList;
-    private String serverIpAddr;
-    private long packetsPerSec;
-    private long bitsPerSec;
-    private long sessionsPerSec;
-    private int isValid;
-    private int vsysId;
-    private Integer[] superiorIds;
+    private long profile_id;
+    private String attack_type;
+    private ArrayList<String> server_ip_list;
+    private String server_ip_addr;
+    private long packets_per_sec;
+    private long bits_per_sec;
+    private long sessions_per_sec;
+    private int is_valid;
+    private int vsys_id;
+    private Integer[] superior_ids;
 
-    public String getProfileId() {
-        return profileId;
+    public long getProfile_id() {
+        return profile_id;
     }
 
-    public void setProfileId(String profileId) {
-        this.profileId = profileId;
+    public void setProfile_id(long profile_id) {
+        this.profile_id = profile_id;
     }
 
-    public String getAttackType() {
-        return attackType;
+    public String getAttack_type() {
+        return attack_type;
     }
 
-    public void setAttackType(String attackType) {
-        this.attackType = attackType;
+    public void setAttack_type(String attack_type) {
+        this.attack_type = attack_type;
     }
 
-    public ArrayList<String> getServerIpList() {
-        return serverIpList;
+    public ArrayList<String> getServer_ip_list() {
+        return server_ip_list;
     }
 
-    public void setServerIpList(ArrayList<String> serverIpList) {
-        this.serverIpList = serverIpList;
+    public void setServer_ip_list(ArrayList<String> server_ip_list) {
+        this.server_ip_list = server_ip_list;
     }
 
-    public String getServerIpAddr() {
-        return serverIpAddr;
+    public String getServer_ip_addr() {
+        return server_ip_addr;
     }
 
-    public void setServerIpAddr(String serverIpAddr) {
-        this.serverIpAddr = serverIpAddr;
+    public void setServer_ip_addr(String server_ip_addr) {
+        this.server_ip_addr = server_ip_addr;
     }
 
-    public long getPacketsPerSec() {
-        return packetsPerSec;
+    public long getPackets_per_sec() {
+        return packets_per_sec;
     }
 
-    public void setPacketsPerSec(long packetsPerSec) {
-        this.packetsPerSec = packetsPerSec;
+    public void setPackets_per_sec(long packets_per_sec) {
+        this.packets_per_sec = packets_per_sec;
     }
 
-    public long getBitsPerSec() {
-        return bitsPerSec;
+    public long getBits_per_sec() {
+        return bits_per_sec;
     }
 
-    public void setBitsPerSec(long bitsPerSec) {
-        this.bitsPerSec = bitsPerSec;
+    public void setBits_per_sec(long bits_per_sec) {
+        this.bits_per_sec = bits_per_sec;
     }
 
-    public long getSessionsPerSec() {
-        return sessionsPerSec;
+    public long getSessions_per_sec() {
+        return sessions_per_sec;
     }
 
-    public void setSessionsPerSec(long sessionsPerSec) {
-        this.sessionsPerSec = sessionsPerSec;
+    public void setSessions_per_sec(long sessions_per_sec) {
+        this.sessions_per_sec = sessions_per_sec;
     }
 
-    public int getIsValid() {
-        return isValid;
+    public int getIs_valid() {
+        return is_valid;
     }
 
-    public void setIsValid(int isValid) {
-        this.isValid = isValid;
+    public void setIs_valid(int is_valid) {
+        this.is_valid = is_valid;
     }
 
-    public int getVsysId() {
-        return vsysId;
+    public int getVsys_id() {
+        return vsys_id;
     }
 
-    public void setVsysId(int vsysId) {
-        this.vsysId = vsysId;
+    public void setVsys_id(int vsys_id) {
+        this.vsys_id = vsys_id;
     }
 
-    public Integer[] getSuperiorIds() {
-        return superiorIds;
+    public Integer[] getSuperior_ids() {
+        return superior_ids;
     }
 
-    public void setSuperiorIds(Integer[] superiorIds) {
-        this.superiorIds = superiorIds;
+    public void setSuperior_ids(Integer[] superior_ids) {
+        this.superior_ids = superior_ids;
     }
 
     @Override
     public String toString() {
         return "DosDetectionThreshold{" +
-                "profileId='" + profileId + '\'' +
-                ", attackType='" + attackType + '\'' +
-                ", serverIpList=" + serverIpList +
-                ", serverIpAddr='" + serverIpAddr + '\'' +
-                ", packetsPerSec=" + packetsPerSec +
-                ", bitsPerSec=" + bitsPerSec +
-                ", sessionsPerSec=" + sessionsPerSec +
-                ", isValid=" + isValid +
-                ", vsysId=" + vsysId +
-                ", superiorIds=" + Arrays.toString(superiorIds) +
+                "profile_id=" + profile_id +
+                ", attack_type='" + attack_type + '\'' +
+                ", server_ip_list=" + server_ip_list +
+                ", server_ip_addr='" + server_ip_addr + '\'' +
+                ", packets_per_sec=" + packets_per_sec +
+                ", bits_per_sec=" + bits_per_sec +
+                ", sessions_per_sec=" + sessions_per_sec +
+                ", is_valid=" + is_valid +
+                ", vsys_id=" + vsys_id +
+                ", superior_ids=" + Arrays.toString(superior_ids) +
                 '}';
     }
 }

src/main/java/com/zdjizhi/common/DosEventLog.java

@@ -2,12 +2,13 @@ package com.zdjizhi.common;
 
 import java.io.Serializable;
 
-public class DosEventLog implements Serializable,Cloneable {
-
+public class DosEventLog implements Serializable, Cloneable {
+    private long recv_time;
     private long log_id;
     private int vsys_id;
     private long start_time;
     private long end_time;
+    private long profile_id;
     private String attack_type;
     private String severity;
     private String conditions;
@@ -19,6 +20,14 @@ public class DosEventLog implements Serializable,Cloneable {
     private long packet_rate;
     private long bit_rate;
 
+    public long getRecv_time() {
+        return recv_time;
+    }
+
+    public void setRecv_time(long recv_time) {
+        this.recv_time = recv_time;
+    }
+
     public long getLog_id() {
         return log_id;
     }
@@ -51,6 +60,14 @@ public class DosEventLog implements Serializable,Cloneable {
         this.end_time = end_time;
     }
 
+    public long getProfile_id() {
+        return profile_id;
+    }
+
+    public void setProfile_id(long profile_id) {
+        this.profile_id = profile_id;
+    }
+
     public String getAttack_type() {
         return attack_type;
     }
@@ -134,10 +151,12 @@ public class DosEventLog implements Serializable,Cloneable {
     @Override
     public String toString() {
         return "DosEventLog{" +
-                "log_id=" + log_id +
+                "recv_time=" + recv_time +
+                ", log_id=" + log_id +
                 ", vsys_id=" + vsys_id +
                 ", start_time=" + start_time +
                 ", end_time=" + end_time +
+                ", profile_id=" + profile_id +
                 ", attack_type='" + attack_type + '\'' +
                 ", severity='" + severity + '\'' +
                 ", conditions='" + conditions + '\'' +

src/main/java/com/zdjizhi/common/DosSketchLog.java

@@ -5,6 +5,7 @@ import java.util.Objects;
 
 public class DosSketchLog implements Serializable {
 
+    private long common_recv_time;
     private String common_sled_ip;
     private String common_data_center;
     private long sketch_start_time;
@@ -17,10 +18,12 @@ public class DosSketchLog implements Serializable {
     private long sketch_bytes;
     private int vsys_id;
 
+
     @Override
     public String toString() {
         return "DosSketchLog{" +
-                "common_sled_ip='" + common_sled_ip + '\'' +
+                "common_recv_time=" + common_recv_time +
+                ", common_sled_ip='" + common_sled_ip + '\'' +
                 ", common_data_center='" + common_data_center + '\'' +
                 ", sketch_start_time=" + sketch_start_time +
                 ", sketch_duration=" + sketch_duration +
@@ -34,6 +37,14 @@ public class DosSketchLog implements Serializable {
                 '}';
     }
 
+    public long getCommon_recv_time() {
+        return common_recv_time;
+    }
+
+    public void setCommon_recv_time(long common_recv_time) {
+        this.common_recv_time = common_recv_time;
+    }
+
     public String getCommon_sled_ip() {
         return common_sled_ip;
     }

src/main/java/com/zdjizhi/common/DosVsysId.java

@@ -4,7 +4,7 @@ import java.util.Arrays;
 
 public class DosVsysId {
     private Integer id;
-    private Integer[] superiorIds;
+    private Integer[] superior_ids;
 
     public Integer getId() {
         return id;
@@ -14,19 +14,19 @@ public class DosVsysId {
         this.id = id;
     }
 
-    public Integer[] getSuperiorIds() {
-        return superiorIds;
+    public Integer[] getSuperior_ids() {
+        return superior_ids;
     }
 
-    public void setSuperiorIds(Integer[] superiorIds) {
-        this.superiorIds = superiorIds;
+    public void setSuperior_ids(Integer[] superior_ids) {
+        this.superior_ids = superior_ids;
     }
 
     @Override
     public String toString() {
         return "DosVsysId{" +
                 "id=" + id +
-                ", superiorIds=" + Arrays.toString(superiorIds) +
+                ", superior_ids=" + Arrays.toString(superior_ids) +
                 '}';
     }
 }

src/main/java/com/zdjizhi/common/FlowWriteConfig.java

@@ -7,12 +7,11 @@ import org.jasypt.encryption.pbe.StandardPBEStringEncryptor;
  * @author wlh
  * @date 2021/1/6
  */
-public class CommonConfig {
+public class FlowWriteConfig {
 
     /**
      * 定位库默认分隔符
      */
-    public static final String LOCATION_SEPARATOR = ".";
 
     private static StandardPBEStringEncryptor encryptor = new StandardPBEStringEncryptor();
 
@@ -51,7 +50,6 @@ public class CommonConfig {
     public static final int DESTINATION_IP_PARTITION_NUM = CommonConfigurations.getIntProperty("destination.ip.partition.num");
     public static final int DATA_CENTER_ID_NUM = CommonConfigurations.getIntProperty("data.center.id.num");
 
-    public static final String IP_MMDB_PATH = CommonConfigurations.getStringProperty("ip.mmdb.path");
 
     public static final String BIFANG_SERVER_URI = CommonConfigurations.getStringProperty("bifang.server.uri");
     public static final String BIFANG_SERVER_ENCRYPTPWD_PATH = CommonConfigurations.getStringProperty("bifang.server.encryptpwd.path");
@@ -74,37 +72,34 @@ public class CommonConfig {
 
     public static final int SASL_JAAS_CONFIG_FLAG = CommonConfigurations.getIntProperty("sasl.jaas.config.flag");
 
-    public static final String NACOS_SERVER_ADDR = CommonConfigurations.getStringProperty("nacos.server.addr");
-    public static final String NACOS_USERNAME = CommonConfigurations.getStringProperty("nacos.username");
-    public static final String NACOS_PASSWORD = CommonConfigurations.getStringProperty("nacos.password");
-    public static final String NACOS_NAMESPACE = CommonConfigurations.getStringProperty("nacos.namespace");
-    public static final String NACOS_DATA_ID = CommonConfigurations.getStringProperty("nacos.data.id");
-    public static final String NACOS_GROUP = CommonConfigurations.getStringProperty("nacos.group");
-    public static final int NACOS_READ_TIMEOUT = CommonConfigurations.getIntProperty("nacos.read.timeout");
+    public static final Integer HTTP_SOCKET_TIMEOUT = CommonConfigurations.getIntProperty("http.socket.timeout");
+
+    public static final Long KNOWLEDGE_EXECUTION_INTERVAL = CommonConfigurations.getLongProperty("knowledge.execution.interval");
 
 
-    public static final String HOS_TOKEN = CommonConfigurations.getStringProperty("hos.token");
+    public static final String KNOWLEDGE_BASE_URL = CommonConfigurations.getStringProperty("knowledge.base.uri");
+    public static final String KNOWLEDGE_BASE_PATH = CommonConfigurations.getStringProperty("knowledge.base.path");
+    public static final String IP_USER_DEFINED_KD_ID = CommonConfigurations.getStringProperty("ip.user.defined.kd.id");
+    public static final String IP_BUILTIN_KD_ID = CommonConfigurations.getStringProperty("ip.builtin.kd.id");
 
-    public static final String CLUSTER_OR_SINGLE = CommonConfigurations.getStringProperty("cluster.or.single");
 
-    public static final String HDFS_URI_NS1 = CommonConfigurations.getStringProperty("hdfs.uri.nn1");
-    public static final String HDFS_URI_NS2 = CommonConfigurations.getStringProperty("hdfs.uri.nn2");
-    public static final String HDFS_PATH = CommonConfigurations.getStringProperty("hdfs.path");
-    public static final String HDFS_USER = CommonConfigurations.getStringProperty("hdfs.user");
+    public static final String BIFANG_SERVER_TOKEN = CommonConfigurations.getStringProperty("bifang.server.token");
+
+
+    public static final Integer STATIC_SENSITIVITY_THRESHOLD = CommonConfigurations.getIntProperty("static.sensitivity.threshold");
+    public static final Double BASELINE_SENSITIVITY_THRESHOLD = CommonConfigurations.getDoubleProperty("baseline.sensitivity.threshold");
+
+    public static final Double BASELINE_SESSIONS_MINOR_THRESHOLD = CommonConfigurations.getDoubleProperty("baseline.sessions.minor.threshold");
+
+
+    public static final Double BASELINE_SESSIONS_WARNING_THRESHOLD = CommonConfigurations.getDoubleProperty("baseline.sessions.warning.threshold");
+
+    public static final Double BASELINE_SESSIONS_MAJOR_THRESHOLD = CommonConfigurations.getDoubleProperty("baseline.sessions.major.threshold");
+
+    public static final Double BASELINE_SESSIONS_SEVERE_THRESHOLD = CommonConfigurations.getDoubleProperty("baseline.sessions.severe.threshold");
+    public static final Double BASELINE_SESSIONS_CRITICAL_THRESHOLD = CommonConfigurations.getDoubleProperty("baseline.sessions.critical.threshold");
 
-    public static final String DOWNLOAD_PATH = CommonConfigurations.getStringProperty("download.path");
 
-    public static void main(String[] args) {
-        StandardPBEStringEncryptor encryptor = new StandardPBEStringEncryptor();
-        // 配置加密解密的密码/salt值
-        encryptor.setPassword("galaxy");
-        // 对"raw_password"进行加密：S5kR+Y7CI8k7MaecZpde25yK8NKUnd6p
-//        String password = "galaxy2019";
-        String password = "nacos";
-        String encPwd = encryptor.encrypt(password);
-        System.out.println(encPwd);
-        // 再进行解密：raw_password
-        String rawPwd = encryptor.decrypt(encPwd);
-        System.out.println(rawPwd);
-    }
 }
+
+

src/main/java/com/zdjizhi/common/KnowledgeLog.java

@@ -1,91 +0,0 @@
-package com.zdjizhi.common;
-
-public class KnowledgeLog {
-    public   String id;
-    public   String name;
-    public   String path;
-    public   Long size;
-    public   String format;
-    public   String sha256;
-    public   String version;
-    public   String updateTime;
-
-    public String getId() {
-        return id;
-    }
-
-    public void setId(String id) {
-        this.id = id;
-    }
-
-    public String getName() {
-        return name;
-    }
-
-    public void setName(String name) {
-        this.name = name;
-    }
-
-    public String getPath() {
-        return path;
-    }
-
-    public void setPath(String path) {
-        this.path = path;
-    }
-
-    public Long getSize() {
-        return size;
-    }
-
-    public void setSize(Long size) {
-        this.size = size;
-    }
-
-    public String getFormat() {
-        return format;
-    }
-
-    public void setFormat(String format) {
-        this.format = format;
-    }
-
-    public String getSha256() {
-        return sha256;
-    }
-
-    public void setSha256(String sha256) {
-        this.sha256 = sha256;
-    }
-
-    public String getVersion() {
-        return version;
-    }
-
-    public void setVersion(String version) {
-        this.version = version;
-    }
-
-    public String getUpdateTime() {
-        return updateTime;
-    }
-
-    public void setUpdateTime(String updateTime) {
-        this.updateTime = updateTime;
-    }
-
-
-    @Override
-    public String toString() {
-        return "KnowledgeLog{" +
-                "id='" + id + '\'' +
-                ", name='" + name + '\'' +
-                ", path='" + path + '\'' +
-                ", size=" + size +
-                ", format='" + format + '\'' +
-                ", sha256='" + sha256 + '\'' +
-                ", version='" + version + '\'' +
-                ", updateTime='" + updateTime + '\'' +
-                '}';
-    }
-}

src/main/java/com/zdjizhi/common/pojo/KnowlegeBaseMeta.java

@@ -0,0 +1,74 @@
+package com.zdjizhi.common.pojo;
+
+import java.io.Serializable;
+
+/**
+ *
+ */
+public class KnowlegeBaseMeta implements Serializable {
+    private String kb_id;
+    private String name;
+    private String sha256;
+    private String format;
+    private String path;
+
+    public KnowlegeBaseMeta(String kd_id, String name, String sha256, String format, String path) {
+        this.kb_id = kd_id;
+        this.name = name;
+        this.sha256 = sha256;
+        this.format = format;
+        this.path = path;
+    }
+
+    public String getKb_id() {
+        return kb_id;
+    }
+
+    public void setKb_id(String kb_id) {
+        this.kb_id = kb_id;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getSha256() {
+        return sha256;
+    }
+
+    public void setSha256(String sha256) {
+        this.sha256 = sha256;
+    }
+
+    public String getFormat() {
+        return format;
+    }
+
+    public void setFormat(String format) {
+        this.format = format;
+    }
+
+    public String getPath() {
+        return path;
+    }
+
+    public void setPath(String path) {
+        this.path = path;
+    }
+
+    @Override
+    public String toString() {
+        return "KnowlegeBaseMeta{" +
+                "kb_id='" + kb_id + '\'' +
+                ", name='" + name + '\'' +
+                ", sha256='" + sha256 + '\'' +
+                ", format='" + format + '\'' +
+                ", path='" + path + '\'' +
+                '}';
+    }
+}
+

src/main/java/com/zdjizhi/etl/DosDetection.java

@@ -2,6 +2,8 @@ package com.zdjizhi.etl;
 
 import cn.hutool.log.Log;
 import cn.hutool.log.LogFactory;
+import com.geedgenetworks.utils.DateUtils;
+import com.geedgenetworks.utils.StringUtil;
 import com.zdjizhi.common.*;
 import com.zdjizhi.utils.*;
 import inet.ipaddr.IPAddress;
@@ -10,7 +12,7 @@ import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.concurrent.BasicThreadFactory;
 import org.apache.flink.configuration.Configuration;
 import org.apache.flink.shaded.guava18.com.google.common.collect.TreeRangeMap;
-import org.apache.flink.streaming.api.functions.co.BroadcastProcessFunction;
+import org.apache.flink.streaming.api.functions.ProcessFunction;
 import org.apache.flink.util.Collector;
 
 import java.math.BigDecimal;
@@ -23,12 +25,12 @@ import java.util.concurrent.TimeUnit;
 /**
  * @author wlh
  */
-public class DosDetection extends BroadcastProcessFunction<DosSketchLog,Map<String, byte[]>, DosEventLog> {
+public class DosDetection extends ProcessFunction<DosSketchLog, DosEventLog> {
 
     private static final Log logger = LogFactory.get();
     private static Map<String, Map<String, DosBaselineThreshold>> baselineMap = new HashMap<>();
     private final static NumberFormat PERCENT_INSTANCE = NumberFormat.getPercentInstance();
-    private HashMap<Integer,HashMap<String, TreeRangeMap<IPAddress, DosDetectionThreshold>>> thresholdRangeMap;
+    private HashMap<Integer, HashMap<String, TreeRangeMap<IPAddress, DosDetectionThreshold>>> thresholdRangeMap;
 
     private final static int BASELINE_SIZE = 144;
     private final static int STATIC_CONDITION_TYPE = 1;
@@ -41,22 +43,20 @@ public class DosDetection extends BroadcastProcessFunction<DosSketchLog,Map<Stri
 
     private final static int OTHER_BASELINE_TYPE = 3;
 
+
+
+
     @Override
     public void open(Configuration parameters) {
         ScheduledExecutorService executorService = new ScheduledThreadPoolExecutor(2,
                 new BasicThreadFactory.Builder().namingPattern("Dos-Detection-%d").daemon(true).build());
         try {
-
             super.open(parameters);
-            logger.info("begin init");
-            IpUtils.loadIpLook();
-            logger.info("init over");
-
             executorService.scheduleAtFixedRate(() -> thresholdRangeMap = ParseStaticThreshold.createStaticThreshold(), 0,
-                    CommonConfig.STATIC_THRESHOLD_SCHEDULE_MINUTES, TimeUnit.MINUTES);
+                    FlowWriteConfig.STATIC_THRESHOLD_SCHEDULE_MINUTES, TimeUnit.MINUTES);
 
             executorService.scheduleAtFixedRate(() -> baselineMap = ParseBaselineThreshold.readFromHbase(), 0,
-                    CommonConfig.BASELINE_THRESHOLD_SCHEDULE_DAYS, TimeUnit.DAYS);
+                    FlowWriteConfig.BASELINE_THRESHOLD_SCHEDULE_DAYS, TimeUnit.DAYS);
         } catch (Exception e) {
             logger.error("定时器任务执行失败", e);
         }
@@ -64,7 +64,7 @@ public class DosDetection extends BroadcastProcessFunction<DosSketchLog,Map<Stri
     }
 
     @Override
-    public void processElement(DosSketchLog value, ReadOnlyContext ctx, Collector<DosEventLog> out) {
+    public void processElement(DosSketchLog value, Context ctx, Collector<DosEventLog> out) throws Exception {
         DosEventLog finalResult = null;
         try {
             String destinationIp = value.getDestination_ip();
@@ -74,13 +74,13 @@ public class DosDetection extends BroadcastProcessFunction<DosSketchLog,Map<Stri
             IPAddress destinationIpAddress = new IPAddressString(destinationIp).getAddress();
 
             DosDetectionThreshold threshold = null;
-            if (thresholdRangeMap.containsKey(vsysId)){
+            if (thresholdRangeMap.containsKey(vsysId)) {
                 threshold = thresholdRangeMap.get(vsysId).getOrDefault(attackType, TreeRangeMap.create()).get(destinationIpAddress);
             }
 
             logger.debug("当前判断IP：{}, 类型: {}", key, attackType);
             if (threshold == null && baselineMap.containsKey(key)) {
-                finalResult = getDosEventLogByBaseline(value,key);
+                finalResult = getDosEventLogByBaseline(value, key);
             } else if (threshold == null && !baselineMap.containsKey(key)) {
                 finalResult = getDosEventLogBySensitivityThreshold(value);
             } else if (threshold != null) {
@@ -93,83 +93,87 @@ public class DosDetection extends BroadcastProcessFunction<DosSketchLog,Map<Stri
             logger.error("判定失败\n {} \n{}", value, e);
         }
 
-        if (finalResult != null){
+        if (finalResult != null) {
             out.collect(finalResult);
         }
     }
 
-    @Override
-    public void processBroadcastElement(Map<String, byte[]> value, Context ctx, Collector<DosEventLog> out) throws Exception {
-        IpUtils.updateIpLook(value);
-    }
 
     private DosEventLog getDosEventLogBySensitivityThreshold(DosSketchLog value) {
         long sketchSessions = value.getSketch_sessions();
-        Integer staticSensitivityThreshold = NacosUtils.getIntProperty("static.sensitivity.threshold");
+        Integer staticSensitivityThreshold = FlowWriteConfig.STATIC_SENSITIVITY_THRESHOLD;
         long diff = sketchSessions - staticSensitivityThreshold;
-        return getDosEventLog(value, staticSensitivityThreshold, diff, SENSITIVITY_CONDITION_TYPE, SESSIONS_TAG);
+        return getDosEventLog(value, staticSensitivityThreshold, diff, 0, SENSITIVITY_CONDITION_TYPE, SESSIONS_TAG);
     }
 
-    private DosEventLog getDosEventLogByBaseline(DosSketchLog value,String key) {
+    private DosEventLog getDosEventLogByBaseline(DosSketchLog value, String key) {
         String attackType = value.getAttack_type();
         long sketchSessions = value.getSketch_sessions();
         DosBaselineThreshold dosBaselineThreshold = baselineMap.get(key).get(attackType);
         Integer base = getBaseValue(dosBaselineThreshold, value);
         long diff = sketchSessions - base;
-        return getDosEventLog(value, base, diff, BASELINE_CONDITION_TYPE, SESSIONS_TAG);
+        return getDosEventLog(value, base, diff, 0, BASELINE_CONDITION_TYPE, SESSIONS_TAG);
     }
 
     private DosEventLog getDosEventLogByStaticThreshold(DosSketchLog value, DosDetectionThreshold threshold) throws CloneNotSupportedException {
-        long base = threshold.getSessionsPerSec();
-        long diff = value.getSketch_sessions() - base;
-        DosEventLog result = getDosEventLog(value, base, diff, STATIC_CONDITION_TYPE, SESSIONS_TAG);
-        if (result == null) {
-            base = threshold.getPacketsPerSec();
-            diff = value.getSketch_packets() - base;
-            result = getDosEventLog(value, base, diff, STATIC_CONDITION_TYPE, PACKETS_TAG);
-            if (result == null) {
-                base = threshold.getBitsPerSec();
-                diff = value.getSketch_bytes() - base;
-                result = getDosEventLog(value, base, diff, STATIC_CONDITION_TYPE, BITS_TAG);
-            }
+        long sessionBase = threshold.getSessions_per_sec();
+        long pktBase = threshold.getPackets_per_sec();
+        long bitBase = threshold.getBits_per_sec();
+
+        long diffSession = value.getSketch_sessions() - sessionBase;
+        long diffPkt = value.getSketch_packets() - pktBase;
+        long diffByte = value.getSketch_bytes() - bitBase;
+
+        double diffSessionPercent = 0.0;
+        double diffPktPercent = 0.0;
+        double diffBitPercent = 0.0;
+        //todo 代码Review发现该部分存在bug，23.11版本做修复，需测试。
+        if (sessionBase > 0) {
+            diffSessionPercent = getDiffPercent(diffSession, sessionBase) * 100;
         }
-        /*
-        ArrayList<DosEventLog> dosEventLogs = new ArrayList<>();
-        if (result != null){
-            dosEventLogs.add(result);
-            Integer[] superiorIds = threshold.getSuperiorIds();
-            if (superiorIds != null && superiorIds.length > 0){
-                for (Integer integer:superiorIds){
-                    DosEventLog clone = (DosEventLog) result.clone();
-                    clone.setVsys_id(integer);
-                    clone.setLog_id(SnowflakeId.generateId());
-                    dosEventLogs.add(clone);
-                }
-            }
+        if (pktBase > 0) {
+            diffPktPercent = getDiffPercent(diffPkt, pktBase) * 100;
+        }
+        if (bitBase > 0) {
+            diffBitPercent = getDiffPercent(diffByte, bitBase) * 100;
+        }
+
+        long profileId = 0;
+        DosEventLog result = null;
+
+        if (diffSessionPercent >= diffPktPercent && diffSessionPercent >= diffBitPercent) {
+            profileId = threshold.getProfile_id();
+            result = getDosEventLog(value, sessionBase, diffSession, profileId, STATIC_CONDITION_TYPE, SESSIONS_TAG);
+        } else if (diffPktPercent >= diffSessionPercent && diffPktPercent >= diffBitPercent) {
+            profileId = threshold.getProfile_id();
+            result = getDosEventLog(value, pktBase, diffPkt, profileId, STATIC_CONDITION_TYPE, PACKETS_TAG);
+        } else if (diffBitPercent >= diffPktPercent && diffBitPercent >= diffSessionPercent) {
+            profileId = threshold.getProfile_id();
+            result = getDosEventLog(value, bitBase, diffByte, profileId, STATIC_CONDITION_TYPE, BITS_TAG);
         }
-        */
         return result;
     }
 
-    private DosEventLog getDosEventLog(DosSketchLog value, long base, long diff, int type, String tag) {
+    private DosEventLog getDosEventLog(DosSketchLog value, long base, long diff, long profileId, int type, String tag) {
         DosEventLog result = null;
         String destinationIp = value.getDestination_ip();
         String attackType = value.getAttack_type();
         if (diff > 0 && base != 0) {
             double percent = getDiffPercent(diff, base);
             Severity severity = judgeSeverity(percent);
-            Integer staticSensitivityThreshold = NacosUtils.getIntProperty("static.sensitivity.threshold");
+            Integer staticSensitivityThreshold = FlowWriteConfig.STATIC_SENSITIVITY_THRESHOLD;
             if (severity != Severity.NORMAL) {
-                if (type == BASELINE_CONDITION_TYPE && percent < NacosUtils.getDoubleProperty("baseline.sensitivity.threshold")) {
+                if (type == BASELINE_CONDITION_TYPE && percent < FlowWriteConfig.BASELINE_SENSITIVITY_THRESHOLD) {
                     logger.debug("当前server IP:{},类型:{},基线值{}百分比{}未超过基线敏感阈值,日志详情\n{}", destinationIp, attackType, base, percent, value);
-                }else if ((type == BASELINE_CONDITION_TYPE || type == SENSITIVITY_CONDITION_TYPE) && value.getSketch_sessions() < staticSensitivityThreshold){
-                    logger.debug("当前server IP:{},类型:{},基线值{}百分比{}未超过静态敏感阈值,日志详情\n{}",destinationIp, attackType, base, percent, value);
-                }else {
-                    result = getResult(value, base, severity, percent+1, type, tag);
-                    if (type == SENSITIVITY_CONDITION_TYPE){
+                } else if ((type == BASELINE_CONDITION_TYPE || type == SENSITIVITY_CONDITION_TYPE) && value.getSketch_sessions() < staticSensitivityThreshold) {
+                    logger.debug("当前server IP:{},类型:{},基线值{}百分比{}未超过静态敏感阈值,日志详情\n{}", destinationIp, attackType, base, percent, value);
+                } else {
+//                    result = getResult(value, base, profileId, severity, percent+1, type, tag);
+                    result = getResult(value, base, profileId, severity, percent, type, tag);
+                    if (type == SENSITIVITY_CONDITION_TYPE) {
                         result.setSeverity(Severity.MAJOR.severity);
                     }
-                    logger.info("检测到当前server IP {} 存在 {} 异常,超出基线{} {}倍,基于{}:{}检测,日志详情\n {}", destinationIp,attackType,base,percent,type,tag,result);
+                    logger.info("检测到当前server IP {} 存在 {} 异常,超出基线{} {}倍,基于{}:{}检测,日志详情\n {}", destinationIp, attackType, base, percent, type, tag, result);
                 }
             } else {
                 logger.debug("当前server IP:{} 未出现 {} 异常,日志详情 {}", destinationIp, attackType, value);
@@ -178,17 +182,20 @@ public class DosDetection extends BroadcastProcessFunction<DosSketchLog,Map<Stri
         return result;
     }
 
-    private DosEventLog getResult(DosSketchLog value, long base, Severity severity, double percent, int type, String tag) {
+    private DosEventLog getResult(DosSketchLog value, long base, long profileId, Severity severity, double percent, int type, String tag) {
         DosEventLog dosEventLog = new DosEventLog();
+        dosEventLog.setRecv_time(value.getCommon_recv_time());
         dosEventLog.setLog_id(SnowflakeId.generateId());
         dosEventLog.setVsys_id(value.getVsys_id());
         dosEventLog.setStart_time(value.getSketch_start_time());
         dosEventLog.setEnd_time(value.getSketch_start_time() + value.getSketch_duration());
+        dosEventLog.setProfile_id(profileId);
         dosEventLog.setAttack_type(value.getAttack_type());
         dosEventLog.setSeverity(severity.severity);
-        dosEventLog.setConditions(getConditions(PERCENT_INSTANCE.format(percent), base, value.getSketch_sessions(), type, tag));
+        dosEventLog.setConditions(getConditions(PERCENT_INSTANCE.format(percent), base, value.getSketch_sessions(), type, tag, dosEventLog));
+//        dosEventLog.setConditions(getConditions(percent, base, value.getSketch_sessions(), type, tag,dosEventLog));
         dosEventLog.setDestination_ip(value.getDestination_ip());
-        dosEventLog.setDestination_country(IpUtils.ipLookup.countryLookup(value.getDestination_ip()));
+        dosEventLog.setDestination_country(IpLookupUtils.getCountryLookup(value.getDestination_ip()));
         String ipList = value.getSource_ip();
         dosEventLog.setSource_ip_list(ipList);
         dosEventLog.setSource_country_list(getSourceCountryList(ipList));
@@ -212,8 +219,8 @@ public class DosDetection extends BroadcastProcessFunction<DosSketchLog,Map<Stri
                         logger.debug("获取到当前IP: {},类型: {} baseline值为0,替换为P95观测值{}", value.getDestination_ip(), value.getAttack_type(), defaultVaule);
                         base = defaultVaule;
                     }
-                    if (sessionRateBaselineType == OTHER_BASELINE_TYPE && base < NacosUtils.getIntProperty("static.sensitivity.threshold")){
-                        base = NacosUtils.getIntProperty("static.sensitivity.threshold");
+                    if (sessionRateBaselineType == OTHER_BASELINE_TYPE && base < FlowWriteConfig.STATIC_SENSITIVITY_THRESHOLD) {
+                        base = FlowWriteConfig.STATIC_SENSITIVITY_THRESHOLD;
                     }
                 }
             }
@@ -223,12 +230,24 @@ public class DosDetection extends BroadcastProcessFunction<DosSketchLog,Map<Stri
         return base;
     }
 
-    private String getConditions(String percent, long base, long sessions, int type, String tag) {
+    private String getConditions(String percent, long base, long sessions, int type, String tag, DosEventLog dosEventLog) {
+        int condition = 0;
+        if ("Minor".equals(dosEventLog.getSeverity())) {
+            condition = 50;
+        } else if ("Warning".equals(dosEventLog.getSeverity())) {
+            condition = 100;
+        } else if ("Major".equals(dosEventLog.getSeverity())) {
+            condition = 250;
+        } else if ("Severe".equals(dosEventLog.getSeverity())) {
+            condition = 500;
+        } else if ("Critical".equals(dosEventLog.getSeverity())) {
+            condition = 800;
+        }
         switch (type) {
             case STATIC_CONDITION_TYPE:
                 return "Rate > " +
                         base + " " +
-                        tag + "/s";
+                        tag + "/s" + "(>" + condition + "%)";
             case BASELINE_CONDITION_TYPE:
                 return tag + " > " +
                         percent + " of baseline";
@@ -248,8 +267,8 @@ public class DosDetection extends BroadcastProcessFunction<DosSketchLog,Map<Stri
                 String[] ipArr = sourceIpList.split(",");
                 HashSet<String> countrySet = new HashSet<>();
                 for (String ip : ipArr) {
-                    String country = IpUtils.ipLookup.countryLookup(ip);
-                    if (StringUtil.isNotBlank(country)){
+                    String country = IpLookupUtils.getCountryLookup(ip);
+                    if (StringUtil.isNotBlank(country)) {
                         countrySet.add(country);
                     }
                 }
@@ -276,28 +295,28 @@ public class DosDetection extends BroadcastProcessFunction<DosSketchLog,Map<Stri
         return index;
     }
 
-    public static void main(String[] args) {
-//        System.out.println(new DosDetection().getSourceCountryList("192.0.2.3,138.199.14.31,255.255.255.255,121.14.89.209," +
-//                "23.200.74.224,161.117.68.253"));
-//        DosDetection dosDetection = new DosDetection();
-//        System.out.println(dosDetection.judgeSeverity(dosDetection.getDiffPercent(499, 1000)));
 
-    }
 
     private Double getDiffPercent(long diff, long base) {
-        return BigDecimal.valueOf((float) diff / base).setScale(4, BigDecimal.ROUND_HALF_UP).doubleValue();
+        try {
+            return BigDecimal.valueOf((float) diff / base).setScale(4, BigDecimal.ROUND_HALF_UP).doubleValue();
+        } catch (Exception e) {
+            logger.info("当前阈值为0,进行下一阈值条件判断", e);
+            return 0.0;
+        }
+
     }
 
     private Severity judgeSeverity(double diffPercent) {
-        if (diffPercent >= NacosUtils.getDoubleProperty("baseline.sessions.minor.threshold") && diffPercent < NacosUtils.getDoubleProperty("baseline.sessions.warning.threshold")) {
+        if (diffPercent >= FlowWriteConfig.BASELINE_SESSIONS_MINOR_THRESHOLD && diffPercent < FlowWriteConfig.BASELINE_SESSIONS_WARNING_THRESHOLD) {
             return Severity.MINOR;
-        } else if (diffPercent >= NacosUtils.getDoubleProperty("baseline.sessions.warning.threshold") && diffPercent < NacosUtils.getDoubleProperty("baseline.sessions.major.threshold")) {
+        } else if (diffPercent >= FlowWriteConfig.BASELINE_SESSIONS_WARNING_THRESHOLD && diffPercent < FlowWriteConfig.BASELINE_SESSIONS_MAJOR_THRESHOLD) {
             return Severity.WARNING;
-        } else if (diffPercent >= NacosUtils.getDoubleProperty("baseline.sessions.major.threshold") && diffPercent < NacosUtils.getDoubleProperty("baseline.sessions.severe.threshold")) {
+        } else if (diffPercent >= FlowWriteConfig.BASELINE_SESSIONS_MAJOR_THRESHOLD && diffPercent < FlowWriteConfig.BASELINE_SESSIONS_SEVERE_THRESHOLD) {
             return Severity.MAJOR;
-        } else if (diffPercent >= NacosUtils.getDoubleProperty("baseline.sessions.severe.threshold") && diffPercent < NacosUtils.getDoubleProperty("baseline.sessions.critical.threshold")) {
+        } else if (diffPercent >= FlowWriteConfig.BASELINE_SESSIONS_SEVERE_THRESHOLD && diffPercent < FlowWriteConfig.BASELINE_SESSIONS_CRITICAL_THRESHOLD) {
             return Severity.SEVERE;
-        } else if (diffPercent >= NacosUtils.getDoubleProperty("baseline.sessions.critical.threshold")) {
+        } else if (diffPercent >= FlowWriteConfig.BASELINE_SESSIONS_CRITICAL_THRESHOLD) {
             return Severity.CRITICAL;
         } else {
             return Severity.NORMAL;

src/main/java/com/zdjizhi/etl/EtlProcessFunction.java

@@ -2,11 +2,11 @@ package com.zdjizhi.etl;
 
 import cn.hutool.log.Log;
 import cn.hutool.log.LogFactory;
-import com.zdjizhi.common.CommonConfig;
+import com.zdjizhi.common.FlowWriteConfig;
 import com.zdjizhi.common.DosSketchLog;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.flink.api.java.tuple.Tuple3;
-import org.apache.flink.api.java.tuple.Tuple6;
+import org.apache.flink.api.java.tuple.Tuple7;
 import org.apache.flink.streaming.api.functions.windowing.ProcessWindowFunction;
 import org.apache.flink.streaming.api.windowing.windows.TimeWindow;
 import org.apache.flink.util.Collector;
@@ -44,7 +44,7 @@ public class EtlProcessFunction extends ProcessWindowFunction<DosSketchLog, DosS
     private DosSketchLog getMiddleResult(Tuple3<String,String,Integer> keys,Iterable<DosSketchLog> elements){
 
         DosSketchLog midResuleLog = new DosSketchLog();
-        Tuple6<Long, Long, Long,String,Long,Long> values = sketchAggregate(elements);
+        Tuple7<Long, Long, Long,String,Long,Long,Long> values = sketchAggregate(elements);
         try {
             if (values != null){
                 midResuleLog.setAttack_type(keys.f0);
@@ -56,6 +56,7 @@ public class EtlProcessFunction extends ProcessWindowFunction<DosSketchLog, DosS
                 midResuleLog.setSketch_sessions(values.f0);
                 midResuleLog.setSketch_packets(values.f1);
                 midResuleLog.setSketch_bytes(values.f2);
+                midResuleLog.setCommon_recv_time(values.f6);
                 return midResuleLog;
             }
         } catch (Exception e){
@@ -64,16 +65,22 @@ public class EtlProcessFunction extends ProcessWindowFunction<DosSketchLog, DosS
         return null;
     }
 
-    private Tuple6<Long, Long, Long,String,Long,Long> sketchAggregate(Iterable<DosSketchLog> elements){
+    private Tuple7<Long, Long, Long,String,Long,Long,Long> sketchAggregate(Iterable<DosSketchLog> elements){
         long sessions = 0;
         long packets = 0 ;
         long bytes = 0;
         long startTime = System.currentTimeMillis()/1000;
         long endTime = System.currentTimeMillis()/1000;
         long duration = 0;
+        long recvtime = 0;
         HashSet<String> sourceIpSet = new HashSet<>();
         try {
             for (DosSketchLog newSketchLog : elements){
+               if (recvtime == 0){
+                   recvtime = newSketchLog.getCommon_recv_time();
+               }else if (recvtime > newSketchLog.getCommon_recv_time()){
+                   recvtime = newSketchLog.getCommon_recv_time();
+               }
                 String sourceIp = newSketchLog.getSource_ip();
                 if (StringUtils.equals(sourceIp,EMPTY_SOURCE_IP_IPV4) || StringUtils.equals(sourceIp,EMPTY_SOURCE_IP_IPV6)){
                     sessions += newSketchLog.getSketch_sessions();
@@ -83,14 +90,15 @@ public class EtlProcessFunction extends ProcessWindowFunction<DosSketchLog, DosS
                     endTime = newSketchLog.getSketch_start_time() > endTime ? newSketchLog.getSketch_start_time() : endTime;
                     duration = endTime - startTime == 0 ? 5 : endTime - startTime;
                 }else {
-                    if (sourceIpSet.size() < CommonConfig.SOURCE_IP_LIST_LIMIT){
+                    if (sourceIpSet.size() < FlowWriteConfig.SOURCE_IP_LIST_LIMIT){
                         sourceIpSet.add(sourceIp);
                     }
                 }
             }
+
             String sourceIpList = StringUtils.join(sourceIpSet, ",");
-            return Tuple6.of(sessions/CommonConfig.FLINK_WINDOW_MAX_TIME,packets/CommonConfig.FLINK_WINDOW_MAX_TIME,
-                    bytes*8/CommonConfig.FLINK_WINDOW_MAX_TIME,sourceIpList,startTime,duration);
+            return Tuple7.of(sessions/ FlowWriteConfig.FLINK_WINDOW_MAX_TIME,packets/ FlowWriteConfig.FLINK_WINDOW_MAX_TIME,
+                    bytes*8/ FlowWriteConfig.FLINK_WINDOW_MAX_TIME,sourceIpList,startTime,duration,recvtime);
         }catch (Exception e){
             logger.error("聚合中间结果集失败 {}",e);
         }

src/main/java/com/zdjizhi/etl/ParseBaselineThreshold.java

@@ -2,9 +2,9 @@ package com.zdjizhi.etl;
 
 import cn.hutool.log.Log;
 import cn.hutool.log.LogFactory;
-import com.zdjizhi.common.CommonConfig;
+import com.geedgenetworks.utils.DateUtils;
+import com.zdjizhi.common.FlowWriteConfig;
 import com.zdjizhi.common.DosBaselineThreshold;
-import com.zdjizhi.utils.DateUtils;
 import com.zdjizhi.utils.HbaseUtils;
 import org.apache.hadoop.hbase.HBaseConfiguration;
 import org.apache.hadoop.hbase.HConstants;
@@ -17,7 +17,7 @@ import java.util.*;
 
 public class ParseBaselineThreshold {
 
-//    private static final Logger logger = LoggerFactory.getLogger(ParseBaselineThreshold.class);
+
     private static final Log logger = LogFactory.get();
     private static ArrayList<String> floodTypeList = new ArrayList<>();
 
@@ -34,21 +34,23 @@ public class ParseBaselineThreshold {
     private static void prepareHbaseEnv() throws IOException {
         org.apache.hadoop.conf.Configuration config = HBaseConfiguration.create();
 
-        config.set("hbase.zookeeper.quorum", CommonConfig.HBASE_ZOOKEEPER_QUORUM);
+        config.set("hbase.zookeeper.quorum", FlowWriteConfig.HBASE_ZOOKEEPER_QUORUM);
         config.set("hbase.client.retries.number", "3");
         config.set("hbase.bulkload.retries.number", "3");
         config.set("zookeeper.recovery.retry", "3");
-        config.setInt(HConstants.HBASE_CLIENT_OPERATION_TIMEOUT, CommonConfig.HBASE_CLIENT_OPERATION_TIMEOUT);
-        config.setInt(HConstants.HBASE_CLIENT_SCANNER_TIMEOUT_PERIOD, CommonConfig.HBASE_CLIENT_SCANNER_TIMEOUT_PERIOD);
+        config.set("hbase.defaults.for.version", "2.2.3");
+        config.set("hbase.defaults.for.version.skip", "true");
+        config.setInt(HConstants.HBASE_CLIENT_OPERATION_TIMEOUT, FlowWriteConfig.HBASE_CLIENT_OPERATION_TIMEOUT);
+        config.setInt(HConstants.HBASE_CLIENT_SCANNER_TIMEOUT_PERIOD, FlowWriteConfig.HBASE_CLIENT_SCANNER_TIMEOUT_PERIOD);
 
-        TableName tableName = TableName.valueOf(CommonConfig.HBASE_BASELINE_TABLE_NAME);
+        TableName tableName = TableName.valueOf(FlowWriteConfig.HBASE_BASELINE_TABLE_NAME);
         Connection conn = ConnectionFactory.createConnection(config);
         table = conn.getTable(tableName);
         long currentTimeMillis = System.currentTimeMillis();
         scan = new Scan()
                 .setAllowPartialResults(true)
-                .setTimeRange(DateUtils.getSomeDate(new Date(currentTimeMillis), Math.negateExact(CommonConfig.HBASE_BASELINE_TTL)).getTime(), currentTimeMillis)
-                .setLimit(CommonConfig.HBASE_BASELINE_TOTAL_NUM);
+                .setTimeRange(DateUtils.getSomeDate(new Date(currentTimeMillis), Math.negateExact(FlowWriteConfig.HBASE_BASELINE_TTL)).getTime(), currentTimeMillis)
+                .setLimit(FlowWriteConfig.HBASE_BASELINE_TOTAL_NUM);
         logger.info("连接hbase成功，正在读取baseline数据");
     }
 
@@ -82,29 +84,4 @@ public class ParseBaselineThreshold {
         }
         return baselineMap;
     }
-
-    public static void main(String[] args) {
-        long currentTimeMillis = System.currentTimeMillis();
-        long p200D = DateUtils.getSomeDate(new Date(currentTimeMillis), Math.negateExact(CommonConfig.HBASE_BASELINE_TTL)).getTime();
-        System.out.println(p200D);
-        System.out.println(currentTimeMillis);
-        System.out.println(currentTimeMillis - p200D);
-
-
-        Map<String, Map<String, DosBaselineThreshold>> baselineMap = readFromHbase();
-        Set<String> keySet = baselineMap.keySet();
-        for (String key : keySet) {
-            Map<String, DosBaselineThreshold> stringTuple2Map = baselineMap.get(key);
-            Set<String> strings = stringTuple2Map.keySet();
-            for (String s:strings){
-                DosBaselineThreshold dosBaselineThreshold = stringTuple2Map.get(s);
-                System.out.println(key+"---"+s+"---"+dosBaselineThreshold);
-            }
-        }
-        System.out.println(baselineMap.size());
-    }
-
-
-
-
 }

src/main/java/com/zdjizhi/etl/ParseSketchLog.java

@@ -1,12 +1,11 @@
 package com.zdjizhi.etl;
 
-import com.fasterxml.jackson.databind.JavaType;
-import com.zdjizhi.common.CommonConfig;
+import com.alibaba.fastjson2.JSONObject;
+import com.geedgenetworks.utils.StringUtil;
+import com.zdjizhi.common.FlowWriteConfig;
 import com.zdjizhi.common.DosSketchLog;
 import com.zdjizhi.source.DosSketchSource;
 import com.zdjizhi.utils.FlinkEnvironmentUtils;
-import com.zdjizhi.utils.JsonMapper;
-import com.zdjizhi.utils.StringUtil;
 import org.apache.flink.api.common.eventtime.WatermarkStrategy;
 import org.apache.flink.api.common.functions.FlatMapFunction;
 import org.apache.flink.streaming.api.datastream.SingleOutputStreamOperator;
@@ -23,22 +22,19 @@ import java.util.*;
 public class ParseSketchLog {
 
     private static Logger logger = LoggerFactory.getLogger(ParseSketchLog.class);
-    private static JsonMapper jsonMapperInstance = JsonMapper.getInstance();
-    private static JavaType hashmapJsonType = jsonMapperInstance.createCollectionType(HashMap.class, String.class, Object.class);
-    private static JavaType listType = jsonMapperInstance.createCollectionType(ArrayList.class, HashMap.class);
 
 
-    public static SingleOutputStreamOperator<DosSketchLog> getSketchSource(){
+    public static SingleOutputStreamOperator<DosSketchLog> getSketchSource() {
         return flatSketchSource().assignTimestampsAndWatermarks(createWatermarkStrategy());
     }
 
-    private static SingleOutputStreamOperator<DosSketchLog> flatSketchSource(){
+    private static SingleOutputStreamOperator<DosSketchLog> flatSketchSource() {
         return DosSketchSource.createDosSketchSource().flatMap(new FlatSketchLog());
     }
 
-    private static WatermarkStrategy<DosSketchLog> createWatermarkStrategy(){
+    private static WatermarkStrategy<DosSketchLog> createWatermarkStrategy() {
         return WatermarkStrategy
-                .<DosSketchLog>forBoundedOutOfOrderness(Duration.ofSeconds(CommonConfig.FLINK_WATERMARK_MAX_ORDERNESS))
+                .<DosSketchLog>forBoundedOutOfOrderness(Duration.ofSeconds(FlowWriteConfig.FLINK_WATERMARK_MAX_ORDERNESS))
                 .withTimestampAssigner((event, timestamp) -> event.getSketch_start_time() * 1000);
     }
 
@@ -46,15 +42,22 @@ public class ParseSketchLog {
         @Override
         public void flatMap(String s, Collector<DosSketchLog> collector) {
             try {
-                if (StringUtil.isNotBlank(s)){
-                    HashMap<String, Object> sketchSource = jsonMapperInstance.fromJson(s, hashmapJsonType);
+                if (StringUtil.isNotBlank(s)) {
+
+                    final long recv_time = System.currentTimeMillis()/1000;
+
+                    HashMap<String, Object> sketchSource = JSONObject.parseObject(s, HashMap.class);
                     long sketchStartTime = Long.parseLong(sketchSource.get("sketch_start_time").toString());
                     long sketchDuration = Long.parseLong(sketchSource.get("sketch_duration").toString());
                     String attackType = sketchSource.get("attack_type").toString();
                     int vsysId = Integer.parseInt(sketchSource.getOrDefault("common_vsys_id", 1).toString());
-                    ArrayList<HashMap<String, Object>> reportIpList = jsonMapperInstance.fromJson(jsonMapperInstance.toJson(sketchSource.get("report_ip_list")), listType);
+                    String report_ip_list = JSONObject.toJSONString(sketchSource.get("report_ip_list"));
+
+                    ArrayList<HashMap<String, Object>> reportIpList = JSONObject.parseObject(report_ip_list, ArrayList.class);
+
                     for (HashMap<String, Object> obj : reportIpList) {
                         DosSketchLog dosSketchLog = new DosSketchLog();
+                        dosSketchLog.setCommon_recv_time(recv_time);
                         dosSketchLog.setSketch_start_time(sketchStartTime);
                         dosSketchLog.setSketch_duration(sketchDuration);
                         dosSketchLog.setAttack_type(attackType);
@@ -70,19 +73,12 @@ public class ParseSketchLog {
                         dosSketchLog.setSketch_packets(sketchPackets);
                         dosSketchLog.setSketch_bytes(sketchBytes);
                         collector.collect(dosSketchLog);
-                        logger.debug("数据解析成功：{}",dosSketchLog.toString());
+                        logger.debug("数据解析成功：{}", dosSketchLog.toString());
                     }
                 }
             } catch (Exception e) {
-                logger.error("数据解析错误：{} \n{}",s,e);
+                logger.error("数据解析错误：{} \n{}", s, e);
             }
         }
     }
-
-
-    public static void main(String[] args) throws Exception {
-        flatSketchSource().print();
-        FlinkEnvironmentUtils.streamExeEnv.execute();
-    }
-
 }

src/main/java/com/zdjizhi/etl/ParseStaticThreshold.java

@@ -2,38 +2,38 @@ package com.zdjizhi.etl;
 
 import cn.hutool.log.Log;
 import cn.hutool.log.LogFactory;
-import com.fasterxml.jackson.databind.JavaType;
-import com.zdjizhi.common.CommonConfig;
+import com.alibaba.fastjson2.JSON;
+import com.alibaba.fastjson2.JSONObject;
+import com.zdjizhi.common.FlowWriteConfig;
 import com.zdjizhi.common.DosDetectionThreshold;
 import com.zdjizhi.common.DosVsysId;
 import com.zdjizhi.utils.HttpClientUtils;
-import com.zdjizhi.utils.JsonMapper;
-import com.zdjizhi.utils.NacosUtils;
 import inet.ipaddr.IPAddress;
 import inet.ipaddr.IPAddressString;
 import org.apache.flink.shaded.guava18.com.google.common.collect.Range;
 import org.apache.flink.shaded.guava18.com.google.common.collect.TreeRangeMap;
+
 import org.apache.http.client.utils.URIBuilder;
 import org.apache.http.message.BasicHeader;
 
+import java.io.BufferedReader;
+import java.io.InputStreamReader;
+import java.io.OutputStream;
+import java.net.HttpURLConnection;
 import java.net.URISyntaxException;
+import java.net.URL;
 import java.util.ArrayList;
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
 
 /**
  * @author wlh
  */
 public class ParseStaticThreshold {
-//    private static Logger logger = LoggerFactory.getLogger(ParseStaticThreshold.class);
     private static final Log logger = LogFactory.get();
     private static String encryptpwd;
 
-    private static JsonMapper jsonMapperInstance = JsonMapper.getInstance();
-    private static JavaType hashmapJsonType = jsonMapperInstance.createCollectionType(HashMap.class, String.class, Object.class);
-    private static JavaType thresholdType = jsonMapperInstance.createCollectionType(ArrayList.class, DosDetectionThreshold.class);
-    private static JavaType vsysIDType = jsonMapperInstance.createCollectionType(ArrayList.class, DosVsysId.class);
-
     static {
         //加载加密登录密码
         encryptpwd = getEncryptpwd();
@@ -45,17 +45,18 @@ public class ParseStaticThreshold {
     private static String getEncryptpwd() {
         String psw = HttpClientUtils.ERROR_MESSAGE;
         try {
-            URIBuilder uriBuilder = new URIBuilder(CommonConfig.BIFANG_SERVER_URI);
+            URIBuilder uriBuilder = new URIBuilder(FlowWriteConfig.BIFANG_SERVER_URI);
             HashMap<String, Object> parms = new HashMap<>();
             parms.put("password", "admin");
-            HttpClientUtils.setUrlWithParams(uriBuilder, CommonConfig.BIFANG_SERVER_ENCRYPTPWD_PATH, parms);
+            HttpClientUtils.setUrlWithParams(uriBuilder, FlowWriteConfig.BIFANG_SERVER_ENCRYPTPWD_PATH, parms);
             String resposeJsonStr = HttpClientUtils.httpGet(uriBuilder.build());
             if (!HttpClientUtils.ERROR_MESSAGE.equals(resposeJsonStr)) {
-                HashMap<String, Object> resposeMap = jsonMapperInstance.fromJson(resposeJsonStr, hashmapJsonType);
+                HashMap<String, Object> resposeMap = JSONObject.parseObject(resposeJsonStr, HashMap.class);
                 boolean success = (boolean) resposeMap.get("success");
                 String msg = resposeMap.get("msg").toString();
+
                 if (success) {
-                    HashMap<String, Object> data = jsonMapperInstance.fromJson(jsonMapperInstance.toJson(resposeMap.get("data")), hashmapJsonType);
+                    HashMap<String, Object> data = JSONObject.parseObject(JSONObject.toJSONString(resposeMap.get("data")), HashMap.class);
                     psw = data.get("encryptpwd").toString();
                 } else {
                     logger.error(msg);
@@ -69,38 +70,6 @@ public class ParseStaticThreshold {
         return psw;
     }
 
-    /**
-     * 登录bifang服务，获取token
-     *
-     * @return token
-     */
-    private static String loginBifangServer() {
-        String token = HttpClientUtils.ERROR_MESSAGE;
-        try {
-            if (!HttpClientUtils.ERROR_MESSAGE.equals(encryptpwd)) {
-                URIBuilder uriBuilder = new URIBuilder(CommonConfig.BIFANG_SERVER_URI);
-                HashMap<String, Object> parms = new HashMap<>();
-                parms.put("username", "admin");
-                parms.put("password", encryptpwd);
-                HttpClientUtils.setUrlWithParams(uriBuilder, CommonConfig.BIFANG_SERVER_LOGIN_PATH, parms);
-                String resposeJsonStr = HttpClientUtils.httpPost(uriBuilder.build(), null);
-                if (!HttpClientUtils.ERROR_MESSAGE.equals(resposeJsonStr)) {
-                    HashMap<String, Object> resposeMap = jsonMapperInstance.fromJson(resposeJsonStr, hashmapJsonType);
-                    boolean success = (boolean) resposeMap.get("success");
-                    String msg = resposeMap.get("msg").toString();
-                    if (success) {
-                        HashMap<String, Object> data = jsonMapperInstance.fromJson(jsonMapperInstance.toJson(resposeMap.get("data")), hashmapJsonType);
-                        token = data.get("token").toString();
-                    } else {
-                        logger.error(msg);
-                    }
-                }
-            }
-        } catch (Exception e) {
-            logger.error("登录失败,未获取到token ", e);
-        }
-        return token;
-    }
 
     /**
      * 获取vsysId配置列表
@@ -110,27 +79,28 @@ public class ParseStaticThreshold {
     private static ArrayList<DosVsysId> getVsysId() {
         ArrayList<DosVsysId> vsysIdList = null;
         try {
-            URIBuilder uriBuilder = new URIBuilder(CommonConfig.BIFANG_SERVER_URI);
+            URIBuilder uriBuilder = new URIBuilder(FlowWriteConfig.BIFANG_SERVER_URI);
             HashMap<String, Object> parms = new HashMap<>();
-            parms.put("pageSize", -1);
-//            parms.put("orderBy", "vsysId desc");
+            parms.put("page_size", -1);
+//           parms.put("orderBy", "vsysId desc");
             parms.put("type", 1);
-            HttpClientUtils.setUrlWithParams(uriBuilder, CommonConfig.BIFANG_SERVER_POLICY_VSYSID_PATH, parms);
-            String token = NacosUtils.getStringProperty("bifang.server.token");
+            HttpClientUtils.setUrlWithParams(uriBuilder, FlowWriteConfig.BIFANG_SERVER_POLICY_VSYSID_PATH, parms);
+            String token = FlowWriteConfig.BIFANG_SERVER_TOKEN;
             if (!HttpClientUtils.ERROR_MESSAGE.equals(token)) {
                 BasicHeader authorization = new BasicHeader("Authorization", token);
                 BasicHeader authorization1 = new BasicHeader("Content-Type", "application/x-www-form-urlencoded");
                 String resposeJsonStr = HttpClientUtils.httpGet(uriBuilder.build(), authorization, authorization1);
                 if (!HttpClientUtils.ERROR_MESSAGE.equals(resposeJsonStr)) {
-                    HashMap<String, Object> resposeMap = jsonMapperInstance.fromJson(resposeJsonStr, hashmapJsonType);
+                    HashMap<String, Object> resposeMap = JSONObject.parseObject(resposeJsonStr, HashMap.class);
                     boolean success = (boolean) resposeMap.get("success");
                     String msg = resposeMap.get("msg").toString();
                     if (success) {
-                        HashMap<String, Object> data = jsonMapperInstance.fromJson(jsonMapperInstance.toJson(resposeMap.get("data")), hashmapJsonType);
-                        Object list = data.get("list");
+                        HashMap<String, Object> data = JSONObject.parseObject(JSONObject.toJSONString(resposeMap.get("data")), HashMap.class);
+                       Object list = data.get("vsys_list");
                         if (list != null) {
-                            vsysIdList = jsonMapperInstance.fromJson(jsonMapperInstance.toJson(list), vsysIDType);
-                            logger.info("获取到vsysId {}条", vsysIdList.size());
+                            List<DosVsysId> dosVsysIds = JSON.parseArray(JSONObject.toJSONString(list), DosVsysId.class);
+                            vsysIdList= (ArrayList)dosVsysIds;
+                          logger.info("获取到vsysId {}条", vsysIdList.size());
                         } else {
                             logger.warn("vsysIdList为空");
                         }
@@ -147,7 +117,6 @@ public class ParseStaticThreshold {
 
     /**
      * 根据vsysId获取静态阈值配置列表
-     *
      * @return thresholds
      */
     private static ArrayList<DosDetectionThreshold> getDosDetectionThreshold() {
@@ -157,30 +126,31 @@ public class ParseStaticThreshold {
             if (vsysIds != null) {
                 for (DosVsysId dosVsysId : vsysIds) {
                     Integer vsysId = dosVsysId.getId() == null ? 1 : dosVsysId.getId();
-                    Integer[] superiorIds = dosVsysId.getSuperiorIds();
-                    URIBuilder uriBuilder = new URIBuilder(CommonConfig.BIFANG_SERVER_URI);
+                    Integer[] superiorIds = dosVsysId.getSuperior_ids();
+                    URIBuilder uriBuilder = new URIBuilder(FlowWriteConfig.BIFANG_SERVER_URI);
                     HashMap<String, Object> parms = new HashMap<>();
-                    parms.put("pageSize", -1);
-                    parms.put("orderBy", "profileId asc");
-                    parms.put("isValid", 1);
-                    parms.put("vsysId", vsysId);
-                    HttpClientUtils.setUrlWithParams(uriBuilder, CommonConfig.BIFANG_SERVER_POLICY_THRESHOLD_PATH, parms);
-                    String token = NacosUtils.getStringProperty("bifang.server.token");
+                    parms.put("page_size", -1);
+//                    parms.put("order_by", "profileId asc");
+                    parms.put("is_valid", 1);
+                    parms.put("vsys_id", vsysId);
+                    HttpClientUtils.setUrlWithParams(uriBuilder, FlowWriteConfig.BIFANG_SERVER_POLICY_THRESHOLD_PATH, parms);
+                    String token = FlowWriteConfig.BIFANG_SERVER_TOKEN;
                     if (!HttpClientUtils.ERROR_MESSAGE.equals(token)) {
                         BasicHeader authorization = new BasicHeader("Authorization", token);
                         BasicHeader authorization1 = new BasicHeader("Content-Type", "application/x-www-form-urlencoded");
                         String resposeJsonStr = HttpClientUtils.httpGet(uriBuilder.build(), authorization, authorization1);
                         if (!HttpClientUtils.ERROR_MESSAGE.equals(resposeJsonStr)) {
-                            HashMap<String, Object> resposeMap = jsonMapperInstance.fromJson(resposeJsonStr, hashmapJsonType);
+                            HashMap<String, Object> resposeMap = JSONObject.parseObject(resposeJsonStr,HashMap.class);
                             boolean success = (boolean) resposeMap.get("success");
                             String msg = resposeMap.get("msg").toString();
                             if (success) {
-                                HashMap<String, Object> data = jsonMapperInstance.fromJson(jsonMapperInstance.toJson(resposeMap.get("data")), hashmapJsonType);
-                                Object list = data.get("list");
+                               HashMap<String, Object> data = JSONObject.parseObject(JSONObject.toJSONString(resposeMap.get("data")), HashMap.class);
+                                Object list = data.get("dos_detections");
                                 if (list != null) {
-                                    ArrayList<DosDetectionThreshold> thresholds = jsonMapperInstance.fromJson(jsonMapperInstance.toJson(list), thresholdType);
+                                   List<DosDetectionThreshold> dosDetectionThresholds = JSON.parseArray(JSONObject.toJSONString(list), DosDetectionThreshold.class);
+                                    ArrayList<DosDetectionThreshold> thresholds = (ArrayList)dosDetectionThresholds;
                                     for (DosDetectionThreshold dosDetectionThreshold : thresholds) {
-                                        dosDetectionThreshold.setSuperiorIds(superiorIds);
+                                        dosDetectionThreshold.setSuperior_ids(superiorIds);
                                         vsysThresholds.add(dosDetectionThreshold);
                                     }
                                     logger.info("获取到vsys id是{}静态阈值配置{}条", vsysId, thresholds.size());
@@ -197,7 +167,6 @@ public class ParseStaticThreshold {
         } catch (Exception e) {
             logger.error("获取静态阈值配置失败,请检查bifang服务或登录配置信息 ", e);
         }
-
         return vsysThresholds;
     }
 
@@ -212,12 +181,16 @@ public class ParseStaticThreshold {
             ArrayList<DosDetectionThreshold> dosDetectionThreshold = getDosDetectionThreshold();
             if (dosDetectionThreshold != null && !dosDetectionThreshold.isEmpty()) {
                 for (DosDetectionThreshold threshold : dosDetectionThreshold) {
-                    String attackType = threshold.getAttackType();
-                    int vsysId = threshold.getVsysId();
+
+                    String attackType = threshold.getAttack_type();
+                    int vsysId = threshold.getVsys_id();
                     HashMap<String, TreeRangeMap<IPAddress, DosDetectionThreshold>> rangeMap = thresholdRangeMap.getOrDefault(vsysId, new HashMap<>());
 
                     TreeRangeMap<IPAddress, DosDetectionThreshold> treeRangeMap = rangeMap.getOrDefault(attackType, TreeRangeMap.create());
-                    ArrayList<String> serverIpList = threshold.getServerIpList();
+
+
+                    ArrayList<String> serverIpList = threshold.getServer_ip_list();
+
                     for (String sip : serverIpList) {
                         IPAddressString ipAddressString = new IPAddressString(sip);
                         if (ipAddressString.isIPAddress()) {
@@ -259,33 +232,51 @@ public class ParseStaticThreshold {
         return thresholdRangeMap;
     }
 
-    public static void main(String[] args) {
-        /*
-        ArrayList<DosDetectionThreshold> dosDetectionThreshold = getDosDetectionThreshold();
-//        dosDetectionThreshold.forEach(System.out::println);
-        getVsysId().forEach(System.out::println);
-        System.out.println("------------------------");
-        */
-        HashMap<Integer, HashMap<String, TreeRangeMap<IPAddress, DosDetectionThreshold>>> staticThreshold = createStaticThreshold();
 
-        System.out.println("------------------------");
 
-        for (Integer integer : staticThreshold.keySet()) {
-            HashMap<String, TreeRangeMap<IPAddress, DosDetectionThreshold>> stringTreeRangeMapHashMap = staticThreshold.get(integer);
-            for (String type : stringTreeRangeMapHashMap.keySet()) {
-                Map<Range<IPAddress>, DosDetectionThreshold> asMapOfRanges = stringTreeRangeMapHashMap.get(type).asMapOfRanges();
-                for (Range<IPAddress> range : asMapOfRanges.keySet()) {
-                    DosDetectionThreshold threshold = asMapOfRanges.get(range);
-                    System.out.println(integer + "---" + type + "---" + range + "---" + threshold);
+    /**
+     * 登录bifang服务，获取token
+     *
+     * @return token
+     */
+    private static String loginBifangServer() {
+        String token = HttpClientUtils.ERROR_MESSAGE;
+        try {
+            final HashMap<String, Object> parmsMap = new HashMap<>();
+            String urlString = FlowWriteConfig.BIFANG_SERVER_URI+FlowWriteConfig.BIFANG_SERVER_LOGIN_PATH;
+            parmsMap.put("username","admin");
+            parmsMap.put("password",encryptpwd);
+            parmsMap.put("auth_mode","");
+            final String jsonInputString = JSON.toJSONString(parmsMap);
+            final URL url = new URL(urlString);
+            final HttpURLConnection connection  = (HttpURLConnection)url.openConnection();
+            connection.setRequestMethod("POST");
+            connection.setRequestProperty("Content-Type", "application/json");
+            connection.setRequestProperty("Accept", "application/json");
+            connection.setDoOutput(true);
+            OutputStream os = connection.getOutputStream();
+            os.write(jsonInputString.getBytes());
+            os.flush();
+            os.close();
+            int responseCode = connection.getResponseCode();
+            if (responseCode == 200 ) {
+                // 读取响应内容
+                BufferedReader reader = new BufferedReader(new InputStreamReader(connection.getInputStream()));
+                String line;
+                StringBuilder response = new StringBuilder();
+                while ((line = reader.readLine()) != null) {
+                    response.append(line);
                 }
-                System.out.println("------------------------");
+                reader.close();
+                HashMap<String, Object> body = JSONObject.parseObject(String.valueOf(response), HashMap.class);
+                final HashMap data = JSONObject.parseObject(String.valueOf( body.get("data")), HashMap.class);
+                token = (String) data.get("token");
             }
-
+        } catch (Exception e) {
+            logger.error("登录失败,未获取到token ", e);
         }
-//        String s = loginBifangServer();
-//        System.out.println(s);
 
+        return token;
     }
 
-
 }

src/main/java/com/zdjizhi/etl/TrafficServerIpMetrics.java

@@ -2,7 +2,7 @@ package com.zdjizhi.etl;
 
 import cn.hutool.log.Log;
 import cn.hutool.log.LogFactory;
-import com.zdjizhi.common.CommonConfig;
+import com.zdjizhi.common.FlowWriteConfig;
 import com.zdjizhi.common.DosMetricsLog;
 import com.zdjizhi.common.DosSketchLog;
 
@@ -26,16 +26,11 @@ class TrafficServerIpMetrics {
     }
 
     private static long timeFloor(long sketchStartTime){
-        return sketchStartTime / CommonConfig.FLINK_WINDOW_MAX_TIME * CommonConfig.FLINK_WINDOW_MAX_TIME;
+        return sketchStartTime / FlowWriteConfig.FLINK_WINDOW_MAX_TIME * FlowWriteConfig.FLINK_WINDOW_MAX_TIME;
     }
 
     private static int getPartitionNumByIp(String destinationIp){
-        return Math.abs(destinationIp.hashCode()) % CommonConfig.DESTINATION_IP_PARTITION_NUM;
-    }
-
-    public static void main(String[] args) {
-        System.out.println(getPartitionNumByIp("146.177.223.43"));
-        System.out.println("146.177.223.43".hashCode());
+        return Math.abs(destinationIp.hashCode()) % FlowWriteConfig.DESTINATION_IP_PARTITION_NUM;
     }
 
 }

src/main/java/com/zdjizhi/sink/DosEventSink.java

@@ -1,8 +1,9 @@
 package com.zdjizhi.sink;
 
-import com.zdjizhi.common.CommonConfig;
+import com.alibaba.fastjson2.JSONObject;
+import com.zdjizhi.common.FlowWriteConfig;
 import com.zdjizhi.common.DosEventLog;
-import com.zdjizhi.utils.JsonMapper;
+//import com.zdjizhi.utils.JsonMapper;
 import com.zdjizhi.utils.KafkaUtils;
 import org.apache.flink.streaming.api.datastream.SingleOutputStreamOperator;
 
@@ -13,9 +14,10 @@ class DosEventSink {
     static void dosEventOutputSink(SingleOutputStreamOperator<DosEventLog> dosEventLogOutputStream){
         dosEventLogOutputStream
                 .filter(Objects::nonNull)
-                .map(JsonMapper::toJsonString)
-                .addSink(KafkaUtils.getKafkaSink(CommonConfig.KAFKA_OUTPUT_EVENT_TOPIC_NAME))
-                .setParallelism(CommonConfig.KAFKA_OUTPUT_EVENT_PARALLELISM);
+//                .map(JsonMapper::toJsonString)
+                .map(JSONObject::toJSONString)
+                .addSink(KafkaUtils.getKafkaSink(FlowWriteConfig.KAFKA_OUTPUT_EVENT_TOPIC_NAME))
+                .setParallelism(FlowWriteConfig.KAFKA_OUTPUT_EVENT_PARALLELISM);
     }
 
 }

src/main/java/com/zdjizhi/sink/OutputStreamSink.java

@@ -2,19 +2,14 @@ package com.zdjizhi.sink;
 
 import cn.hutool.log.Log;
 import cn.hutool.log.LogFactory;
-import com.alibaba.nacos.api.PropertyKeyConst;
-import com.zdjizhi.common.CommonConfig;
+import com.zdjizhi.common.FlowWriteConfig;
 import com.zdjizhi.common.DosEventLog;
 import com.zdjizhi.common.DosMetricsLog;
 import com.zdjizhi.common.DosSketchLog;
 import com.zdjizhi.etl.DosDetection;
 import com.zdjizhi.etl.EtlProcessFunction;
 import com.zdjizhi.etl.ParseSketchLog;
-import com.zdjizhi.source.DosSketchSource;
 import com.zdjizhi.utils.FlinkEnvironmentUtils;
-import org.apache.flink.api.common.state.MapStateDescriptor;
-import org.apache.flink.api.common.typeinfo.TypeInformation;
-import org.apache.flink.api.common.typeinfo.Types;
 import org.apache.flink.api.java.functions.KeySelector;
 import org.apache.flink.api.java.tuple.Tuple3;
 import org.apache.flink.streaming.api.datastream.*;
@@ -22,14 +17,12 @@ import org.apache.flink.streaming.api.windowing.assigners.TumblingEventTimeWindo
 import org.apache.flink.streaming.api.windowing.time.Time;
 import org.apache.flink.util.OutputTag;
 
-import java.util.Map;
-import java.util.Properties;
 
 /**
  * @author 94976
  */
 public class OutputStreamSink {
-//    private static final Logger logger = LoggerFactory.getLogger(OutputStreamSink.class);
+    //    private static final Logger logger = LoggerFactory.getLogger(OutputStreamSink.class);
     private static final Log logger = LogFactory.get();
 
     public static OutputTag<DosMetricsLog> outputTag = new OutputTag<DosMetricsLog>("traffic server ip metrics"){};
@@ -39,44 +32,24 @@ public class OutputStreamSink {
             SingleOutputStreamOperator<DosSketchLog> middleStream = getMiddleStream();
             DosEventSink.dosEventOutputSink(getEventSinkStream(middleStream));
             TrafficServerIpMetricsSink.sideOutputMetricsSink(middleStream);
-            FlinkEnvironmentUtils.streamExeEnv.execute(CommonConfig.STREAM_EXECUTION_JOB_NAME);
+            FlinkEnvironmentUtils.streamExeEnv.execute(FlowWriteConfig.STREAM_EXECUTION_JOB_NAME);
         } catch (Exception e) {
             logger.error("任务启动失败 {}",e);
         }
     }
 
     private static SingleOutputStreamOperator<DosEventLog> getEventSinkStream(SingleOutputStreamOperator<DosSketchLog> middleStream){
-        DataStreamSource<Map<String, byte[]>> broadcastSource=null;
-        Properties nacosProperties = new Properties();
-
-        nacosProperties.put(PropertyKeyConst.SERVER_ADDR,CommonConfig.NACOS_SERVER_ADDR);
-        nacosProperties.setProperty(PropertyKeyConst.USERNAME, CommonConfig.NACOS_USERNAME);
-        nacosProperties.setProperty(PropertyKeyConst.PASSWORD, CommonConfig.NACOS_PASSWORD);
-        nacosProperties.setProperty(PropertyKeyConst.NAMESPACE, CommonConfig.NACOS_NAMESPACE);
-
-        if ("CLUSTER".equals(CommonConfig.CLUSTER_OR_SINGLE)){
-            broadcastSource = DosSketchSource.broadcastSource(nacosProperties,CommonConfig.HDFS_PATH);
-        }else {
-            broadcastSource= DosSketchSource.singleBroadcastSource(nacosProperties);
-        }
-
-        MapStateDescriptor<String,Map> descriptor =
-                new MapStateDescriptor<>("descriptorTest", Types.STRING, TypeInformation.of(Map.class));
-
-        BroadcastStream<Map<String, byte[]>> broadcast = broadcastSource.broadcast(descriptor);
-
         return middleStream
-                .connect(broadcast)
-                .process(new DosDetection()).setParallelism(CommonConfig.FLINK_DETECTION_MAP_PARALLELISM);
+                .process(new DosDetection()).setParallelism(FlowWriteConfig.FLINK_DETECTION_MAP_PARALLELISM);
 
     }
 
     private static SingleOutputStreamOperator<DosSketchLog> getMiddleStream(){
         return ParseSketchLog.getSketchSource()
                 .keyBy(new KeysSelector())
-                .window(TumblingEventTimeWindows.of(Time.seconds(CommonConfig.FLINK_WINDOW_MAX_TIME)))
+                .window(TumblingEventTimeWindows.of(Time.seconds(FlowWriteConfig.FLINK_WINDOW_MAX_TIME)))
                 .process(new EtlProcessFunction())
-                .setParallelism(CommonConfig.FLINK_FIRST_AGG_PARALLELISM);
+                .setParallelism(FlowWriteConfig.FLINK_FIRST_AGG_PARALLELISM);
     }
 
     private static class KeysSelector implements KeySelector<DosSketchLog, Tuple3<String, String, Integer>>{

src/main/java/com/zdjizhi/sink/TrafficServerIpMetricsSink.java

@@ -1,9 +1,10 @@
 package com.zdjizhi.sink;
 
-import com.zdjizhi.common.CommonConfig;
+import com.alibaba.fastjson2.JSONObject;
+import com.zdjizhi.common.FlowWriteConfig;
 import com.zdjizhi.common.DosMetricsLog;
 import com.zdjizhi.common.DosSketchLog;
-import com.zdjizhi.utils.JsonMapper;
+
 import com.zdjizhi.utils.KafkaUtils;
 import org.apache.flink.streaming.api.datastream.DataStream;
 import org.apache.flink.streaming.api.datastream.SingleOutputStreamOperator;
@@ -14,10 +15,9 @@ class TrafficServerIpMetricsSink {
 
     static void sideOutputMetricsSink(SingleOutputStreamOperator<DosSketchLog> outputStream){
         DataStream<DosMetricsLog> sideOutput = outputStream.getSideOutput(outputTag);
-        sideOutput.map(JsonMapper::toJsonString).addSink(KafkaUtils.getKafkaSink(CommonConfig.KAFKA_OUTPUT_METRIC_TOPIC_NAME))
-                .setParallelism(CommonConfig.KAFKA_OUTPUT_METRIC_PARALLELISM);
-
-
+//        sideOutput.map(JsonMapper::toJsonString).addSink(KafkaUtils.getKafkaSink(CommonConfig.KAFKA_OUTPUT_METRIC_TOPIC_NAME))
+        sideOutput.map(JSONObject::toJSONString).addSink(KafkaUtils.getKafkaSink(FlowWriteConfig.KAFKA_OUTPUT_METRIC_TOPIC_NAME))
+                .setParallelism(FlowWriteConfig.KAFKA_OUTPUT_METRIC_PARALLELISM);
 
 
     }

src/main/java/com/zdjizhi/source/DosSketchSource.java

@@ -1,15 +1,14 @@
 package com.zdjizhi.source;
 
-import com.zdjizhi.common.CommonConfig;
-import com.zdjizhi.common.CustomFile;
+
+
+import com.zdjizhi.common.FlowWriteConfig;
 import com.zdjizhi.utils.FlinkEnvironmentUtils;
 import org.apache.flink.api.common.serialization.SimpleStringSchema;
 import org.apache.flink.streaming.api.datastream.DataStreamSource;
 import org.apache.flink.streaming.api.environment.StreamExecutionEnvironment;
 import org.apache.flink.streaming.connectors.kafka.FlinkKafkaConsumer;
 
-import java.util.List;
-import java.util.Map;
 import java.util.Properties;
 
 /**
@@ -21,26 +20,18 @@ public class DosSketchSource {
 
     public static DataStreamSource<String> createDosSketchSource(){
         Properties properties = new Properties();
-        properties.setProperty("bootstrap.servers", CommonConfig.KAFKA_INPUT_BOOTSTRAP_SERVERS);
-        properties.setProperty("group.id", CommonConfig.KAFKA_GROUP_ID);
-        if (CommonConfig.SASL_JAAS_CONFIG_FLAG == 1){
+        properties.setProperty("bootstrap.servers", FlowWriteConfig.KAFKA_INPUT_BOOTSTRAP_SERVERS);
+        properties.setProperty("group.id", FlowWriteConfig.KAFKA_GROUP_ID);
+        if (FlowWriteConfig.SASL_JAAS_CONFIG_FLAG == 1){
             properties.put("security.protocol", "SASL_PLAINTEXT");
             properties.put("sasl.mechanism", "PLAIN");
-            properties.put("sasl.jaas.config", "org.apache.kafka.common.security.plain.PlainLoginModule required username=\""+CommonConfig.SASL_JAAS_CONFIG_USER+"\" password=\""+CommonConfig.SASL_JAAS_CONFIG_PASSWORD+"\";");
+            properties.put("sasl.jaas.config", "org.apache.kafka.common.security.plain.PlainLoginModule required username=\""+ FlowWriteConfig.SASL_JAAS_CONFIG_USER+"\" password=\""+ FlowWriteConfig.SASL_JAAS_CONFIG_PASSWORD+"\";");
         }
 
         return streamExeEnv.addSource(new FlinkKafkaConsumer<String>(
-                CommonConfig.KAFKA_INPUT_TOPIC_NAME,
+                FlowWriteConfig.KAFKA_INPUT_TOPIC_NAME,
                 new SimpleStringSchema(), properties))
-                .setParallelism(CommonConfig.KAFKA_INPUT_PARALLELISM);
+                .setParallelism(FlowWriteConfig.KAFKA_INPUT_PARALLELISM);
     }
 
-
-    public static DataStreamSource<Map<String, byte[]>> broadcastSource(Properties nacosProperties, String STORE_PATH){
-        return streamExeEnv.addSource(new HttpSource(nacosProperties, CommonConfig.NACOS_DATA_ID, CommonConfig.NACOS_GROUP, CommonConfig.NACOS_READ_TIMEOUT,STORE_PATH));
-    }
-
-    public static DataStreamSource<Map<String, byte[]>> singleBroadcastSource(Properties nacosProperties){
-        return streamExeEnv.addSource(new SingleHttpSource(nacosProperties, CommonConfig.NACOS_DATA_ID, CommonConfig.NACOS_GROUP, CommonConfig.NACOS_READ_TIMEOUT));
-    }
 }

src/main/java/com/zdjizhi/source/HttpSource.java

@@ -1,182 +0,0 @@
-package com.zdjizhi.source;
-
-import cn.hutool.core.io.FileUtil;
-import cn.hutool.core.io.IoUtil;
-import cn.hutool.json.JSONObject;
-import com.alibaba.nacos.api.NacosFactory;
-import com.alibaba.nacos.api.PropertyKeyConst;
-import com.alibaba.nacos.api.config.ConfigService;
-import com.alibaba.nacos.api.config.listener.Listener;
-import com.fasterxml.jackson.databind.JavaType;
-import com.google.common.base.Joiner;
-import com.jayway.jsonpath.JsonPath;
-import com.zdjizhi.common.CommonConfig;
-import com.zdjizhi.common.CustomFile;
-import com.zdjizhi.common.KnowledgeLog;
-import com.zdjizhi.utils.*;
-import org.apache.commons.io.IOUtils;
-import org.apache.flink.configuration.Configuration;
-import org.apache.http.Header;
-import org.apache.http.message.BasicHeader;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.*;
-import java.text.SimpleDateFormat;
-import java.util.*;
-import java.util.concurrent.Executor;
-
-
-public class HttpSource extends RichHttpSourceFunction<Map<String, byte[]>> {
-
-    private static final Logger logger = LoggerFactory.getLogger(HttpSource.class);
-
-    private static final String EXPR = "$.[?(@.version=='latest' && @.name in ['ip_v4_built_in','ip_v6_built_in','ip_v4_user_defined','ip_v6_user_defined'])].['name','sha256','format','path']";
-
-    //连接nacos的配置
-    private Properties nacosProperties;
-
-    //nacos data id
-    private String NACOS_DATA_ID;
-
-    //nacos group
-    private String NACOS_GROUP;
-
-    //nacos 连接超时时间
-    private long NACOS_READ_TIMEOUT;
-
-    //上传到hdfs的路径
-    private String STORE_PATH;
-
-    private ConfigService configService;
-
-//    private static JsonMapper jsonMapperInstance = JsonMapper.getInstance();
-//    private static JavaType listType = jsonMapperInstance.createCollectionType(List.class, KnowledgeLog.class);
-    private static Map<String, String> updateMap = new HashMap<>();
-    private static HashMap<String, byte[]> knowledgeFileCache;
-    private boolean isRunning = true;
-
-
-    public HttpSource(Properties nacosProperties, String NACOS_DATA_ID, String NACOS_GROUP, long NACOS_READ_TIMEOUT, String storePath) {
-        this.nacosProperties = nacosProperties;
-        this.NACOS_DATA_ID = NACOS_DATA_ID;
-        this.NACOS_GROUP = NACOS_GROUP;
-        this.NACOS_READ_TIMEOUT = NACOS_READ_TIMEOUT;
-        this.STORE_PATH = storePath;
-    }
-
-    @Override
-    public void open(Configuration parameters) throws Exception {
-        super.open(parameters);
-        //初始化元数据缓存
-        updateMap = new HashMap<>(16);
-        //初始化定位库缓存
-        knowledgeFileCache = new HashMap<>(16);
-        logger.info("连接nacos：" + nacosProperties.getProperty(PropertyKeyConst.SERVER_ADDR));
-        configService = NacosFactory.createConfigService(nacosProperties);
-    }
-    @Override
-    public void run(SourceContext ctx) throws Exception {
-//        ctx.emitWatermark(new Watermark(Long.MAX_VALUE));
-        String config = configService.getConfig(NACOS_DATA_ID, NACOS_GROUP, NACOS_READ_TIMEOUT);
-        SimpleDateFormat formatter = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
-        String format = formatter.format(new Date());
-        logger.info(format + "receive config from nacos:" + config);
-        System.out.println(format + "receive config from nacos:" + config);
-        if (StringUtil.isNotBlank(config)) {
-            ArrayList<Object> metaList = JsonPath.parse(config).read(EXPR);
-            loadKnowledge(metaList);
-        }
-
-
-        configService.addListener(NACOS_DATA_ID, NACOS_GROUP, new Listener() {
-            @Override
-            public Executor getExecutor() {
-                return null;
-            }
-
-            @Override
-            public void receiveConfigInfo(String configMsg) {
-                try {
-                    logger.info("receive update config:" + configMsg);
-                    if (StringUtil.isNotBlank(configMsg)) {
-                        ArrayList<Object> metaList = JsonPath.parse(configMsg).read(EXPR);
-                        if (metaList.size() >= 1) {
-                            for (Object metadata : metaList) {
-                                JSONObject knowledgeJson = new JSONObject(metadata, false, true);
-                                String fileName = Joiner.on(CommonConfig.LOCATION_SEPARATOR).useForNull("").join(knowledgeJson.getStr("name"),
-                                        knowledgeJson.getStr("format"));
-                                String sha256 = knowledgeJson.getStr("sha256");
-                                String filePath = knowledgeJson.getStr("path");
-                                if (!sha256.equals(updateMap.get(fileName))) {
-                                    updateMap.put(fileName, sha256);
-                                    updateKnowledge(fileName, filePath);
-                                }
-
-                            }
-                            ctx.collect(knowledgeFileCache);
-                        }
-                    }
-
-                } catch (Exception e) {
-                    logger.error("监听nacos配置失败", e);
-                }
-                System.out.println(configMsg);
-            }
-        });
-
-        while (isRunning) {
-            Thread.sleep(10000);
-        }
-
-    }
-
-    private void loadKnowledge(ArrayList<Object> metaList) {
-        InputStream inputStream = null;
-        try {
-            if (metaList.size() >= 1) {
-                for (Object metadata : metaList) {
-                    JSONObject knowledgeJson = new JSONObject(metadata, false, true);
-                    String fileName = Joiner.on(CommonConfig.LOCATION_SEPARATOR).useForNull("").join(knowledgeJson.getStr("name"),
-                            knowledgeJson.getStr("format"));
-                    String sha256 = knowledgeJson.getStr("sha256");
-                    String filePath = knowledgeJson.getStr("path");
-                    Header header = new BasicHeader("token", CommonConfig.HOS_TOKEN);
-                    HttpClientUtils2 httpClientUtils = new HttpClientUtils2();
-                    inputStream = httpClientUtils.httpGetInputStream(filePath, 3000, header);
-                    updateMap.put(fileName, sha256);
-                    knowledgeFileCache.put(fileName, IOUtils.toByteArray(inputStream));
-                }
-            }
-        } catch (IOException ioException) {
-            ioException.printStackTrace();
-        } finally {
-            IOUtils.closeQuietly(inputStream);
-        }
-    }
-
-
-    private void updateKnowledge(String fileName, String filePath) {
-        InputStream inputStream = null;
-        FileOutputStream outputStream = null;
-        try {
-            Header header = new BasicHeader("token", CommonConfig.HOS_TOKEN);
-            HttpClientUtils2 httpClientUtils = new HttpClientUtils2();
-            inputStream = httpClientUtils.httpGetInputStream(filePath, 3000, header);
-            byte[] bytes = IOUtils.toByteArray(inputStream);
-            HdfsUtils.uploadFileByBytes(CommonConfig.HDFS_PATH + fileName, bytes);
-            knowledgeFileCache.put(fileName, bytes);
-        } catch (IOException ioException) {
-            ioException.printStackTrace();
-        } finally {
-            IOUtils.closeQuietly(inputStream);
-            IOUtils.closeQuietly(outputStream);
-        }
-    }
-    @Override
-    public void cancel() {
-        this.isRunning = false;
-    }
-
-
-}

src/main/java/com/zdjizhi/source/HttpSourceFunction.java

@@ -1,6 +0,0 @@
-package com.zdjizhi.source;
-
-import org.apache.flink.streaming.api.functions.source.SourceFunction;
-
-public interface HttpSourceFunction<OUT> extends SourceFunction<OUT> {
-}

src/main/java/com/zdjizhi/source/RichHttpSourceFunction.java

@@ -1,10 +0,0 @@
-package com.zdjizhi.source;
-
-import org.apache.flink.api.common.functions.AbstractRichFunction;
-
-public abstract class RichHttpSourceFunction<OUT> extends AbstractRichFunction implements HttpSourceFunction<OUT> {
-    private static final long serialVersionUID = 1L;
-
-    public RichHttpSourceFunction() {
-    }
-}

src/main/java/com/zdjizhi/source/SingleHttpSource.java

@@ -1,217 +0,0 @@
-package com.zdjizhi.source;
-
-import cn.hutool.core.io.FileUtil;
-import cn.hutool.core.io.IoUtil;
-import cn.hutool.json.JSONObject;
-import com.alibaba.nacos.api.NacosFactory;
-import com.alibaba.nacos.api.PropertyKeyConst;
-import com.alibaba.nacos.api.config.ConfigService;
-import com.alibaba.nacos.api.config.listener.Listener;
-import com.fasterxml.jackson.databind.JavaType;
-import com.google.common.base.Joiner;
-import com.jayway.jsonpath.JsonPath;
-import com.zdjizhi.common.CommonConfig;
-import com.zdjizhi.common.CustomFile;
-import com.zdjizhi.common.KnowledgeLog;
-import com.zdjizhi.utils.*;
-import org.apache.commons.io.IOUtils;
-import org.apache.flink.configuration.Configuration;
-import org.apache.flink.streaming.api.watermark.Watermark;
-import org.apache.http.Header;
-import org.apache.http.message.BasicHeader;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.*;
-import java.util.*;
-import java.util.concurrent.Executor;
-
-public class SingleHttpSource extends RichHttpSourceFunction<Map<String, byte[]>> {
-
-    private static final Logger logger = LoggerFactory.getLogger(SingleHttpSource.class);
-    private static HashMap<String, byte[]> knowledgeFileCache;
-
-    private Properties nacosProperties;
-
-    private String NACOS_DATA_ID;
-
-    private String NACOS_GROUP;
-
-    private long NACOS_READ_TIMEOUT;
-
-    private static String STORE_PATH;
-
-    private ConfigService configService;
-
-//    private static JsonMapper jsonMapperInstance = JsonMapper.getInstance();
-//    private static JavaType listType = jsonMapperInstance.createCollectionType(List.class, KnowledgeLog.class);
-    private static final String EXPR = "$.[?(@.version=='latest' && @.name in ['ip_v4_built_in','ip_v6_built_in','ip_v4_user_defined','ip_v6_user_defined'])].['name','sha256','format','path']";
-
-
-    private static Map<String, String> updateMap = new HashMap<>();
-
-    private boolean isRunning = true;
-
-
-    public SingleHttpSource(Properties nacosProperties, String NACOS_DATA_ID, String NACOS_GROUP, long NACOS_READ_TIMEOUT) {
-        this.nacosProperties = nacosProperties;
-        this.NACOS_DATA_ID = NACOS_DATA_ID;
-        this.NACOS_GROUP = NACOS_GROUP;
-        this.NACOS_READ_TIMEOUT = NACOS_READ_TIMEOUT;
-    }
-
-
-
-    @Override
-    public void open(Configuration parameters) throws Exception {
-        super.open(parameters);
-        logger.info("连接nacos：" + nacosProperties.getProperty(PropertyKeyConst.SERVER_ADDR));
-        configService = NacosFactory.createConfigService(nacosProperties);
-        //初始化元数据缓存
-        updateMap = new HashMap<>(16);
-        //初始化定位库缓存
-        knowledgeFileCache = new HashMap<>(16);
-    }
-
-    @Override
-    public void run(SourceContext ctx) throws Exception {
-//        ctx.emitWatermark(new Watermark(Long.MAX_VALUE));
-        String config = configService.getConfig(NACOS_DATA_ID, NACOS_GROUP, NACOS_READ_TIMEOUT);
-//        List<CustomFile> customFiles = new ArrayList<>();
-        if (StringUtil.isNotBlank(config)) {
-            ArrayList<Object> metaList = JsonPath.parse(config).read(EXPR);
-            loadKnowledge(metaList);
-        }
-//        if (StringUtil.isNotBlank(config)) {
-//            List<KnowledgeLog> knowledgeLogListList = jsonMapperInstance.fromJson(config, listType);
-//            if (knowledgeLogListList.size()>=1){
-//                for (KnowledgeLog knowledgeLog : knowledgeLogListList) {
-//                    String name = knowledgeLog.getName().concat(".").concat(knowledgeLog.getFormat());
-//                    String sha256 = knowledgeLog.getSha256();
-//                    updateMap.put(name,sha256);
-//                }
-//            }
-//        }
-
-        configService.addListener(NACOS_DATA_ID, NACOS_GROUP, new Listener() {
-            @Override
-            public Executor getExecutor() {
-                return null;
-            }
-
-            @Override
-            public void receiveConfigInfo(String configMsg) {
-                try {
-                    logger.info("receive update config:" + configMsg);
-                    if (StringUtil.isNotBlank(configMsg)) {
-                        ArrayList<Object> metaList = JsonPath.parse(configMsg).read(EXPR);
-                        if (metaList.size() >= 1) {
-                            for (Object metadata : metaList) {
-                                JSONObject knowledgeJson = new JSONObject(metadata, false, true);
-                                String fileName = Joiner.on(CommonConfig.LOCATION_SEPARATOR).useForNull("").join(knowledgeJson.getStr("name"),
-                                        knowledgeJson.getStr("format"));
-                                String sha256 = knowledgeJson.getStr("sha256");
-                                String filePath = knowledgeJson.getStr("path");
-                                if (!sha256.equals(updateMap.get(fileName))) {
-                                    updateMap.put(fileName, sha256);
-                                    updateKnowledge(fileName, filePath);
-                                }
-
-                            }
-                            ctx.collect(knowledgeFileCache);
-                        }
-                    }
-
-                } catch (Exception e) {
-                    logger.error("监听nacos配置失败", e);
-                }
-                System.out.println(configMsg);
-            }
-        });
-
-        while (isRunning) {
-            Thread.sleep(10000);
-        }
-
-
-
-    }
-
-//    private CustomFile loadKnowledge(String fileName, String filePath) {
-//        InputStream inputStream = null;
-//        FileOutputStream outputStream = null;
-//        CustomFile customFile = new CustomFile();
-//        try {
-//            customFile.setFileName(fileName);
-//            Header header = new BasicHeader("token", CommonConfig.HOS_TOKEN);
-//            HttpClientUtils2 httpClientUtils = new HttpClientUtils2();
-//            inputStream = httpClientUtils.httpGetInputStream(filePath, 3000, header);
-//            FileUtil.mkdir(CommonConfig.DOWNLOAD_PATH);
-//            File file = new File(CommonConfig.DOWNLOAD_PATH.concat(File.separator).concat(fileName));
-//            outputStream = new FileOutputStream(file);
-//            byte[] bytes = IOUtils.toByteArray(inputStream);
-//            customFile.setContent(bytes);
-//            inputStream = new ByteArrayInputStream(customFile.getContent());
-//            IoUtil.copy(inputStream, outputStream);
-//
-//        } catch (IOException ioException) {
-//            ioException.printStackTrace();
-//        } finally {
-//            IOUtils.closeQuietly(inputStream);
-//            IOUtils.closeQuietly(outputStream);
-//        }
-//        return customFile;
-//    }
-private void loadKnowledge(ArrayList<Object> metaList) {
-    InputStream inputStream = null;
-    try {
-        if (metaList.size() >= 1) {
-            for (Object metadata : metaList) {
-                JSONObject knowledgeJson = new JSONObject(metadata, false, true);
-                String fileName = Joiner.on(CommonConfig.LOCATION_SEPARATOR).useForNull("").join(knowledgeJson.getStr("name"),
-                        knowledgeJson.getStr("format"));
-                String sha256 = knowledgeJson.getStr("sha256");
-                String filePath = knowledgeJson.getStr("path");
-                Header header = new BasicHeader("token", CommonConfig.HOS_TOKEN);
-                HttpClientUtils2 httpClientUtils = new HttpClientUtils2();
-                inputStream = httpClientUtils.httpGetInputStream(filePath, 3000, header);
-                updateMap.put(fileName, sha256);
-                knowledgeFileCache.put(fileName, IOUtils.toByteArray(inputStream));
-            }
-        }
-    } catch (IOException ioException) {
-        ioException.printStackTrace();
-    } finally {
-        IOUtils.closeQuietly(inputStream);
-    }
-}
-
-
-    private void updateKnowledge(String fileName, String filePath) {
-        InputStream inputStream = null;
-        FileOutputStream outputStream = null;
-        try {
-            Header header = new BasicHeader("token", CommonConfig.HOS_TOKEN);
-            HttpClientUtils2 httpClientUtils = new HttpClientUtils2();
-            inputStream = httpClientUtils.httpGetInputStream(filePath, 3000, header);
-            FileUtil.mkdir(CommonConfig.DOWNLOAD_PATH);
-            File file = new File(CommonConfig.DOWNLOAD_PATH.concat(File.separator).concat(fileName));
-            outputStream = new FileOutputStream(file);
-            byte[] bytes = IOUtils.toByteArray(inputStream);
-            knowledgeFileCache.put(fileName, bytes);
-            inputStream=new ByteArrayInputStream(bytes);
-            IoUtil.copy(inputStream, outputStream);
-        } catch (IOException ioException) {
-            ioException.printStackTrace();
-        } finally {
-            IOUtils.closeQuietly(inputStream);
-            IOUtils.closeQuietly(outputStream);
-        }
-    }
-
-    @Override
-    public void cancel() {
-        this.isRunning = false;
-    }
-}
-

src/main/java/com/zdjizhi/utils/CollectionUtils.java

@@ -1,23 +0,0 @@
-package com.zdjizhi.utils;
-
-import java.util.Collection;
-import java.util.HashSet;
-
-/**
- * @author wlh
- * 扩展集合处理工具
- */
-public class CollectionUtils {
-
-    public static<T> Collection<T> takeUniqueLimit(Collection<T> collection, int limit){
-        int i =0;
-        Collection<T> newSet = new HashSet<>();
-        for (T t:collection){
-            if (i < limit){
-                newSet.add(t);
-                i += 1;
-            }
-        }
-        return newSet;
-    }
-}

src/main/java/com/zdjizhi/utils/FileByteUtils.java

@@ -1,24 +0,0 @@
-package com.zdjizhi.utils;
-
-import java.io.ByteArrayOutputStream;
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.IOException;
-
-public class FileByteUtils {
-
-    public static byte[] getFileBytes (String filePath) throws IOException {
-        File file = new File(filePath);
-        FileInputStream fis = new FileInputStream(file);
-        ByteArrayOutputStream bos = new ByteArrayOutputStream(1024);
-        byte[] b = new byte[1024];
-        int n;
-        while ((n = fis.read(b)) != -1) {
-            bos.write(b, 0, n);
-        }
-        fis.close();
-        byte[] data = bos.toByteArray();
-        bos.close();
-        return data;
-    }
-}

src/main/java/com/zdjizhi/utils/FlinkEnvironmentUtils.java

@@ -1,8 +1,6 @@
 package com.zdjizhi.utils;
 
-import com.zdjizhi.common.CommonConfig;
-import org.apache.flink.streaming.api.CheckpointingMode;
-import org.apache.flink.streaming.api.environment.CheckpointConfig;
+import com.zdjizhi.common.FlowWriteConfig;
 import org.apache.flink.streaming.api.environment.StreamExecutionEnvironment;
 
 
@@ -13,7 +11,7 @@ public class FlinkEnvironmentUtils {
     public static StreamExecutionEnvironment streamExeEnv = StreamExecutionEnvironment.getExecutionEnvironment();
 
     static {
-        streamExeEnv.setParallelism(CommonConfig.STREAM_EXECUTION_ENVIRONMENT_PARALLELISM);
+        streamExeEnv.setParallelism(FlowWriteConfig.STREAM_EXECUTION_ENVIRONMENT_PARALLELISM);
 
         /*
         // 每 1000ms 开始一次 checkpoint

src/main/java/com/zdjizhi/utils/HdfsUtils.java

@@ -1,75 +0,0 @@
-package com.zdjizhi.utils;
-import cn.hutool.log.Log;
-import cn.hutool.log.LogFactory;
-import com.zdjizhi.common.CommonConfig;
-import org.apache.hadoop.conf.Configuration;
-import org.apache.hadoop.fs.FSDataInputStream;
-import org.apache.hadoop.fs.FSDataOutputStream;
-import org.apache.hadoop.fs.FileSystem;
-import org.apache.hadoop.fs.Path;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.IOException;
-import java.net.URI;
-import java.net.URISyntaxException;
-
-public class HdfsUtils {
-
-    private static final Log logger = LogFactory.get();
-    private static FileSystem fileSystem;
-
-    static {
-        Configuration configuration = new Configuration();
-        try {
-            //配置hdfs相关信息
-            configuration.set("fs.defaultFS","hdfs://ns1");
-            configuration.set("hadoop.proxyuser.root.hosts","*");
-            configuration.set("hadoop.proxyuser.root.groups","*");
-            configuration.set("ha.zookeeper.quorum", CommonConfig.HBASE_ZOOKEEPER_QUORUM);
-            configuration.set("dfs.nameservices","ns1");
-            configuration.set("dfs.ha.namenodes.ns1","nn1,nn2");
-            configuration.set("dfs.namenode.rpc-address.ns1.nn1",CommonConfig.HDFS_URI_NS1);
-            configuration.set("dfs.namenode.rpc-address.ns1.nn2",CommonConfig.HDFS_URI_NS2);
-            configuration.set("dfs.client.failover.proxy.provider.ns1","org.apache.hadoop.hdfs.server.namenode.ha.ConfiguredFailoverProxyProvider");
-            //指定用户
-            System.setProperty("HADOOP_USER_NAME", CommonConfig.HDFS_USER);
-            //创建fileSystem,用于连接hdfs
-            fileSystem = FileSystem.get(configuration);
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-    public static boolean isExists(String filePath) throws IOException {
-        return fileSystem.exists(new Path(filePath));
-    }
-
-    public static byte[] getFileBytes(String filePath) throws IOException {
-        try (FSDataInputStream open = fileSystem.open(new Path(filePath))) {
-            byte[] bytes = new byte[open.available()];
-            open.read(0, bytes, 0, open.available());
-            return bytes;
-        } catch (IOException e) {
-            logger.error("An I/O exception when files are download from HDFS. Message is :" + e.getMessage());
-        }
-        return null;
-    }
-
-    public static void uploadFileByBytes(String filePath,byte[] bytes) throws IOException {
-        try (FSDataOutputStream fsDataOutputStream = fileSystem.create(new Path(filePath), true)) {
-            fsDataOutputStream.write(bytes);
-//            fsDataOutputStream.flush();
-        } catch (RuntimeException e) {
-            logger.error("Uploading files to the HDFS is abnormal. Message is :" + e.getMessage());
-        } catch (IOException e) {
-            logger.error("An I/O exception when files are uploaded to HDFS. Message is :" + e.getMessage());
-        }
-    }
-
-    public static void rename(String src, String dst) throws IOException {
-        fileSystem.rename(new Path(src),new Path(dst));
-    }
-
-
-}

src/main/java/com/zdjizhi/utils/HttpClientUtils.java

@@ -2,12 +2,16 @@ package com.zdjizhi.utils;
 
 import cn.hutool.log.Log;
 import cn.hutool.log.LogFactory;
-import com.zdjizhi.common.CommonConfig;
+import com.geedgenetworks.utils.StringUtil;
+
+import com.zdjizhi.common.FlowWriteConfig;
 import org.apache.http.*;
 import org.apache.http.client.ClientProtocolException;
 import org.apache.http.client.HttpRequestRetryHandler;
 import org.apache.http.client.config.RequestConfig;
-import org.apache.http.client.methods.*;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpGet;
+import org.apache.http.client.methods.HttpPost;
 import org.apache.http.client.protocol.HttpClientContext;
 import org.apache.http.client.utils.URIBuilder;
 import org.apache.http.conn.ConnectTimeoutException;
@@ -48,9 +52,9 @@ public class HttpClientUtils {
     static {
 
         // 设置最大连接数
-        CONN_MANAGER.setMaxTotal(CommonConfig.HTTP_POOL_MAX_CONNECTION);
+        CONN_MANAGER.setMaxTotal(FlowWriteConfig.HTTP_POOL_MAX_CONNECTION);
         // 设置每个连接的路由数
-        CONN_MANAGER.setDefaultMaxPerRoute(CommonConfig.HTTP_POOL_MAX_PER_ROUTE);
+        CONN_MANAGER.setDefaultMaxPerRoute(FlowWriteConfig.HTTP_POOL_MAX_PER_ROUTE);
 
     }
 
@@ -62,11 +66,11 @@ public class HttpClientUtils {
         // 创建Http请求配置参数
         RequestConfig requestConfig = RequestConfig.custom()
                 // 获取连接超时时间
-                .setConnectionRequestTimeout(CommonConfig.HTTP_POOL_REQUEST_TIMEOUT)
+                .setConnectionRequestTimeout(FlowWriteConfig.HTTP_POOL_REQUEST_TIMEOUT)
                 // 请求超时时间
-                .setConnectTimeout(CommonConfig.HTTP_POOL_CONNECT_TIMEOUT)
+                .setConnectTimeout(FlowWriteConfig.HTTP_POOL_CONNECT_TIMEOUT)
                 // 响应超时时间
-                .setSocketTimeout(CommonConfig.HTTP_POOL_RESPONSE_TIMEOUT)
+                .setSocketTimeout(FlowWriteConfig.HTTP_POOL_RESPONSE_TIMEOUT)
                 .build();
 
         /*

src/main/java/com/zdjizhi/utils/IpLocationConfiguration.java

@@ -1,21 +0,0 @@
-package com.zdjizhi.utils;
-import lombok.Data;
-/**
- * @author fy
- * @version 1.0
- * @date 2022/10/19 18:27
- */
-
-
-@Data
-public class IpLocationConfiguration {
-
-    private String ipV4UserDefined;
-
-    private String ipV4BuiltIn;
-
-    private String ipV6UserDefined;
-
-    private String ipV6BuiltIn;
-
-}

src/main/java/com/zdjizhi/utils/IpLookupUtils.java

@@ -0,0 +1,182 @@
+package com.zdjizhi.utils;
+
+import cn.hutool.crypto.digest.DigestUtil;
+import cn.hutool.log.Log;
+import cn.hutool.log.LogFactory;
+import com.alibaba.fastjson2.*;
+import com.geedgenetworks.utils.IpLookupV2;
+import com.geedgenetworks.utils.StringUtil;
+import com.google.common.base.Joiner;
+import com.zdjizhi.common.FlowWriteConfig;
+import com.zdjizhi.common.pojo.KnowlegeBaseMeta;
+import com.zdjizhi.utils.connections.http.HttpClientService;
+import org.apache.http.client.utils.URIBuilder;
+
+import java.io.ByteArrayInputStream;
+import java.net.URISyntaxException;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Timer;
+import java.util.TimerTask;
+
+
+/**
+ * @author wangchengcheng
+ * @version 2023/11/10 15:23
+ */
+public class IpLookupUtils {
+    private static final Log logger = LogFactory.get();
+    private static final String ipBuiltInName = "ip_builtin.mmdb";
+    private static final String ipUserDefinedName = "ip_user_defined.mmdb";
+
+    /**
+     * ip定位库
+     */
+    private static IpLookupV2 ipLookup;
+
+    /**
+     * 定位库默认分隔符
+     */
+    private static final String LOCATION_SEPARATOR = ".";
+
+    /**
+     * 最大重试次数
+     */
+    private static final int TRY_TIMES = 5;
+
+    /**
+     * http connections
+     */
+    private static final HttpClientService httpClientService;
+
+    /**
+     * 定位库元数据缓存
+     */
+    private static final HashMap<String, KnowlegeBaseMeta> knowledgeMetaCache = new HashMap<>(16);
+
+    private static String currentSha256IpUserDefined = "";
+
+    private static String currentSha256IpBuiltin = "";
+
+    static {
+        httpClientService = new HttpClientService();
+        stuffKnowledgeMetaCache();
+        Timer timer = new Timer();
+        timer.schedule(new TimerTask() {
+            @Override
+            public void run() {
+                stuffKnowledgeMetaCache();
+            }
+        }, 0, FlowWriteConfig.KNOWLEDGE_EXECUTION_INTERVAL);
+    }
+
+
+
+    private static void stuffKnowledgeMetaCache(){
+        final KnowlegeBaseMeta ipBuiltinknowlegeBaseMeta = getKnowlegeBaseMeta(FlowWriteConfig.IP_BUILTIN_KD_ID);
+        if (!currentSha256IpBuiltin.equals(ipBuiltinknowlegeBaseMeta.getSha256())) {
+            String fileName = Joiner.on(LOCATION_SEPARATOR).useForNull("").join(ipBuiltinknowlegeBaseMeta.getName(), ipBuiltinknowlegeBaseMeta.getFormat());
+            knowledgeMetaCache.put(fileName, ipBuiltinknowlegeBaseMeta);
+        }
+        final KnowlegeBaseMeta ipUserDefinedknowlegeBaseMeta = getKnowlegeBaseMeta(FlowWriteConfig.IP_USER_DEFINED_KD_ID);
+        if (!currentSha256IpUserDefined.equals(ipUserDefinedknowlegeBaseMeta.getSha256())) {
+            String fileName = Joiner.on(LOCATION_SEPARATOR).useForNull("").join(ipUserDefinedknowlegeBaseMeta.getName(), ipUserDefinedknowlegeBaseMeta.getFormat());
+            knowledgeMetaCache.put(fileName, ipUserDefinedknowlegeBaseMeta);
+        }
+        if (!currentSha256IpUserDefined.equals(ipUserDefinedknowlegeBaseMeta.getSha256()) || !currentSha256IpBuiltin.equals(ipBuiltinknowlegeBaseMeta.getSha256())) {
+            currentSha256IpBuiltin = ipBuiltinknowlegeBaseMeta.getSha256();
+            currentSha256IpUserDefined = ipUserDefinedknowlegeBaseMeta.getSha256();
+            reloadIpLookup();
+        }
+    }
+
+    /**
+     * 从HDFS下载文件更新IpLookup
+     */
+    private static void reloadIpLookup() {
+        IpLookupV2.Builder builder = new IpLookupV2.Builder(false);
+        for (String fileName : knowledgeMetaCache.keySet()) {
+            int retryNum = 0;
+            KnowlegeBaseMeta knowlegeBaseMeta = knowledgeMetaCache.get(fileName);
+            String metaSha256 = knowlegeBaseMeta.getSha256();
+            while (retryNum < TRY_TIMES) {
+                System.out.println("download file ：" + fileName + ",HOS path :" + knowlegeBaseMeta.getPath());
+                Long startTime = System.currentTimeMillis();
+                byte[] httpGetByte = httpClientService.httpGetByte(knowlegeBaseMeta.getPath(), FlowWriteConfig.HTTP_SOCKET_TIMEOUT);
+                if (httpGetByte != null && httpGetByte.length > 0) {
+                    String downloadFileSha256 = DigestUtil.sha256Hex(httpGetByte);
+                    if (metaSha256.equals(downloadFileSha256)) {
+                        ByteArrayInputStream inputStream = new ByteArrayInputStream(httpGetByte);
+                        switch (fileName) {
+                            case ipBuiltInName:
+                                builder.loadDataFile(inputStream);
+                                break;
+                            case ipUserDefinedName:
+                                builder.loadDataFilePrivate(inputStream);
+                                break;
+                            default:
+                        }
+                        System.out.println("update " + fileName + " finished, speed :" + (System.currentTimeMillis() - startTime) + "ms");
+                        retryNum = TRY_TIMES;
+                    } else {
+                        logger.error("通过HOS下载{}的sha256为:{} ,网关内记录为:{} ,sha256不相等 开始第{}次重试下载文件", fileName, downloadFileSha256, metaSha256, retryNum);
+                        retryNum++;
+                    }
+                } else {
+                    logger.error("通过HOS下载{}的流为空 ,开始第{}次重试下载文件", fileName, retryNum);
+                    retryNum++;
+                }
+            }
+        }
+        ipLookup = builder.build();
+    }
+
+
+    /**
+     * 根据配置组合生成知识库元数据过滤参数
+     *
+     * @return 过滤参数
+     */
+    private static String getFilterParameter() {
+
+        String expr = "[?(@.version=='latest')][?(@.name in ('ip_builtin','ip_user_defined'))]";
+
+        return expr;
+    }
+
+    public static String getCountryLookup(String ip) {
+        return ipLookup.countryLookup(ip);
+    }
+
+    private static KnowlegeBaseMeta getKnowlegeBaseMeta(String kd_id) {
+        KnowlegeBaseMeta knowlegeBaseMeta = null;
+        String knowledgeInfo = null;
+        try {
+            URIBuilder uriBuilder = new URIBuilder(FlowWriteConfig.KNOWLEDGE_BASE_URL);
+            HashMap<String, Object> parms = new HashMap<>();
+            parms.put("kb_id", kd_id);
+            HttpClientUtils.setUrlWithParams(uriBuilder, FlowWriteConfig.KNOWLEDGE_BASE_PATH, parms);
+            knowledgeInfo = HttpClientUtils.httpGet(uriBuilder.build());
+            if (knowledgeInfo.contains("200")) {
+                final Map<String, Object> jsonObject = JSONObject.parseObject(knowledgeInfo, Map.class);
+                JSONPath jsonPath = JSONPath.of(getFilterParameter());
+                String extract = jsonPath.extract(JSONReader.of(jsonObject.get("data").toString())).toString();
+                if (StringUtil.isNotBlank(extract)) {
+                    JSONArray jsonArray = JSON.parseArray(extract);
+                    if (jsonArray.size() > 0) {
+                        for (int i = 0; i < jsonArray.size(); i++) {
+                            knowlegeBaseMeta = JSONObject.parseObject(jsonArray.getString(i), KnowlegeBaseMeta.class);
+                        }
+                    }
+                }
+            } else {
+                logger.error("获取knowledge_base失败,请求回执为" + knowledgeInfo);
+            }
+        } catch (URISyntaxException e) {
+            logger.error("构造URI异常", e);
+        } catch (Exception e) {
+            logger.error("获取knowledge_base失败", e);
+        }
+        return knowlegeBaseMeta;
+    }
+}

src/main/java/com/zdjizhi/utils/IpUtils.java

@@ -1,115 +0,0 @@
-package com.zdjizhi.utils;
-
-import com.zdjizhi.common.CommonConfig;
-import com.zdjizhi.common.CustomFile;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.ByteArrayInputStream;
-import java.io.InputStream;
-import java.util.List;
-import java.util.Map;
-
-public class IpUtils {
-    public static IpLookupV2 ipLookup ;
-
-    private static Logger LOG = LoggerFactory.getLogger(IpUtils.class);
-
-
-    /**
-     * IP定位库工具类
-     */
-//    public static IpLookupV2 ipLookup = new IpLookupV2.Builder(false)
-//            .loadDataFileV4(CommonConfig.IP_MMDB_PATH + "ip_v4_built_in.mmdb")
-//            .loadDataFileV6(CommonConfig.IP_MMDB_PATH + "ip_v6_built_in.mmdb")
-//            .loadDataFilePrivateV4(CommonConfig.IP_MMDB_PATH + "ip_v4_user_defined.mmdb")
-//            .loadDataFilePrivateV6(CommonConfig.IP_MMDB_PATH + "ip_v6_user_defined.mmdb")
-//            .build();
-
-
-    public static void loadIpLook(){
-        try {
-            IpLookupV2.Builder builder = new IpLookupV2.Builder(false);
-            if ("CLUSTER".equals(CommonConfig.CLUSTER_OR_SINGLE)) {
-                byte[] ipv4BuiltBytes = HdfsUtils.getFileBytes(CommonConfig.HDFS_PATH + "ip_v4_built_in.mmdb");
-                if (ipv4BuiltBytes!=null){
-                    InputStream ipv4BuiltInputStream = new ByteArrayInputStream(ipv4BuiltBytes);
-                    builder.loadDataFileV4(ipv4BuiltInputStream);
-                }
-
-                byte[] ipv6BuiltBytes = HdfsUtils.getFileBytes(CommonConfig.HDFS_PATH + "ip_v6_built_in.mmdb");
-                if (ipv6BuiltBytes!=null){
-                    InputStream ipv6BuiltInputStream = new ByteArrayInputStream(ipv6BuiltBytes);
-                    builder.loadDataFileV6(ipv6BuiltInputStream);
-                }
-
-                byte[] ipv4UserBytes = HdfsUtils.getFileBytes(CommonConfig.HDFS_PATH + "ip_v4_user_defined.mmdb");
-                if (ipv4UserBytes!=null){
-                    InputStream ipv4UserInputStream = new ByteArrayInputStream(ipv4UserBytes);
-                    builder.loadDataFilePrivateV4(ipv4UserInputStream);
-                }
-
-                byte[] ipv6UserBytes = HdfsUtils.getFileBytes(CommonConfig.HDFS_PATH + "ip_v6_user_defined.mmdb");
-                if (ipv6UserBytes!=null){
-                    InputStream ipv6UserInputStream = new ByteArrayInputStream(ipv6UserBytes);
-                    builder.loadDataFilePrivateV6(ipv6UserInputStream);
-                }
-            }else if ("SINGLE".equals(CommonConfig.CLUSTER_OR_SINGLE)){
-                byte[] ipv4BuiltBytes = FileByteUtils.getFileBytes(CommonConfig.DOWNLOAD_PATH + "ip_v4_built_in.mmdb");
-                if (ipv4BuiltBytes!=null){
-                    InputStream ipv4BuiltInputStream = new ByteArrayInputStream(ipv4BuiltBytes);
-                    builder.loadDataFileV4(ipv4BuiltInputStream);
-                }
-
-                byte[] ipv6BuiltBytes = FileByteUtils.getFileBytes(CommonConfig.DOWNLOAD_PATH + "ip_v6_built_in.mmdb");
-                if (ipv6BuiltBytes!=null){
-                    InputStream ipv6BuiltInputStream = new ByteArrayInputStream(ipv6BuiltBytes);
-                    builder.loadDataFileV6(ipv6BuiltInputStream);
-                }
-
-                byte[] ipv4UserBytes = FileByteUtils.getFileBytes(CommonConfig.DOWNLOAD_PATH + "ip_v4_user_defined.mmdb");
-                if (ipv4UserBytes!=null){
-                    InputStream ipv4UserInputStream = new ByteArrayInputStream(ipv4UserBytes);
-                    builder.loadDataFilePrivateV4(ipv4UserInputStream);
-                }
-
-                byte[] ipv6UserBytes = FileByteUtils.getFileBytes(CommonConfig.DOWNLOAD_PATH + "ip_v6_user_defined.mmdb");
-                if (ipv6UserBytes!=null){
-                    InputStream ipv6UserInputStream = new ByteArrayInputStream(ipv6UserBytes);
-                    builder.loadDataFilePrivateV6(ipv6UserInputStream);
-                }
-            }
-            ipLookup = builder.build();
-
-        }catch (Exception e){
-            LOG.error("加载失败",e);
-        }
-    }
-
-    public static void updateIpLook(Map<String, byte[]> knowledgeFileCache){
-        try{
-            IpLookupV2.Builder builder = new IpLookupV2.Builder(false);
-            ipLookup= builder.loadDataFileV4(new ByteArrayInputStream(knowledgeFileCache.get("ip_v4_built_in.mmdb")))
-                    .loadDataFileV6(new ByteArrayInputStream(knowledgeFileCache.get("ip_v6_built_in.mmdb")))
-                    .loadDataFilePrivateV4(new ByteArrayInputStream(knowledgeFileCache.get("ip_v4_user_defined.mmdb")))
-                    .loadDataFilePrivateV6(new ByteArrayInputStream(knowledgeFileCache.get("ip_v6_user_defined.mmdb")))
-                    .build();
-        }catch (Exception e){
-            LOG.error("加载失败",e);
-        }
-
-    }
-
-    public static void main(String[] args) {
-        System.out.println(ipLookup.countryLookup("49.7.115.37"));
-
-        String ips = "182.168.50.23,182.168.50.45,182.168.56.9,182.168.56.8,92.168.50.58,19.168.56.7,12.168.56.6,2.168.50.40,1.168.50.19,9.168.50.6,2.168.50.4,192.168.56.17,192.168.50.27,192.168.50.26,192.168.50.18,192.168.56.3,192.168.56.10";
-        for (String ip:ips.split(",")){
-            System.out.println(ip+"--"+ipLookup.countryLookup(ip));
-        }
-
-    }
-
-
-
-}

src/main/java/com/zdjizhi/utils/KafkaUtils.java

@@ -1,6 +1,6 @@
 package com.zdjizhi.utils;
 
-import com.zdjizhi.common.CommonConfig;
+import com.zdjizhi.common.FlowWriteConfig;
 import org.apache.flink.api.common.serialization.SimpleStringSchema;
 import org.apache.flink.streaming.connectors.kafka.FlinkKafkaProducer;
 
@@ -11,11 +11,11 @@ public class KafkaUtils {
 
     private static Properties getKafkaSinkProperty(){
         Properties properties = new Properties();
-        properties.setProperty("bootstrap.servers", CommonConfig.KAFKA_OUTPUT_BOOTSTRAP_SERVERS);
-        if (CommonConfig.SASL_JAAS_CONFIG_FLAG == 1){
+        properties.setProperty("bootstrap.servers", FlowWriteConfig.KAFKA_OUTPUT_BOOTSTRAP_SERVERS);
+        if (FlowWriteConfig.SASL_JAAS_CONFIG_FLAG == 1){
             properties.put("security.protocol", "SASL_PLAINTEXT");
             properties.put("sasl.mechanism", "PLAIN");
-            properties.put("sasl.jaas.config", "org.apache.kafka.common.security.plain.PlainLoginModule required username=\""+CommonConfig.SASL_JAAS_CONFIG_USER+"\" password=\""+CommonConfig.SASL_JAAS_CONFIG_PASSWORD+"\";");
+            properties.put("sasl.jaas.config", "org.apache.kafka.common.security.plain.PlainLoginModule required username=\""+ FlowWriteConfig.SASL_JAAS_CONFIG_USER+"\" password=\""+ FlowWriteConfig.SASL_JAAS_CONFIG_PASSWORD+"\";");
         }
 
         return properties;

src/main/java/com/zdjizhi/utils/NacosUtils.java

@@ -1,92 +0,0 @@
-package com.zdjizhi.utils;
-
-import cn.hutool.log.Log;
-import cn.hutool.log.LogFactory;
-import com.alibaba.nacos.api.NacosFactory;
-import com.alibaba.nacos.api.PropertyKeyConst;
-import com.alibaba.nacos.api.config.ConfigService;
-import com.alibaba.nacos.api.config.listener.Listener;
-
-import java.io.IOException;
-import java.io.StringReader;
-import java.util.Properties;
-import java.util.concurrent.Executor;
-
-public class NacosUtils {
-//    private static final Logger logger = LoggerFactory.getLogger(NacosUtils.class);
-    private static final Log logger = LogFactory.get();
-    private static Properties nacosProperties = new Properties();
-    private static Properties commonProperties = new Properties();
-
-
-    private static final String NACOS_SERVER_ADDR = CommonConfigurations.getStringProperty("nacos.server.addr");
-    private static final String NACOS_STATIC_NAMESPACE = CommonConfigurations.getStringProperty("nacos.static.namespace");
-    private static final String NACOS_USERNAME = CommonConfigurations.getStringProperty("nacos.username");
-    private static final String NACOS_PASSWORD = CommonConfigurations.getStringProperty("nacos.password");
-    private static final String NACOS_STATIC_DATA_ID = CommonConfigurations.getStringProperty("nacos.static.data.id");
-    private static final String NACOS_STATIC_GROUP = CommonConfigurations.getStringProperty("nacos.static.group");
-    private static final long NACOS_READ_TIMEOUT = CommonConfigurations.getLongProperty("nacos.read.timeout");
-
-    static {
-        createConfigService();
-    }
-
-    private static void getProperties() {
-        nacosProperties.setProperty(PropertyKeyConst.SERVER_ADDR, NACOS_SERVER_ADDR);
-        nacosProperties.setProperty(PropertyKeyConst.NAMESPACE, NACOS_STATIC_NAMESPACE);
-        nacosProperties.setProperty(PropertyKeyConst.USERNAME, NACOS_USERNAME);
-        nacosProperties.setProperty(PropertyKeyConst.PASSWORD, NACOS_PASSWORD);
-    }
-
-    private static void createConfigService() {
-        try {
-            getProperties();
-            ConfigService configService = NacosFactory.createConfigService(nacosProperties);
-            String config = configService.getConfig(NACOS_STATIC_DATA_ID, NACOS_STATIC_GROUP, NACOS_READ_TIMEOUT);
-            commonProperties.load(new StringReader(config));
-
-
-            configService.addListener(NACOS_STATIC_DATA_ID, NACOS_STATIC_GROUP, new Listener() {
-                @Override
-                public Executor getExecutor() {
-                    return null;
-                }
-
-                @Override
-                public void receiveConfigInfo(String configMsg) {
-                    try {
-                        commonProperties.clear();
-                        commonProperties.load(new StringReader(configMsg));
-                    } catch (IOException e) {
-                        logger.error("监听nacos配置失败", e);
-                    }
-                    System.out.println(configMsg);
-                }
-            });
-        } catch (Exception e) {
-            e.printStackTrace();
-            logger.error("获取nacos配置失败", e);
-        }
-    }
-
-    public static String getStringProperty(String key) {
-        return commonProperties.getProperty(key);
-    }
-
-    public static Integer getIntProperty(String key) {
-        return Integer.parseInt(commonProperties.getProperty(key));
-    }
-
-    public static Double getDoubleProperty(String key) {
-        return Double.parseDouble(commonProperties.getProperty(key));
-    }
-
-    public static Long getLongProperty(String key) {
-        return Long.parseLong(commonProperties.getProperty(key));
-    }
-
-    public static Boolean getBooleanProperty(String key) {
-        return "true".equals(commonProperties.getProperty(key).toLowerCase().trim());
-    }
-
-}

src/main/java/com/zdjizhi/utils/SnowflakeId.java

@@ -2,7 +2,7 @@ package com.zdjizhi.utils;
 
 import cn.hutool.log.Log;
 import cn.hutool.log.LogFactory;
-import com.zdjizhi.common.CommonConfig;
+import com.zdjizhi.common.FlowWriteConfig;
 
 public class SnowflakeId {
 //    private static final Logger logger = LoggerFactory.getLogger(SnowflakeId.class);
@@ -99,7 +99,7 @@ public class SnowflakeId {
     private static ZookeeperUtils zookeeperUtils = new ZookeeperUtils();
 
     static {
-        idWorker = new SnowflakeId(CommonConfig.HBASE_ZOOKEEPER_QUORUM, CommonConfig.DATA_CENTER_ID_NUM);
+        idWorker = new SnowflakeId(FlowWriteConfig.HBASE_ZOOKEEPER_QUORUM, FlowWriteConfig.DATA_CENTER_ID_NUM);
     }
 
     //==============================Constructors=====================================
@@ -108,7 +108,7 @@ public class SnowflakeId {
      * 构造函数
      */
     private SnowflakeId(String zookeeperIp, long dataCenterIdNum) {
-        DistributedLock lock = new DistributedLock(CommonConfig.HBASE_ZOOKEEPER_QUORUM, "disLocks1");
+        DistributedLock lock = new DistributedLock(FlowWriteConfig.HBASE_ZOOKEEPER_QUORUM, "disLocks1");
         try {
             lock.lock();
             int tmpWorkerId = zookeeperUtils.modifyNode("/Snowflake/" + "worker" + dataCenterIdNum, zookeeperIp);

src/main/java/com/zdjizhi/utils/connections/http/HttpClientService.java

@@ -1,6 +1,11 @@
-package com.zdjizhi.utils;
+package com.zdjizhi.utils.connections.http;
 
-import com.zdjizhi.common.CommonConfig;
+import cn.hutool.log.Log;
+import cn.hutool.log.LogFactory;
+
+import com.geedgenetworks.utils.StringUtil;
+import com.zdjizhi.common.FlowWriteConfig;
+import com.zdjizhi.utils.exception.FlowWriteException;
 import org.apache.commons.io.IOUtils;
 import org.apache.http.*;
 import org.apache.http.client.ClientProtocolException;
@@ -8,63 +13,35 @@ import org.apache.http.client.HttpRequestRetryHandler;
 import org.apache.http.client.config.RequestConfig;
 import org.apache.http.client.methods.CloseableHttpResponse;
 import org.apache.http.client.methods.HttpGet;
-import org.apache.http.client.methods.HttpPost;
 import org.apache.http.client.protocol.HttpClientContext;
-import org.apache.http.client.utils.URIBuilder;
 import org.apache.http.config.Registry;
 import org.apache.http.config.RegistryBuilder;
 import org.apache.http.conn.ConnectTimeoutException;
 import org.apache.http.conn.ConnectionKeepAliveStrategy;
-import org.apache.http.conn.HttpHostConnectException;
 import org.apache.http.conn.socket.ConnectionSocketFactory;
 import org.apache.http.conn.socket.PlainConnectionSocketFactory;
 import org.apache.http.conn.ssl.NoopHostnameVerifier;
 import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
-import org.apache.http.entity.ByteArrayEntity;
 import org.apache.http.impl.client.CloseableHttpClient;
 import org.apache.http.impl.client.HttpClients;
 import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
 import org.apache.http.message.BasicHeaderElementIterator;
 import org.apache.http.protocol.HTTP;
 import org.apache.http.util.EntityUtils;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import javax.net.ssl.*;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.InterruptedIOException;
-import java.net.URI;
+import java.net.SocketTimeoutException;
 import java.net.UnknownHostException;
-import java.nio.charset.StandardCharsets;
 import java.security.KeyManagementException;
 import java.security.NoSuchAlgorithmException;
 import java.security.cert.X509Certificate;
-import java.util.Map;
 
-import static org.apache.kafka.common.requests.FetchMetadata.log;
+public class HttpClientService {
 
-/**
- * http client工具类
- */
-public class HttpClientUtils2 {
-    /** 全局连接池对象 */
-    private static final PoolingHttpClientConnectionManager CONN_MANAGER = new PoolingHttpClientConnectionManager();
-
-    private static Logger logger = LoggerFactory.getLogger(HttpClientUtils2.class);
-    public static final String ERROR_MESSAGE = "-1";
-
-    /*
-     * 静态代码块配置连接池信息
-     */
-    static {
-
-        // 设置最大连接数
-        CONN_MANAGER.setMaxTotal(CommonConfig.HTTP_POOL_MAX_CONNECTION);
-        // 设置每个连接的路由数
-        CONN_MANAGER.setDefaultMaxPerRoute(CommonConfig.HTTP_POOL_MAX_PER_ROUTE);
-
-    }
+    private static final Log log = LogFactory.get();
 
     /**
      * 在调用SSL之前需要重写验证方法，取消检测SSL
@@ -80,9 +57,11 @@ public class HttpClientUtils2 {
                 public X509Certificate[] getAcceptedIssuers() {
                     return null;
                 }
+
                 @Override
                 public void checkClientTrusted(X509Certificate[] xcs, String str) {
                 }
+
                 @Override
                 public void checkServerTrusted(X509Certificate[] xcs, String str) {
                 }
@@ -96,31 +75,33 @@ public class HttpClientUtils2 {
             // 创建ConnectionManager，添加Connection配置信息
             PoolingHttpClientConnectionManager connManager = new PoolingHttpClientConnectionManager(socketFactoryRegistry);
             // 设置最大连接数
-            connManager.setMaxTotal(CommonConfig.HTTP_POOL_MAX_CONNECTION);
+            connManager.setMaxTotal(FlowWriteConfig.HTTP_POOL_MAX_CONNECTION);
             // 设置每个连接的路由数
-            connManager.setDefaultMaxPerRoute(CommonConfig.HTTP_POOL_MAX_PER_ROUTE);
+            connManager.setDefaultMaxPerRoute(FlowWriteConfig.HTTP_POOL_MAX_PER_ROUTE);
             return connManager;
         } catch (KeyManagementException | NoSuchAlgorithmException e) {
-            throw new RuntimeException(e.getMessage());
+            throw new FlowWriteException(e.getMessage());
         }
     }
 
     /**
      * 获取Http客户端连接对象
+     *
+     * @param socketTimeOut 响应超时时间
      * @return Http客户端连接对象
      */
-    private  CloseableHttpClient getHttpClient() {
+    private CloseableHttpClient getHttpClient(int socketTimeOut) {
         // 创建Http请求配置参数
         RequestConfig requestConfig = RequestConfig.custom()
                 // 获取连接超时时间
-                .setConnectionRequestTimeout(CommonConfig.HTTP_POOL_REQUEST_TIMEOUT)
+                .setConnectionRequestTimeout(FlowWriteConfig.HTTP_POOL_REQUEST_TIMEOUT)
                 // 请求超时时间
-                .setConnectTimeout(CommonConfig.HTTP_POOL_CONNECT_TIMEOUT)
+                .setConnectTimeout(FlowWriteConfig.HTTP_POOL_CONNECT_TIMEOUT)
                 // 响应超时时间
-                .setSocketTimeout(CommonConfig.HTTP_POOL_RESPONSE_TIMEOUT)
+                .setSocketTimeout(socketTimeOut)
                 .build();
 
-        /*
+        /**
          * 测出超时重试机制为了防止超时不生效而设置
          *  如果直接放回false,不重试
          *  这里会根据情况进行判断是否重试
@@ -135,25 +116,32 @@ public class HttpClientUtils2 {
             if (exception instanceof SSLHandshakeException) {// 不要重试SSL握手异常
                 return false;
             }
+            if (exception instanceof SocketTimeoutException) {
+                if (exception.getMessage().contains("Read timed out")) {
+                    return false;
+                }
+            }
             if (exception instanceof UnknownHostException) {// 目标服务器不可达
                 return false;
             }
             if (exception instanceof ConnectTimeoutException) {// 连接被拒绝
                 return false;
             }
-            if (exception instanceof HttpHostConnectException) {// 连接被拒绝
-                return false;
-            }
             if (exception instanceof SSLException) {// ssl握手异常
                 return false;
             }
             if (exception instanceof InterruptedIOException) {// 超时
                 return true;
             }
+
+
             HttpClientContext clientContext = HttpClientContext.adapt(context);
             HttpRequest request = clientContext.getRequest();
             // 如果请求是幂等的，就再次尝试
-            return !(request instanceof HttpEntityEnclosingRequest);
+            if (!(request instanceof HttpEntityEnclosingRequest)) {
+                return true;
+            }
+            return false;
         };
 
 
@@ -164,7 +152,7 @@ public class HttpClientUtils2 {
                 HeaderElement he = it.nextElement();
                 String param = he.getName();
                 String value = he.getValue();
-                if (value != null && "timeout".equalsIgnoreCase(param)) {
+                if (value != null && param.equalsIgnoreCase("timeout")) {
                     return Long.parseLong(value) * 1000;
                 }
             }
@@ -183,11 +171,10 @@ public class HttpClientUtils2 {
                 .build();
     }
 
-    // TODO: 2022/10/19  加载知识库
     public InputStream httpGetInputStream(String url, int socketTimeout, Header... headers) {
         InputStream result = null;
         // 获取客户端连接对象
-        CloseableHttpClient httpClient = getHttpClient();// TODO: 2022/10/19 去掉了 socketTimeout
+        CloseableHttpClient httpClient = getHttpClient(socketTimeout);
         // 创建GET请求对象
         HttpGet httpGet = new HttpGet(url);
         if (StringUtil.isNotEmpty(headers)) {
@@ -228,7 +215,47 @@ public class HttpClientUtils2 {
     }
 
 
+    public byte[] httpGetByte(String url, int socketTimeout, Header... headers) {
+        byte[] result = null;
+        // 获取客户端连接对象
+        CloseableHttpClient httpClient = getHttpClient(socketTimeout);
+        // 创建GET请求对象
+        HttpGet httpGet = new HttpGet(url);
+        if (StringUtil.isNotEmpty(headers)) {
+            for (Header h : headers) {
+                httpGet.addHeader(h);
+            }
+        }
+        CloseableHttpResponse response = null;
 
+        try {
+            // 执行请求
+            response = httpClient.execute(httpGet);
+            // 获取响应实体
+            result = IOUtils.toByteArray(response.getEntity().getContent());
+            // 获取响应信息
+            EntityUtils.consume(response.getEntity());
+        } catch (ClientProtocolException e) {
+            log.error("current file: {},Protocol error:{}", url, e.getMessage());
 
+        } catch (ParseException e) {
+            log.error("current file: {}, Parser error:{}", url, e.getMessage());
+
+        } catch (IOException e) {
+            log.error("current file: {},IO error:{}", url, e.getMessage());
+
+        } finally {
+            if (null != response) {
+                try {
+                    EntityUtils.consume(response.getEntity());
+                    response.close();
+                } catch (IOException e) {
+                    log.error("Release Connection error:{}", e.getMessage());
+
+                }
+            }
+            return result;
+        }
+    }
 
 }

src/main/java/com/zdjizhi/utils/exception/FlowWriteException.java

@@ -0,0 +1,13 @@
+package com.zdjizhi.utils.exception;
+
+
+public class FlowWriteException extends RuntimeException {
+
+    public FlowWriteException() {
+    }
+
+    public FlowWriteException(String message) {
+        super(message);
+    }
+
+}

src/main/resources/common.properties

@@ -15,7 +15,7 @@ kafka.input.topic.name=DOS-SKETCH-RECORD
 kafka.input.bootstrap.servers=192.168.44.11:9094,192.168.44.14:9094,192.168.44.15:9094
 
 #读取kafka group id
-kafka.input.group.id=dos-detection-job-221125-1
+kafka.input.group.id=dos-detection-job-221125-23132
 #kafka.input.group.id=dos-detection-job-210813-1
 
 #发送kafka metrics并行度大小
@@ -30,7 +30,7 @@ kafka.output.event.parallelism=3
 
 #发送kafka event topic名
 #kafka.output.event.topic.name=DOS-EVENT
-kafka.output.event.topic.name=abcd
+kafka.output.event.topic.name=dos-test
 
 #kafka输出地址
 kafka.output.bootstrap.servers=192.168.44.12:9094
@@ -64,7 +64,7 @@ flink.detection.map.parallelism=1
 flink.watermark.max.orderness=300
 
 #计算窗口大小，默认600s
-flink.window.max.time=600
+flink.window.max.time=60
 
 #dos event结果中distinct source IP限制
 source.ip.list.limit=10000
@@ -74,27 +74,6 @@ destination.ip.partition.num=10000
 
 data.center.id.num=15
 
-#IP mmdb库路径
-ip.mmdb.path=D:\\data\\dat\\bak\\
-#ip.mmdb.path=/home/bigdata/topology/dat/
-#ip.mmdb.path=/home/bigdata/wlh/topology/dos-detection/dat/
-
-#bifang服务访问地址
-bifang.server.uri=http://192.168.44.72:80
-#bifang.server.uri=http://192.168.44.3:80
-
-#加密密码路径信息
-bifang.server.encryptpwd.path=/v1/user/encryptpwd
-
-#登录bifang服务路径信息
-bifang.server.login.path=/v1/user/login
-
-#获取vaysId路径信息
-bifang.server.policy.vaysid.path=/v1/system/vsys/
-
-#获取静态阈值路径信息
-bifang.server.policy.threshold.path=/v1/policy/profile/DoS/detection/threshold
-
 #http请求相关参数
 #最大连接数
 http.pool.max.connection=400
@@ -125,34 +104,46 @@ sasl.jaas.config.password=6MleDyA3Z73HSaXiKsDJ2k7Ys8YWLhEJ
 #是否开启kafka用户认证配置，1：是；0：否
 sasl.jaas.config.flag=1
 
-############################## Nacos 配置 ######################################
-nacos.server.addr=192.168.44.12:8848
-nacos.username=nacos
-nacos.password=nacos
-nacos.read.timeout=5000
-############################## Nacos ---知识库配置 ######################################
-nacos.namespace=public
-nacos.data.id=knowledge_base.json
-nacos.group=DEFAULT_GROUP
+http.socket.timeout=90000
+
+############################## Knowledge Base 配置 ######################################
+knowledge.execution.interval=30000
+knowledge.base.uri=http://192.168.44.12:9999
+knowledge.base.path=/v1/knowledge_base
+ip.user.defined.kd.id=004390bc-3135-4a6f-a492-3662ecb9e289
+ip.builtin.kd.id=64af7077-eb9b-4b8f-80cf-2ceebc89bea9
+
+############################## Bifang Server 配置 ######################################
+bifang.server.token=aa2bdec5518ad131f71944b13ce5c298&1&
+#bifang服务访问地址
+bifang.server.uri=http://192.168.44.72
+#bifang.server.uri=http://192.168.44.3:80
+
+#加密密码路径信息
+bifang.server.encryptpwd.path=/v1/user/encryptpwd
+
+#登录bifang服务路径信息
+bifang.server.login.path=/v1/user/login
+
+#获取vaysId路径信息
+bifang.server.policy.vaysid.path=/v1/admin/vsys
+
+#获取静态阈值路径信息
+bifang.server.policy.threshold.path=/v1/policy/profile/dos_detection
 
 
-############################## Nacos ---静态阈值配置 ######################################
-nacos.static.namespace=test
-nacos.static.data.id=dos_detection.properties
-nacos.static.group=Galaxy
+############################## 基线 配置 ######################################
+static.sensitivity.threshold=1
+#基线敏感阈值
+baseline.sensitivity.threshold=0.2
+
+#基于baseline判定dos攻击的上下限
+baseline.sessions.minor.threshold=0.2
+baseline.sessions.warning.threshold=1
+baseline.sessions.major.threshold=2.5
+baseline.sessions.severe.threshold=5
+baseline.sessions.critical.threshold=8
 
-############################## hos Token 配置 ######################################
-hos.token=c21f969b5f03d33d43e04f8f136e7682
 
-############################# 选择集群模式或者单机模式 配置 ######################################
-cluster.or.single=CLUSTER
-#cluster.or.single=SINGLE
 
-############################## 集群模式配置文件路径 配置 ######################################
-hdfs.path=/test/TEST/
-hdfs.uri.nn1=192.168.40.151:9000
-hdfs.uri.nn2=192.168.40.152:9000
-hdfs.user=dos
 
-############################## 单机模式配置文件下载路径 配置 ######################################
-download.path=D:\\ttt\\

src/main/resources/core-site.xml

@@ -1,58 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<?xml-stylesheet type="text/xsl" href="configuration.xsl"?>
-<!--
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License. See accompanying LICENSE file.
--->
-
-<!-- Put site-specific property overrides in this file. -->
-
-<configuration>
-    <property>  
-        <name>fs.defaultFS</name>  
-        <value>hdfs://ns1</value>  
-    </property>
-    <property>
-        <name>hadoop.tmp.dir</name>
-        <value>file:/home/tsg/olap/hadoop/tmp</value>
-    </property>
-    <property>
-        <name>io.file.buffer.size</name>
-        <value>131702</value>
-    </property>
-    <property>
-	<name>hadoop.proxyuser.root.hosts</name>
-	<value>*</value>
-    </property>
-    <property>
-	<name>hadoop.proxyuser.root.groups</name>
-	<value>*</value>
-    </property>
-    <property>
-	<name>hadoop.logfile.size</name>
-	<value>10000000</value>
-	<description>The max size of each log file</description>
-    </property>
-    <property>
-	<name>hadoop.logfile.count</name>
-	<value>1</value>
-	<description>The max number of log files</description>
-    </property>
-    <property>  
-        <name>ha.zookeeper.quorum</name>  
-        <value>192.168.40.151:2181,192.168.40.152:2181,192.168.40.203:2181</value>  
-    </property>
-    <property>
-        <name>ipc.client.connect.timeout</name>
-        <value>90000</value>
-    </property>
-</configuration>

src/main/resources/hdfs-site.xml

@@ -1,142 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<?xml-stylesheet type="text/xsl" href="configuration.xsl"?>
-<!--
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License. See accompanying LICENSE file.
--->
-
-<!-- Put site-specific property overrides in this file. -->
-
-<configuration>
-    <property>
-        <name>dfs.namenode.name.dir</name>
-        <value>file:/home/tsg/olap/hadoop/dfs/name</value>
-    </property>
-    <property>
-        <name>dfs.datanode.data.dir</name>
-        <value>file:/home/tsg/olap/hadoop/dfs/data</value>
-    </property>
-    <property>
-        <name>dfs.replication</name>
-        <value>2</value>
-    </property>
-    <property>
-	<name>dfs.webhdfs.enabled</name>
-	<value>true</value>
-    </property>
-    <property>
-        <name>dfs.permissions</name>
-        <value>false</value>
-    </property>	
-	<property>  
-        <name>dfs.permissions.enabled</name>  
-        <value>false</value>  
-    </property>  
-    <property>  
-        <name>dfs.nameservices</name>  
-        <value>ns1</value>  
-    </property>  
-    <property>  
-        <name>dfs.blocksize</name>  
-        <value>134217728</value>  
-    </property>  
-    <property>  
-        <name>dfs.ha.namenodes.ns1</name>  
-        <value>nn1,nn2</value>  
-    </property>  
-    <!-- nn1的RPC通信地址，nn1所在地址  -->  
-    <property>  
-        <name>dfs.namenode.rpc-address.ns1.nn1</name>  
-        <value>192.168.40.151:9000</value>  
-    </property>  
-    <!-- nn1的http通信地址，外部访问地址 -->  
-    <property>  
-        <name>dfs.namenode.http-address.ns1.nn1</name>  
-        <value>192.168.40.151:50070</value>  
-    </property>  
-    <!-- nn2的RPC通信地址，nn2所在地址 -->  
-    <property>  
-        <name>dfs.namenode.rpc-address.ns1.nn2</name>  
-        <value>192.168.40.152:9000</value>  
-    </property>  
-    <!-- nn2的http通信地址，外部访问地址 -->  
-    <property>  
-        <name>dfs.namenode.http-address.ns1.nn2</name>  
-        <value>192.168.40.152:50070</value>  
-    </property>  
-    <!-- 指定NameNode的元数据在JournalNode日志上的存放位置(一般和zookeeper部署在一起) -->  
-    <property>  
-        <name>dfs.namenode.shared.edits.dir</name>  
-        <value>qjournal://192.168.40.151:8485;192.168.40.152:8485;192.168.40.203:8485/ns1</value>  
-    </property>  
-    <!-- 指定JournalNode在本地磁盘存放数据的位置 -->  
-    <property>  
-        <name>dfs.journalnode.edits.dir</name>  
-        <value>/home/tsg/olap/hadoop/journal</value>  
-    </property>  
-    <!--客户端通过代理访问namenode，访问文件系统，HDFS 客户端与Active 节点通信的Java 类，使用其确定Active 节点是否活跃  -->  
-    <property>  
-        <name>dfs.client.failover.proxy.provider.ns1</name>  
-        <value>org.apache.hadoop.hdfs.server.namenode.ha.ConfiguredFailoverProxyProvider</value>  
-    </property>  
-    <!--这是配置自动切换的方法，有多种使用方法，具体可以看官网，在文末会给地址，这里是远程登录杀死的方法  -->  
-    <property>  
-        <name>dfs.ha.fencing.methods</name>  
-        <value>sshfence</value>    
-        <value>shell(true)</value> 
-    </property>  
-    <!-- 这个是使用sshfence隔离机制时才需要配置ssh免登陆 -->  
-    <property>  
-        <name>dfs.ha.fencing.ssh.private-key-files</name>  
-        <value>/root/.ssh/id_rsa</value>  
-    </property>  
-    <!-- 配置sshfence隔离机制超时时间，这个属性同上，如果你是用脚本的方法切换，这个应该是可以不配置的 -->  
-    <property>  
-        <name>dfs.ha.fencing.ssh.connect-timeout</name>  
-        <value>30000</value>  
-    </property>  
-    <!-- 这个是开启自动故障转移，如果你没有自动故障转移，这个可以先不配 -->  
-    <property>  
-        <name>dfs.ha.automatic-failover.enabled</name>  
-        <value>true</value>  
-    </property>
-    <property>
-        <name>dfs.datanode.max.transfer.threads</name>
-        <value>8192</value>
-    </property>
-    <!-- namenode处理RPC请求线程数，增大该值资源占用不大 -->
-    <property>
-        <name>dfs.namenode.handler.count</name>
-        <value>30</value>
-    </property>
-    <!-- datanode处理RPC请求线程数，增大该值会占用更多内存 -->
-    <property>
-        <name>dfs.datanode.handler.count</name>
-        <value>40</value>
-    </property>
-    <!-- balance时可占用的带宽 -->
-    <property>
-        <name>dfs.balance.bandwidthPerSec</name>
-        <value>104857600</value>
-    </property>
-    <!-- 磁盘预留空间，该空间不会被hdfs占用，单位字节-->
-    <property>
-        <name>dfs.datanode.du.reserved</name>
-        <value>5368709120</value>
-    </property>
-    <!-- datanode与namenode连接超时时间，单位毫秒  2 * heartbeat.recheck.interval + 30000  -->
-    <property>
-	<name>heartbeat.recheck.interval</name>
-	<value>100000</value>
-    </property>
-</configuration>
-

src/main/resources/yarn-site.xml

@@ -1,196 +0,0 @@
-<?xml version="1.0"?>
-<!--
-            Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License. See accompanying LICENSE file.
--->
-<configuration>
-    <property>
-        <name>yarn.nodemanager.aux-services</name>
-        <value>mapreduce_shuffle</value>
-    </property>
-        <property>
-       <name>yarn.resourcemanager.ha.enabled</name>
-       <value>true</value>
-    </property>
-    <!--声明两台resourcemanager的地址-->
-    <property>
-       <name>yarn.resourcemanager.cluster-id</name>
-       <value>rmcluster</value>
-    </property>
-    <property>
-       <name>yarn.resourcemanager.ha.rm-ids</name>
-       <value>rsm1,rsm2</value>
-    </property>
-    <!-- 配置rm1-->
-     <property>
-       <name>yarn.resourcemanager.hostname.rsm1</name>
-       <value>192.168.40.152</value>
-    </property>
-    <property>
-       <!--<name>yarn.resourcemanager.hostname.rm1</name>-->
-       <name>yarn.resourcemanager.address.rsm1</name>
-       <value>192.168.40.152:9916</value>
-    </property>
-    <property>
-           <name>yarn.resourcemanager.scheduler.address.rsm1</name>
-       <value>192.168.40.152:9917</value>
-    </property>
-    <property>
-           <name>yarn.resourcemanager.webapp.address.rsm1</name>
-       <value>192.168.40.152:9918</value>
-    </property>
-     <property>
-       <name>yarn.resourcemanager.admin.address.rsm1</name>
-       <value>192.168.40.152:9919</value>
-    </property>
-    <property>
-       <name>yarn.resourcemanager.resource-tracker.address.rsm1</name>
-       <value>192.168.40.152:9920</value>
-    </property>
-    <property>
-  <name>yarn.resourcemanager.ha.admin.address.rsm1</name>
-  <value>192.168.40.152:23142</value>
-    </property>
-    <!-- 配置rm2-->
-   
-    <property>
-       <name>yarn.resourcemanager.hostname.rsm2</name>
-       <value>192.168.40.203</value>
-    </property>
-    <property>
-       <!--<name>yarn.resourcemanager.hostname.rm1</name>-->
-       <name>yarn.resourcemanager.address.rsm2</name>
-       <value>192.168.40.203:9916</value>
-    </property>
-    <property>
-           <name>yarn.resourcemanager.scheduler.address.rsm2</name>
-       <value>192.168.40.203:9917</value>
-    </property>
-    <property>
-           <name>yarn.resourcemanager.webapp.address.rsm2</name>
-       <value>192.168.40.203:9918</value>
-    </property>
-    <property>
-       <name>yarn.resourcemanager.admin.address.rsm2</name>
-       <value>192.168.40.203:9919</value>
-    </property>
-    <property>
-       <name>yarn.resourcemanager.resource-tracker.address.rsm2</name>
-       <value>192.168.40.203:9920</value>
-    </property>
-    <property>
-  <name>yarn.resourcemanager.ha.admin.address.rsm2</name>
-  <value>192.168.40.203:23142</value>
-</property>
-    <!--指定zookeeper集群的地址-->
-    <property>
-       <name>yarn.resourcemanager.zk-address</name>
-        <value>192.168.40.151:2181,192.168.40.152:2181,192.168.40.203:2181</value>
-    </property>
-    <!--启用自动恢复，当任务进行一半，rm坏掉，就要启动自动恢复，默认是false-->
-    <property>
-       <name>yarn.resourcemanager.recovery.enabled</name>
-       <value>true</value>
-    </property>
-    <!--启动nm自动恢复，当集群重启，container开启自动恢复，保障任务的可靠性，默认为false，启动该配置需开启下面配置 -->
- <property>
-       <name>yarn.nodemanager.recovery.enabled</name>
-       <value>true</value>
-    </property>
-   <!--开启nm故障恢复后，nm元数据存储路径 -->
-   <property>
-       <name>yarn.nodemanager.recovery.dir</name>
-       <value>/home/tsg/olap/hadoop-2.7.1/yarn</value>
-    </property>
-   <!--启用nm恢复时监控功能，开启后不会去尝试清理container，默认false -->  
- <property>
-      <name>yarn.nodemanager.recovery.supervised</name>
-      <value>true</value>
-   </property>
-  <!--配置nm可用的RPC地址，默认${yarn.nodemanager.hostname}:0，为临时端口。集群重启后，nm与rm连接的端口会变化，这里指定端口，保障nm restart功能 -->
-<property>
-      <name>yarn.nodemanager.address</name>
-      <value>${yarn.nodemanager.hostname}:9923</value>
-   </property>
-        <property>
-       <name>yarn.resourcemanager.store.class</name>
-       <value>org.apache.hadoop.yarn.server.resourcemanager.recovery.ZKRMStateStore</value>
-    </property>
-    <property>
-        <name>yarn.nodemanager.resource.memory-mb</name>
-        <value>30720</value>
-    </property> 
-    <property>
-        <name>yarn.scheduler.minimum-allocation-mb</name>
-        <value>1024</value>
-    </property>
-
-    <property>
-        <name>yarn.scheduler.maximum-allocation-mb</name>
-        <value>30720</value>
-    </property>
-    <!--开启日志聚合 -->
-    <property>
-        <name>yarn.log-aggregation-enable</name>
-        <value>true</value>
-    </property>
-    <property>
-        <name>yarn.nodemanager.heartbeat-interval-ms</name>
-        <value>3000</value>
-    </property>
-   <!--日志保留7天 -->
-    <property>
-        <name>yarn.log-aggregation.retain-seconds</name>
-        <value>604800</value>
-    </property>
-    <property>
-        <name>yarn.nodemanager.log-aggregation.roll-monitoring-interval-seconds</name>
-        <value>3600</value>
-    </property>
-    <property>
-        <name>yarn.nodemanager.remote-app-log-dir</name>
-        <value>/tmp/logs</value>
-    </property>
-   <property>
-        <name>yarn.nodemanager.resource.cpu-vcores</name>
-        <value>14</value>
-    </property>
-    <property>
-        <name>yarn.scheduler.minimum-allocation-vcores</name>
-        <value>1</value>
-    </property>
-    <property>
-        <name>yarn.scheduler.maximum-allocation-vcores</name>
-        <value>14</value>
-    </property>
-    <property>
-        <name>yarn.nodemanager.vmem-check-enabled</name>
-        <value>false</value>
-    </property>
-   <property>
-        <name>yarn.nodemanager.pmem-check-enabled</name>
-        <value>false</value>
-    </property>
-    <property>
-        <name>yarn.nodemanager.disk-health-checker.enable</name>
-        <value>false</value>
-    </property>
-    <!--ApplicationMaster重启次数，配置HA后默认为2-->
-    <property>
-        <name>yarn.resourcemanager.am.max-attempts</name>
-        <value>10000</value>
-    </property>
-    <property>
-        <name>yarn.log.server.url</name>
-        <value>http://bigdata-151:19888/jobhistory/logs</value>
-    </property>
-</configuration>

src/test/java/com/zdjizhi/Http/HttpTest.java

@@ -0,0 +1,50 @@
+package com.zdjizhi.Http;
+
+import com.alibaba.fastjson2.JSON;
+import com.zdjizhi.common.FlowWriteConfig;
+import com.zdjizhi.utils.HttpClientUtils;
+
+import java.io.OutputStream;
+import java.net.HttpURLConnection;
+import java.net.URL;
+import java.util.HashMap;
+
+public class HttpTest {
+    public static void main(String[] args) {
+        String token = HttpClientUtils.ERROR_MESSAGE;
+        try {
+
+            String urlString = FlowWriteConfig.BIFANG_SERVER_URI+"/v1/user/encryptpwd";
+            final HashMap<String, Object> parmsMap = new HashMap<>();
+            parmsMap.put("username","admin");
+
+            final String jsonInputString = JSON.toJSONString(parmsMap);
+            System.out.println("URL:"+urlString);
+            System.out.println("parmsString:"+jsonInputString);
+
+
+            final URL url = new URL(urlString);
+
+            final HttpURLConnection connection  = (HttpURLConnection)url.openConnection();
+
+            connection.setRequestMethod("POST");
+
+            connection.setRequestProperty("Content-Type", "application/json");
+            connection.setRequestProperty("Accept", "application/json");
+            connection.setDoOutput(true);
+            OutputStream os = connection.getOutputStream();
+            os.write(jsonInputString.getBytes());
+            os.flush();
+            os.close();
+
+
+            int responseCode = connection.getResponseCode();
+            System.out.println("Response Code: " + responseCode);
+
+
+
+        } catch (Exception e) {
+            System.out.println("失败");
+        }
+    }
+}

src/test/java/com/zdjizhi/ThresholdTestData/DNS-Flood

@@ -0,0 +1,8 @@
+--DosSketchLog
+{common_sled_ip='null', common_data_center='null', sketch_start_time=1686277141, sketch_duration=59, attack_type='DNS Flood', source_ip='23.91.128.115', destination_ip='102.219.30.33', sketch_sessions=945, sketch_packets=945, sketch_bytes=446370, vsys_id=23}
+{common_sled_ip='null', common_data_center='null', sketch_start_time=1686277205, sketch_duration=86, attack_type='DNS Flood', source_ip='172.217.160.68', destination_ip='10.113.83.88', sketch_sessions=730, sketch_packets=730, sketch_bytes=344575, vsys_id=1}
+{common_sled_ip='null', common_data_center='null', sketch_start_time=1686277244, sketch_duration=47, attack_type='DNS Flood', source_ip='45.135.144.112', destination_ip='42.62.192.132', sketch_sessions=0, sketch_packets=0, sketch_bytes=47, vsys_id=1}
+
+--DosDetectionThreshold
+{profileId='6091', attackType='DNS Flood', serverIpList=[113.113.83.213, 42.62.192.132/28, 10.113.83.1/25, 102.219.30.33/29], serverIpAddr='null', packetsPerSec=1, bitsPerSec=1, sessionsPerSec=1, isValid=1, vsysId=1, superiorIds=[4, 12, 5, 27]}
+{profileId='5679', attackType='DNS Flood', serverIpList=[102.219.30.33], serverIpAddr='null', packetsPerSec=500, bitsPerSec=1000000, sessionsPerSec=100000, isValid=1, vsysId=23, superiorIds=[4, 5]}

src/test/java/com/zdjizhi/ThresholdTestData/ICMP-Flood

@@ -0,0 +1,6 @@
+--DosSketchLog
+{common_sled_ip='null', common_data_center='null', sketch_start_time=1686277232, sketch_duration=59, attack_type='ICMP Flood', source_ip='45.170.244.25', destination_ip='24.152.57.56', sketch_sessions=499, sketch_packets=499, sketch_bytes=111970, vsys_id=1}
+
+
+--DosDetectionThreshold
+{profileId='6093', attackType='ICMP Flood', serverIpList=[31.131.80.88/29, 24.152.57.56/29, 47.93.59.1/25], serverIpAddr='null', packetsPerSec=210, bitsPerSec=0, sessionsPerSec=0, isValid=1, vsysId=1, superiorIds=[4, 12, 5, 27]}

src/test/java/com/zdjizhi/ThresholdTestData/TCP-SYN-Flood

@@ -0,0 +1,7 @@
+--DosSketchLog
+{common_sled_ip='null', common_data_center='null', sketch_start_time=1685003938, sketch_duration=63714, attack_type='TCP SYN Flood', source_ip='5.32.144.55', destination_ip='45.188.134.11', sketch_sessions=0, sketch_packets=0, sketch_bytes=4195, vsys_id=1}
+{common_sled_ip='null', common_data_center='null', sketch_start_time=1686277234, sketch_duration=57, attack_type='TCP SYN Flood', source_ip='18.65.148.128', destination_ip='23.200.74.224', sketch_sessions=54, sketch_packets=54, sketch_bytes=73427, vsys_id=1}
+
+
+--DosDetectionThreshold
+{profileId='6095', attackType='TCP SYN Flood', serverIpList=[23.200.74.224, 45.188.134.11/29, 41.183.0.15/29, 41.183.0.16/30], serverIpAddr='null', packetsPerSec=1, bitsPerSec=1, sessionsPerSec=1, isValid=1, vsysId=1, superiorIds=[5, 4, 12, 27]}

src/test/java/com/zdjizhi/ThresholdTestData/UDP-Flood

@@ -0,0 +1,8 @@
+--DosSketchLog
+{common_sled_ip='null', common_data_center='null', sketch_start_time=1686277291, sketch_duration=0, attack_type='UDP Flood', source_ip='121.14.89.209', destination_ip='192.168.50.11', sketch_sessions=0, sketch_packets=0, sketch_bytes=0, vsys_id=1}
+{common_sled_ip='null', common_data_center='null', sketch_start_time=1686277233, sketch_duration=58, attack_type='UDP Flood', source_ip='192.168.50.56,192.168.50.34,192.168.50.11,192.168.50.33,192.168.50.55,192.168.50.58,192.168.50.36,192.168.50.14,192.168.50.35,192.168.50.13,192.168.50.57,192.168.50.30,192.168.50.51,192.168.50.54,192.168.50.10,192.168.50.32,192.168.50.53,192.168.50.31,192.168.50.16,192.168.50.38,192.168.50.15,192.168.50.37,192.168.50.18,192.168.50.17,192.168.50.50,192.168.50.45,192.168.50.23,192.168.50.22,192.168.50.44,192.168.50.25,192.168.50.47,192.168.50.46,192.168.50.24,192.168.50.63,192.168.50.41,192.168.50.40,192.168.50.62,192.168.50.43,192.168.50.21,192.168.50.20,192.168.50.42,192.168.50.27,192.168.50.26,192.168.50.48,192.168.50.28,192.168.50.61,192.168.50.60', destination_ip='121.14.89.209', sketch_sessions=297, sketch_packets=297, sketch_bytes=371404, vsys_id=1}
+
+
+--DosDetectionThreshold
+{profileId='5333', attackType='UDP Flood', serverIpList=[192.168.50.11, 192.168.50.12], serverIpAddr='null', packetsPerSec=50, bitsPerSec=50, sessionsPerSec=50, isValid=1, vsysId=1, superiorIds=[4, 12, 5, 27]}
+

src/test/java/com/zdjizhi/common/HbaseTest.java

@@ -19,12 +19,12 @@ public class HbaseTest {
     public static void main(String[] args) throws IOException {
         org.apache.hadoop.conf.Configuration config = HBaseConfiguration.create();
 
-        config.set("hbase.zookeeper.quorum", CommonConfig.HBASE_ZOOKEEPER_QUORUM);
+        config.set("hbase.zookeeper.quorum", FlowWriteConfig.HBASE_ZOOKEEPER_QUORUM);
         config.set("hbase.client.retries.number", "3");
         config.set("hbase.bulkload.retries.number", "3");
         config.set("zookeeper.recovery.retry", "3");
-        config.setInt(HConstants.HBASE_CLIENT_OPERATION_TIMEOUT, CommonConfig.HBASE_CLIENT_OPERATION_TIMEOUT);
-        config.setInt(HConstants.HBASE_CLIENT_SCANNER_TIMEOUT_PERIOD, CommonConfig.HBASE_CLIENT_SCANNER_TIMEOUT_PERIOD);
+        config.setInt(HConstants.HBASE_CLIENT_OPERATION_TIMEOUT, FlowWriteConfig.HBASE_CLIENT_OPERATION_TIMEOUT);
+        config.setInt(HConstants.HBASE_CLIENT_SCANNER_TIMEOUT_PERIOD, FlowWriteConfig.HBASE_CLIENT_SCANNER_TIMEOUT_PERIOD);
 
         TableName tableName  = TableName.valueOf("dos_test");
         Connection conn = ConnectionFactory.createConnection(config);

src/test/java/com/zdjizhi/common/NacosTest.java

@@ -55,7 +55,7 @@ public class NacosTest {
             String content = configService.getConfig(DATA_ID, GROUP, 5000);
             Properties nacosConfigMap = new Properties();
             nacosConfigMap.load(new StringReader(content));
-            System.out.println(nacosConfigMap.getProperty("static.sensitivity.threshold"));
+            System.out.println(FlowWriteConfig.STATIC_SENSITIVITY_THRESHOLD);
         } catch (Exception e) {
             e.printStackTrace();
         }

src/test/java/com/zdjizhi/etl/DosDetectionTest.java

@@ -0,0 +1,237 @@
+package com.zdjizhi.etl;
+
+import com.geedgenetworks.utils.StringUtil;
+import com.zdjizhi.common.DosDetectionThreshold;
+import com.zdjizhi.common.DosEventLog;
+import com.zdjizhi.common.DosSketchLog;
+
+import com.zdjizhi.utils.IpLookupUtils;
+import com.zdjizhi.utils.SnowflakeId;
+import org.apache.commons.lang3.StringUtils;
+import org.junit.Test;
+
+import java.math.BigDecimal;
+import java.text.NumberFormat;
+import java.util.ArrayList;
+import java.util.HashSet;
+
+public class DosDetectionTest {
+
+    private final static NumberFormat PERCENT_INSTANCE = NumberFormat.getPercentInstance();
+    private final static int BASELINE_SIZE = 144;
+    private final static int STATIC_CONDITION_TYPE = 1;
+    private final static int BASELINE_CONDITION_TYPE = 2;
+    private final static int SENSITIVITY_CONDITION_TYPE = 3;
+
+    private final static String SESSIONS_TAG = "sessions";
+    private final static String PACKETS_TAG = "packets";
+    private final static String BITS_TAG = "bits";
+    @Test
+    public void dosDetectionTest(){
+        DosDetectionThreshold dosDetectionThreshold = new DosDetectionThreshold();
+        ArrayList<String> serverIpList = new ArrayList<>();
+        serverIpList.add("192.168.50.11");
+        serverIpList.add("192.168.50.1/24");
+        serverIpList.add("FC::12:0:0/54");
+        serverIpList.add("FC::12:0:0");
+        dosDetectionThreshold.setProfile_id(4437);
+        dosDetectionThreshold.setAttack_type("DNS Flood");
+        dosDetectionThreshold.setServer_ip_list(serverIpList);
+        dosDetectionThreshold.setSessions_per_sec(1);
+        dosDetectionThreshold.setPackets_per_sec(1);
+        dosDetectionThreshold.setBits_per_sec(100000);
+        dosDetectionThreshold.setIs_valid(1);
+        dosDetectionThreshold.setSuperior_ids(new Integer[]{5,4,12,27});
+
+
+        DosSketchLog dosSketchLog = new DosSketchLog ();
+
+        dosSketchLog.setSketch_sessions(68);
+        dosSketchLog.setSketch_packets(68);
+        dosSketchLog.setSketch_bytes(285820);//185.82
+        dosSketchLog.setVsys_id(1);
+        dosSketchLog.setAttack_type("ICMP Flood");
+        dosSketchLog.setSource_ip("45.170.244.25");
+        dosSketchLog.setDestination_ip("24.152.57.56");
+        //静态阈值获取
+        long sessionBase = dosDetectionThreshold.getSessions_per_sec();
+        long pktBase=dosDetectionThreshold.getPackets_per_sec();
+        long bitBase=dosDetectionThreshold.getBits_per_sec();
+        //基于速率进行计算
+        long diffSession = dosSketchLog.getSketch_sessions() - sessionBase;
+        long diffPkt = dosSketchLog.getSketch_packets() - pktBase;
+        long diffByte = dosSketchLog.getSketch_bytes() - bitBase;
+
+
+        Double diffSessionPercent = getDiffPercent(diffSession, sessionBase)*100;
+        Double diffPktPercent = getDiffPercent(diffPkt, pktBase)*100;
+        Double diffBitPercent = getDiffPercent(diffByte, bitBase)*100;
+        long profileId = 0;
+        DosEventLog result =null;
+        if (diffSessionPercent >= diffPktPercent && diffSessionPercent >= diffBitPercent){
+            profileId = dosDetectionThreshold.getProfile_id();
+            result= getDosEventLog(dosSketchLog, sessionBase, diffSession, profileId, STATIC_CONDITION_TYPE, SESSIONS_TAG);
+            System.out.println(result);
+        }else if (diffPktPercent >= diffSessionPercent && diffPktPercent >= diffBitPercent){
+            profileId = dosDetectionThreshold.getProfile_id();
+            result = getDosEventLog(dosSketchLog, pktBase, diffPkt,profileId, STATIC_CONDITION_TYPE, PACKETS_TAG);
+            System.out.println(result);
+        }else if (diffBitPercent >= diffPktPercent && diffBitPercent >= diffSessionPercent){
+            profileId = dosDetectionThreshold.getProfile_id();
+            result = getDosEventLog(dosSketchLog, bitBase, diffByte, profileId, STATIC_CONDITION_TYPE, BITS_TAG);
+            System.out.println(result);
+        }
+
+
+
+    }
+    private DosEventLog getDosEventLog(DosSketchLog value, long base, long diff, long profileId, int type, String tag) {
+        DosEventLog result = null;
+        String destinationIp = value.getDestination_ip();
+        String attackType = value.getAttack_type();
+        if (diff > 0 && base != 0) {
+            double percent = getDiffPercent(diff, base);
+            Severity severity = judgeSeverity(percent);
+            Integer staticSensitivityThreshold = 100;
+            if (severity != Severity.NORMAL) {
+                if (type == BASELINE_CONDITION_TYPE && percent < 0.2) {
+//                    logger.debug("当前server IP:{},类型:{},基线值{}百分比{}未超过基线敏感阈值,日志详情\n{}", destinationIp, attackType, base, percent, value);
+                }else if ((type == BASELINE_CONDITION_TYPE || type == SENSITIVITY_CONDITION_TYPE) && value.getSketch_sessions() < staticSensitivityThreshold){
+//                    logger.debug("当前server IP:{},类型:{},基线值{}百分比{}未超过静态敏感阈值,日志详情\n{}",destinationIp, attackType, base, percent, value);
+                }else {
+                    result = getResult(value, base, profileId, severity, percent+1, type, tag);
+                    if (type == SENSITIVITY_CONDITION_TYPE){
+                        result.setSeverity(Severity.MAJOR.severity);
+                    }
+//                    logger.info("检测到当前server IP {} 存在 {} 异常,超出基线{} {}倍,基于{}:{}检测,日志详情\n {}", destinationIp,attackType,base,percent,type,tag,result);
+                }
+            }
+//                else {
+//                logger.debug("当前server IP:{} 未出现 {} 异常,日志详情 {}", destinationIp, attackType, value);
+//            }
+        }
+        return result;
+    }
+
+    private DosEventLog getResult(DosSketchLog value, long base, long profileId, Severity severity, double percent, int type, String tag) {
+        DosEventLog dosEventLog = new DosEventLog();
+//        dosEventLog.setLog_id(SnowflakeId.generateId());
+        dosEventLog.setVsys_id(value.getVsys_id());
+        dosEventLog.setStart_time(value.getSketch_start_time());
+        dosEventLog.setEnd_time(value.getSketch_start_time() + value.getSketch_duration());
+        dosEventLog.setProfile_id(profileId);
+        dosEventLog.setAttack_type(value.getAttack_type());
+        dosEventLog.setSeverity(severity.severity);
+//        dosEventLog.setConditions(getConditions(PERCENT_INSTANCE.format(percent), base, value.getSketch_sessions(), type, tag));
+        dosEventLog.setConditions(getConditions(percent, base, value.getSketch_sessions(), type, tag,dosEventLog));
+        dosEventLog.setDestination_ip(value.getDestination_ip());
+//        dosEventLog.setDestination_country(IpUtils.ipLookup.countryLookup(value.getDestination_ip()));
+        String ipList = value.getSource_ip();
+        dosEventLog.setSource_ip_list(ipList);
+        dosEventLog.setSource_country_list(getSourceCountryList(ipList));
+        dosEventLog.setSession_rate(value.getSketch_sessions());
+        dosEventLog.setPacket_rate(value.getSketch_packets());
+        dosEventLog.setBit_rate(value.getSketch_bytes());
+        return dosEventLog;
+    }
+
+    public String getConditions(double percent, long base, long sessions, int type, String tag,DosEventLog dosEventLog) {
+        int condition =0;
+        if ("Minor".equals(dosEventLog.getSeverity())){
+            condition=50;
+        }else if ("Warning".equals(dosEventLog.getSeverity())){
+            condition=100;
+        }else if ("Major".equals(dosEventLog.getSeverity())){
+            condition=250;
+        }else if ("Severe".equals(dosEventLog.getSeverity())){
+            condition=500;
+        }else if ("Critical".equals(dosEventLog.getSeverity())){
+            condition =800;
+        }
+        switch (type) {
+            case STATIC_CONDITION_TYPE:
+                return "Rate > " +
+                        base + " " +
+                        tag + "/s" + "(>"+condition+"%)";
+            case BASELINE_CONDITION_TYPE:
+                return tag + " > " +
+                        PERCENT_INSTANCE.format(percent) + " of baseline";
+            case SENSITIVITY_CONDITION_TYPE:
+                return String.valueOf(sessions) + " " +
+                        tag + "/s Unusually high " +
+                        StringUtils.capitalize(tag);
+            default:
+                throw new IllegalArgumentException("Illegal Argument type:" + type + ", known types = [1,2,3]");
+        }
+    }
+
+
+
+    private String getSourceCountryList(String sourceIpList) {
+        if (StringUtil.isNotBlank(sourceIpList)) {
+            String countryList;
+            try {
+                String[] ipArr = sourceIpList.split(",");
+                HashSet<String> countrySet = new HashSet<>();
+                for (String ip : ipArr) {
+                    String country = IpLookupUtils.getCountryLookup(ip);
+                    if (StringUtil.isNotBlank(country)){
+                        countrySet.add(country);
+                    }
+                }
+                countryList = StringUtils.join(countrySet, ", ");
+                return countryList;
+            } catch (Exception e) {
+//                logger.error("{} source IP lists 获取国家失败", sourceIpList, e);
+                return StringUtil.EMPTY;
+            }
+        } else {
+            throw new IllegalArgumentException("Illegal Argument sourceIpList = null");
+        }
+    }
+
+
+    private Double getDiffPercent(long diff, long base) {
+        return BigDecimal.valueOf((float) diff / base).setScale(4, BigDecimal.ROUND_HALF_UP).doubleValue();
+    }
+
+    private Severity judgeSeverity(double diffPercent) {
+        if (diffPercent >= 0.5 && diffPercent < 1) {
+            return Severity.MINOR;
+        } else if (diffPercent >= 1 && diffPercent < 2.5) {
+            return Severity.WARNING;
+        } else if (diffPercent >= 2.5 && diffPercent < 5) {
+            return Severity.MAJOR;
+        } else if (diffPercent >= 5 && diffPercent < 8) {
+            return Severity.SEVERE;
+        } else if (diffPercent >= 8) {
+            return Severity.CRITICAL;
+        } else {
+            return Severity.NORMAL;
+        }
+    }
+
+    private enum Severity {
+        /**
+         * 判断严重程度枚举类型
+         */
+        CRITICAL("Critical"),
+        SEVERE("Severe"),
+        MAJOR("Major"),
+        WARNING("Warning"),
+        MINOR("Minor"),
+        NORMAL("Normal");
+
+        private final String severity;
+
+        @Override
+        public String toString() {
+            return this.severity;
+        }
+
+        Severity(String severity) {
+            this.severity = severity;
+        }
+
+    }
+}

src/test/java/com/zdjizhi/etl/EtlProcessFunctionTest.java

@@ -0,0 +1,11 @@
+package com.zdjizhi.etl;
+
+import org.junit.Test;
+
+public class EtlProcessFunctionTest {
+
+    @Test
+    public void EtlProcessFunctionTest(){
+
+    }
+}