网络流量分析#

public class LateralMovementDetector {
    
    private final Map<String, List<ConnectionRecord>> connectionHistory = 
        new HashMap<>();
    
    public DetectionResult detect(ConnectionRecord conn) {
        String srcIp = conn.getSourceIP();
        String dstIp = conn.getDestIP();
        
        // 检测是否是新发现的主机间连接
        if (isNewInternalConnection(srcIp, dstIp)) {
            // 检查是否是异常的服务连接
            if (isAbnormalService(dstIp, conn.getDestPort())) {
                // 检查连接频率
                if (isHighFrequencyConnection(srcIp)) {
                    return DetectionResult.builder()
                        .type("LATERAL_MOVEMENT")
                        .confidence(0.85)
                        .srcIP(srcIp)
                        .dstIP(dstIp)
                        .description("Suspicious lateral movement detected")
                        .indicators(List.of(
                            "New internal connection",
                            "Access to admin ports",
                            "High connection frequency"
                        ))
                        .build();
                }
            }
        }
        
        return DetectionResult.none();
    }
    
    // 检测数据外传
    public DetectionResult detectExfiltration(HostStatistics stats) {
        // 正常：上行流量 < 下行流量
        // 异常：上行流量异常高
        double uploadRatio = stats.getUploadBytes() / stats.getTotalBytes();
        
        if (uploadRatio > 0.8 && stats.getUploadBytes() > 100 * 1024 * 1024) {
            return DetectionResult.builder()
                .type("DATA_EXFILTRATION")
                .confidence(0.9)
                .ip(stats.getIp())
                .uploadBytes(stats.getUploadBytes())
                .description("Potential data exfiltration detected")
                .build();
        }
        
        return DetectionResult.none();
    }
}

public class DNSTunnelDetector {
    
    private static final int DNS_QUERY_MIN_LENGTH = 50; // 正常查询长度阈值
    private static final int DNS_QUERIES_PER_MINUTE = 100; // 异常频率
    
    public boolean isDNSTunnel(String query, String domain) {
        // 检测 1：查询长度异常
        if (query.length() > DNS_QUERY_MIN_LENGTH) {
            return true;
        }
        
        // 检测 2：子域名熵值高（DGA 特征）
        if (calculateEntropy(domain) > 4.5) {
            return true;
        }
        
        // 检测 3：编码特征（Base64 等）
        if (containsEncodedData(domain)) {
            return true;
        }
        
        return false;
    }
    
    private double calculateEntropy(String str) {
        // 计算字符串熵值
        Map<Character, Integer> freq = new HashMap<>();
        for (char c : str.toCharArray()) {
            freq.merge(c, 1, Integer::sum);
        }
        
        double entropy = 0.0;
        int len = str.length();
        for (Map.Entry<Character, Integer> entry : freq.entrySet()) {
            double p = (double) entry.getValue() / len;
            entropy -= p * Math.log(p) / Math.log(2);
        }
        return entropy;
    }
}

public class JA3Detector {
    
    private static final Map<String, ThreatIntel> JA3_FINGERPRINTS = 
        Map.ofEntries(
            // Cobalt Strike 默认指纹
            Map.entry("4d7a28d6fca53091f07f3cf9a090c25c", 
                ThreatIntel.builder()
                    .threatType("C2")
                    .confidence(0.95)
                    .description("Cobalt Strike C2")
                    .build()),
            
            // Emotet 恶意软件
            Map.entry("a0e9d8c7b3f2a1e0d9c8b7a6f5e4d3c2",
                ThreatIntel.builder()
                    .threatType("Malware")
                    .confidence(0.90)
                    .description("Emotet Botnet")
                    .build())
        );
    
    public Optional<ThreatAlert> detectJA3(String ja3Hash) {
        ThreatIntel intel = JA3_FINGERPRINTS.get(ja3Hash);
        if (intel != null) {
            return Optional.of(ThreatAlert.builder()
                .type("JA3_MATCH")
                .threatType(intel.getThreatType())
                .confidence(intel.getConfidence())
                .description(intel.getDescription())
                .indicator(ja3Hash)
                .action(ThreatAction.BLOCK_OR_ALERT)
                .build());
        }
        return Optional.empty();
    }
}