From a3aa4bbfd72e9a745862b427a0e6dc25f53ceef2 Mon Sep 17 00:00:00 2001 From: samwaf Date: Fri, 2 May 2025 15:43:23 +0800 Subject: [PATCH] feat:spider analysis #163 --- api/entrance.go | 3 ++ api/waf_analysis.go | 36 +++++++++++++++++++++++ api/waf_host.go | 10 ++++--- api/waf_stat.go | 13 --------- model/request/waf_analysis_req.go | 8 +++++ model/response/all_host.go | 5 ++-- model/response/waf_analysis_resp.go | 7 +++++ router/entrance.go | 1 + router/waf_analysis.go | 17 +++++++++++ router/waf_stat.go | 3 -- service/waf_service/waf_analysis.go | 45 +++++++++++++++++++++++++++++ service/waf_service/waf_stat.go | 15 ---------- wafmangeweb/localserver.go | 1 + 13 files changed, 127 insertions(+), 37 deletions(-) create mode 100644 api/waf_analysis.go create mode 100644 model/request/waf_analysis_req.go create mode 100644 model/response/waf_analysis_resp.go create mode 100644 router/waf_analysis.go create mode 100644 service/waf_service/waf_analysis.go diff --git a/api/entrance.go b/api/entrance.go index eaa61b7..a9c3f68 100644 --- a/api/entrance.go +++ b/api/entrance.go @@ -36,6 +36,7 @@ type APIGroup struct { WafBlockingPageApi WafGPTApi WafOtpApi + WafAnalysisApi } var APIGroupAPP = new(APIGroup) @@ -85,4 +86,6 @@ var ( wafBlockingPageService = waf_service.WafBlockingPageServiceApp wafOtpService = waf_service.WafOtpServiceApp + + wafAnalysisService = waf_service.WafAnalysisServiceApp ) diff --git a/api/waf_analysis.go b/api/waf_analysis.go new file mode 100644 index 0000000..6b253d9 --- /dev/null +++ b/api/waf_analysis.go @@ -0,0 +1,36 @@ +package api + +import ( + "SamWaf/model/common/response" + "SamWaf/model/request" + "github.com/gin-gonic/gin" +) + +type WafAnalysisApi struct { +} + +// StatAnalysisDayCountryRangeApi 数据分析界面- 国家级别分析 +func (w *WafAnalysisApi) StatAnalysisDayCountryRangeApi(c *gin.Context) { + var req request.WafStatsAnalysisDayRangeCountryReq + err := c.ShouldBind(&req) + if err == nil { + wafStat := wafAnalysisService.StatAnalysisDayCountryRangeApi(req) + response.OkWithDetailed(wafStat, "获取成功", c) + } else { + + response.FailWithMessage("解析失败", c) + } +} + +// AnalysisSpiderRangeApi 数据分析界面- 爬虫分析 +func (w *WafAnalysisApi) AnalysisSpiderRangeApi(c *gin.Context) { + var req request.WafAnalysisSpiderReq + err := c.ShouldBind(&req) + if err == nil { + bean := wafAnalysisService.AnalysisSpiderApi(req) + response.OkWithDetailed(bean, "获取成功", c) + } else { + + response.FailWithMessage("解析失败", c) + } +} diff --git a/api/waf_host.go b/api/waf_host.go index 3f339e0..e315027 100644 --- a/api/waf_host.go +++ b/api/waf_host.go @@ -121,13 +121,15 @@ func (w *WafHostAPi) GetAllListApi(c *gin.Context) { if wafHosts[i].Ssl == 1 { allHostRep[i] = response2.AllHostRep{ - Host: fmt.Sprintf("%s:%d(SSL)", wafHosts[i].Host, wafHosts[i].Port), - Code: wafHosts[i].Code, + Host: fmt.Sprintf("%s:%d(SSL)", wafHosts[i].Host, wafHosts[i].Port), + Code: wafHosts[i].Code, + PreHost: fmt.Sprintf("%s:%d", wafHosts[i].Host, wafHosts[i].Port), } } else { allHostRep[i] = response2.AllHostRep{ - Host: fmt.Sprintf("%s:%d", wafHosts[i].Host, wafHosts[i].Port), - Code: wafHosts[i].Code, + Host: fmt.Sprintf("%s:%d", wafHosts[i].Host, wafHosts[i].Port), + Code: wafHosts[i].Code, + PreHost: fmt.Sprintf("%s:%d", wafHosts[i].Host, wafHosts[i].Port), } } diff --git a/api/waf_stat.go b/api/waf_stat.go index 1a998a9..7e17945 100644 --- a/api/waf_stat.go +++ b/api/waf_stat.go @@ -48,16 +48,3 @@ func (w *WafStatApi) StatHomeSumDayTopIPRangeApi(c *gin.Context) { response.FailWithMessage("解析失败", c) } } - -// 数据分析界面- 国家级别分析 -func (w *WafStatApi) StatAnalysisDayCountryRangeApi(c *gin.Context) { - var req request.WafStatsAnalysisDayRangeCountryReq - err := c.ShouldBind(&req) - if err == nil { - wafStat := wafStatService.StatAnalysisDayCountryRangeApi(req) - response.OkWithDetailed(wafStat, "获取成功", c) - } else { - - response.FailWithMessage("解析失败", c) - } -} diff --git a/model/request/waf_analysis_req.go b/model/request/waf_analysis_req.go new file mode 100644 index 0000000..1157ca7 --- /dev/null +++ b/model/request/waf_analysis_req.go @@ -0,0 +1,8 @@ +package request + +// 爬虫日志分析 +type WafAnalysisSpiderReq struct { + StartDay string `json:"start_day" form:"start_day"` + EndDay string `json:"end_day" form:"end_day"` + Host string `json:"host" form:"host"` +} diff --git a/model/response/all_host.go b/model/response/all_host.go index 16b96c6..f06004c 100644 --- a/model/response/all_host.go +++ b/model/response/all_host.go @@ -3,8 +3,9 @@ package response import "SamWaf/customtype" type AllHostRep struct { - Code string `json:"value"` //唯一码 - Host string `json:"label"` //域名 + Code string `json:"value"` //唯一码 + Host string `json:"label"` //域名 + PreHost string `json:"pre_host"` //纯域名和端口 } type AllShareDbRep struct { diff --git a/model/response/waf_analysis_resp.go b/model/response/waf_analysis_resp.go new file mode 100644 index 0000000..7e63d03 --- /dev/null +++ b/model/response/waf_analysis_resp.go @@ -0,0 +1,7 @@ +package response + +// WafAnalysisSpiderResp 爬虫分析数据值 +type WafAnalysisSpiderResp struct { + Name string `json:"name" form:"name"` + Value int64 `json:"value" form:"value"` +} diff --git a/router/entrance.go b/router/entrance.go index 5c1d404..c5d177f 100644 --- a/router/entrance.go +++ b/router/entrance.go @@ -34,6 +34,7 @@ type ApiGroup struct { WafBlockingPageRouter WafGPTRouter WafOtpRouter + AnalysisRouter } type PublicApiGroup struct { LoginRouter diff --git a/router/waf_analysis.go b/router/waf_analysis.go new file mode 100644 index 0000000..449c5c5 --- /dev/null +++ b/router/waf_analysis.go @@ -0,0 +1,17 @@ +package router + +import ( + "SamWaf/api" + "github.com/gin-gonic/gin" +) + +type AnalysisRouter struct { +} + +func (receiver *AnalysisRouter) InitAnalysisRouter(group *gin.RouterGroup) { + analysisApi := api.APIGroupAPP.WafAnalysisApi + router := group.Group("") + //数据分析 + router.GET("/samwaf/analysis/wafanalysisdaycountryrange", analysisApi.StatAnalysisDayCountryRangeApi) + router.GET("/samwaf/analysis/spider", analysisApi.AnalysisSpiderRangeApi) +} diff --git a/router/waf_stat.go b/router/waf_stat.go index cc80e28..024c69e 100644 --- a/router/waf_stat.go +++ b/router/waf_stat.go @@ -17,7 +17,4 @@ func (receiver *StatRouter) InitStatRouter(group *gin.RouterGroup) { router.GET("/samwaf/wafstatsumdaytopiprange", statApi.StatHomeSumDayTopIPRangeApi) router.GET("/samwaf/statsysinfo", statApi.StatSysinfoApi) router.GET("/samwaf/statrumtimesysinfo", statApi.StatRumtimeSysinfoApi) - - //数据分析 - router.GET("/samwaf/wafanalysisdaycountryrange", statApi.StatAnalysisDayCountryRangeApi) } diff --git a/service/waf_service/waf_analysis.go b/service/waf_service/waf_analysis.go new file mode 100644 index 0000000..b5370de --- /dev/null +++ b/service/waf_service/waf_analysis.go @@ -0,0 +1,45 @@ +package waf_service + +import ( + "SamWaf/global" + "SamWaf/innerbean" + "SamWaf/model" + "SamWaf/model/request" + response2 "SamWaf/model/response" +) + +type WafAnalysisService struct{} + +var WafAnalysisServiceApp = new(WafAnalysisService) + +// StatAnalysisDayCountryRangeApi 通过时间获取国家级别的 攻击数 访问数 +func (receiver *WafAnalysisService) StatAnalysisDayCountryRangeApi(req request.WafStatsAnalysisDayRangeCountryReq) []response2.WafAnalysisDayStats { + var CountOfRange []response2.WafAnalysisDayStats + if req.AttackType == "" { + global.GWAF_LOCAL_STATS_DB.Model(&model.StatsIPCityDay{}).Where("day between ? and ? and country<>? and country<>? ", + req.StartDay, req.EndDay, "0", "内网").Select(" country as Name ,sum(count) as Value").Group("country").Order("sum(count) desc").Scan(&CountOfRange) + + } else { + global.GWAF_LOCAL_STATS_DB.Model(&model.StatsIPCityDay{}).Where("day between ? and ? and type = ? and country<>? and country<>? ", + req.StartDay, req.EndDay, req.AttackType, "0", "内网").Select(" country as Name ,sum(count) as Value").Group("country").Order("sum(count) desc").Scan(&CountOfRange) + + } + return CountOfRange +} + +// AnalysisSpiderApi 爬虫分析 +func (receiver *WafAnalysisService) AnalysisSpiderApi(req request.WafAnalysisSpiderReq) []response2.WafAnalysisSpiderResp { + var CountOfRange []response2.WafAnalysisSpiderResp + if req.Host == "" { + global.GWAF_LOCAL_LOG_DB.Model(&innerbean.WebLog{}).Where("day between ? and ? and is_bot=1 ", + req.StartDay, req.EndDay).Select(" guest_id_entification as Name ,count(1) as Value"). + Group("guest_id_entification").Order("count(1) desc").Scan(&CountOfRange) + + } else { + global.GWAF_LOCAL_LOG_DB.Model(&innerbean.WebLog{}).Where("day between ? and ? and is_bot=1 and host_code = ? ", + req.StartDay, req.EndDay, req.Host). + Select(" guest_id_entification as Name ,count(1) as Value"). + Group("guest_id_entification").Order("count(1) desc").Scan(&CountOfRange) + } + return CountOfRange +} diff --git a/service/waf_service/waf_stat.go b/service/waf_service/waf_stat.go index 0b56668..1cdfeab 100644 --- a/service/waf_service/waf_stat.go +++ b/service/waf_service/waf_stat.go @@ -162,21 +162,6 @@ func (receiver *WafStatService) StatHomeSumDayTopIPRangeApi(req request.WafStats nil } -// 通过时间获取国家级别的 攻击数 访问数 -func (receiver *WafStatService) StatAnalysisDayCountryRangeApi(req request.WafStatsAnalysisDayRangeCountryReq) []response2.WafAnalysisDayStats { - var CountOfRange []response2.WafAnalysisDayStats - if req.AttackType == "" { - global.GWAF_LOCAL_STATS_DB.Model(&model.StatsIPCityDay{}).Where("day between ? and ? and country<>? and country<>? ", - req.StartDay, req.EndDay, "0", "内网").Select(" country as Name ,sum(count) as Value").Group("country").Order("sum(count) desc").Scan(&CountOfRange) - - } else { - global.GWAF_LOCAL_STATS_DB.Model(&model.StatsIPCityDay{}).Where("day between ? and ? and type = ? and country<>? and country<>? ", - req.StartDay, req.EndDay, req.AttackType, "0", "内网").Select(" country as Name ,sum(count) as Value").Group("country").Order("sum(count) desc").Scan(&CountOfRange) - - } - return CountOfRange -} - // 获取系统基本信息 func (receiver *WafStatService) StatHomeSysinfo(c *gin.Context) response2.WafHomeSysinfoStat { tokenStr := c.GetHeader("X-Token") diff --git a/wafmangeweb/localserver.go b/wafmangeweb/localserver.go index 4cd903c..2c0e938 100644 --- a/wafmangeweb/localserver.go +++ b/wafmangeweb/localserver.go @@ -67,6 +67,7 @@ func (web *WafWebManager) initRouter(r *gin.Engine) { router.ApiGroupApp.InitWafBlockingPageRouter(RouterGroup) router.ApiGroupApp.InitGPTRouter(RouterGroup) router.ApiGroupApp.InitWafOtpRouter(RouterGroup) + router.ApiGroupApp.InitAnalysisRouter(RouterGroup) } if global.GWAF_RELEASE == "true" {