feat: super evolution — 20 new security modules with full test coverage
新增20个超进化安全模块 (17 new services + 1 test suite + Dashboard API): - JWT认证服务 (JwtAuthService): 基于HMAC-SHA256的token管理 - 反暴力破解 (BruteForceProtectionService): 渐进延迟+三层时间窗口检测 - 反机器人检测 (AntiBotDetectionService): MC玩家名模式+加入速度+多账号检测 - 反向Shell检测 (ReverseShellDetectionService): 50+ reverse shell模式匹配 - ARP欺骗检测 (ARPSpoofDetectionService): MAC变更+网关欺骗+重复MAC检测 - DNS隧道检测 (DNSTunnelDetectionService): 熵值分析+子域名编码+频率监控 - 漏洞签名检测 (ExploitSignatureService): Log4Shell/SQL注入/XSS等15+签名 - SSRF防护 (SSRFProtectionService): 内网IP/云元数据/编码绕过检测 - XXE防护 (XXEProtectionService): XML实体注入+十亿笑攻击检测 - CSP强制执行 (CSPEnforcementService): XSS/Clickjack防御+安全响应头 - 数据库防火墙 (DatabaseFirewallService): SQL注入+危险关键字+堆叠查询检测 - 数据防泄漏 (DataLossPreventionService): 12种敏感数据模式(邮箱/API Key/SSH Key等) - 内存保护 (MemoryProtectionService): JVM堆监控+GC过载+内存泄漏检测 - 进程注入检测 (ProcessInjectionDetectionService): 线程异常+内存映射+文件描述符 - 安全文件删除 (SecureFileDeletionService): DoD多pass覆写+擦除后删除 - 取证收集器 (ForensicsCollectorService): 进程/网络/文件/日志取证 - 事件响应 (IncidentResponseService): 5套Playbook(DDOS/爆破/入侵/MC漏洞/数据泄露) - 威胁狩猎 (ThreatHuntingService): 10种主动狩猎规则 - 合规扫描 (ComplianceScannerService): 7大类20+项合规检查 - 反破坏检测 (AntiGriefDetectionService): MC方块破坏/放置/实体/容器监控 API端点: DashboardController新增20+个安全API端点 测试: 64个测试全部通过 (12 existing + 52 new)
This commit is contained in:
Peijun Zhao
@@ -0,0 +1,171 @@
|
||||
package com.aluer.security;
|
||||
|
||||
import org.springframework.stereotype.Service;
|
||||
|
||||
import java.lang.management.ManagementFactory;
|
||||
import java.lang.management.MemoryMXBean;
|
||||
import java.lang.management.MemoryUsage;
|
||||
import java.time.Instant;
|
||||
import java.util.*;
|
||||
import java.util.concurrent.ConcurrentHashMap;
|
||||
import java.util.concurrent.Executors;
|
||||
import java.util.concurrent.ScheduledExecutorService;
|
||||
import java.util.concurrent.TimeUnit;
|
||||
import java.util.concurrent.atomic.AtomicLong;
|
||||
|
||||
@Service
|
||||
public class MemoryProtectionService {
|
||||
|
||||
private final MemoryMXBean memoryMXBean = ManagementFactory.getMemoryMXBean();
|
||||
private final ScheduledExecutorService scheduler = Executors.newSingleThreadScheduledExecutor();
|
||||
private final Map<String, List<MemoryAlert>> alerts = new ConcurrentHashMap<>();
|
||||
private final AtomicLong totalAlerts = new AtomicLong(0);
|
||||
|
||||
private static final double HEAP_THRESHOLD = 0.85;
|
||||
private static final double NON_HEAP_THRESHOLD = 0.90;
|
||||
private static final double GC_OVERHEAD_THRESHOLD = 0.15;
|
||||
private static final long MEMORY_CHECK_INTERVAL_SECONDS = 30;
|
||||
|
||||
private long lastGcCount;
|
||||
private long lastGcTime;
|
||||
|
||||
public MemoryProtectionService() {
|
||||
lastGcCount = ManagementFactory.getGarbageCollectorMXBeans().stream()
|
||||
.mapToLong(gc -> gc.getCollectionCount()).sum();
|
||||
lastGcTime = ManagementFactory.getGarbageCollectorMXBeans().stream()
|
||||
.mapToLong(gc -> gc.getCollectionTime()).sum();
|
||||
scheduler.scheduleAtFixedRate(this::checkMemory, MEMORY_CHECK_INTERVAL_SECONDS,
|
||||
MEMORY_CHECK_INTERVAL_SECONDS, TimeUnit.SECONDS);
|
||||
}
|
||||
|
||||
public MemoryCheckResult checkMemory() {
|
||||
List<String> warnings = new ArrayList<>();
|
||||
|
||||
MemoryUsage heap = memoryMXBean.getHeapMemoryUsage();
|
||||
double heapRatio = (double) heap.getUsed() / heap.getMax();
|
||||
if (heapRatio > HEAP_THRESHOLD) {
|
||||
warnings.add("HEAP_HIGH: " + String.format("%.1f%%", heapRatio * 100));
|
||||
MemoryAlert alert = new MemoryAlert(Instant.now(), "HEAP_HIGH",
|
||||
String.format("Heap at %.1f%% (used=%dMB, max=%dMB)", heapRatio * 100,
|
||||
heap.getUsed() / 1024 / 1024, heap.getMax() / 1024 / 1024));
|
||||
alerts.computeIfAbsent("heap", k -> new ArrayList<>()).add(alert);
|
||||
totalAlerts.incrementAndGet();
|
||||
}
|
||||
|
||||
MemoryUsage nonHeap = memoryMXBean.getNonHeapMemoryUsage();
|
||||
double nonHeapRatio = (double) nonHeap.getUsed() / nonHeap.getMax();
|
||||
if (nonHeapRatio > NON_HEAP_THRESHOLD) {
|
||||
warnings.add("NON_HEAP_HIGH: " + String.format("%.1f%%", nonHeapRatio * 100));
|
||||
}
|
||||
|
||||
long currentGcCount = ManagementFactory.getGarbageCollectorMXBeans().stream()
|
||||
.mapToLong(gc -> gc.getCollectionCount()).sum();
|
||||
long currentGcTime = ManagementFactory.getGarbageCollectorMXBeans().stream()
|
||||
.mapToLong(gc -> gc.getCollectionTime()).sum();
|
||||
long gcCountDiff = currentGcCount - lastGcCount;
|
||||
long gcTimeDiff = currentGcTime - lastGcTime;
|
||||
|
||||
if (gcTimeDiff > MEMORY_CHECK_INTERVAL_SECONDS * 1000 * GC_OVERHEAD_THRESHOLD) {
|
||||
warnings.add("GC_OVERHEAD: " + gcTimeDiff + "ms spent in GC");
|
||||
MemoryAlert alert = new MemoryAlert(Instant.now(), "GC_OVERHEAD",
|
||||
String.format("GC overhead: %dms (%d collections)", gcTimeDiff, gcCountDiff));
|
||||
alerts.computeIfAbsent("gc", k -> new ArrayList<>()).add(alert);
|
||||
totalAlerts.incrementAndGet();
|
||||
}
|
||||
lastGcCount = currentGcCount;
|
||||
lastGcTime = currentGcTime;
|
||||
|
||||
// Check for memory leak patterns (steady increase without decrease)
|
||||
String leakPattern = detectLeakPattern();
|
||||
if (leakPattern != null) {
|
||||
warnings.add("MEMORY_LEAK: " + leakPattern);
|
||||
}
|
||||
|
||||
return new MemoryCheckResult(
|
||||
heapRatio, nonHeapRatio, heap.getUsed() / 1024 / 1024,
|
||||
heap.getMax() / 1024 / 1024, gcCountDiff, gcTimeDiff, warnings);
|
||||
}
|
||||
|
||||
public Map<String, Object> getStatus() {
|
||||
Map<String, Object> status = new LinkedHashMap<>();
|
||||
MemoryUsage heap = memoryMXBean.getHeapMemoryUsage();
|
||||
status.put("heapUsedMB", heap.getUsed() / 1024 / 1024);
|
||||
status.put("heapMaxMB", heap.getMax() / 1024 / 1024);
|
||||
status.put("heapRatio", String.format("%.1f%%", (double) heap.getUsed() / heap.getMax() * 100));
|
||||
status.put("nonHeapUsedMB", memoryMXBean.getNonHeapMemoryUsage().getUsed() / 1024 / 1024);
|
||||
status.put("totalAlerts", totalAlerts.get());
|
||||
status.put("leakDetected", detectLeakPattern() != null);
|
||||
return status;
|
||||
}
|
||||
|
||||
public long getTotalAlerts() { return totalAlerts.get(); }
|
||||
|
||||
public void forceGC() {
|
||||
System.gc();
|
||||
}
|
||||
|
||||
private String detectLeakPattern() {
|
||||
List<MemoryAlert> heapAlerts = alerts.get("heap");
|
||||
if (heapAlerts == null || heapAlerts.size() < 5) return null;
|
||||
boolean trending = true;
|
||||
double prev = 0;
|
||||
int consecutive = 0;
|
||||
for (int i = Math.max(0, heapAlerts.size() - 10); i < heapAlerts.size(); i++) {
|
||||
double current = extractHeapPercent(heapAlerts.get(i).message);
|
||||
if (current >= prev) consecutive++;
|
||||
else consecutive = 0;
|
||||
if (consecutive >= 5) return "Heap usage consistently increasing over 5+ checks";
|
||||
prev = current;
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
private double extractHeapPercent(String message) {
|
||||
try {
|
||||
String pct = message.replaceAll(".*?(\\d+\\.?\\d*)%.*", "$1");
|
||||
return Double.parseDouble(pct);
|
||||
} catch (Exception e) {
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
|
||||
private static class MemoryAlert {
|
||||
final Instant timestamp;
|
||||
final String type;
|
||||
final String message;
|
||||
|
||||
MemoryAlert(Instant timestamp, String type, String message) {
|
||||
this.timestamp = timestamp;
|
||||
this.type = type;
|
||||
this.message = message;
|
||||
}
|
||||
}
|
||||
|
||||
public static class MemoryCheckResult {
|
||||
private final double heapRatio;
|
||||
private final double nonHeapRatio;
|
||||
private final long heapUsedMB;
|
||||
private final long heapMaxMB;
|
||||
private final long gcCount;
|
||||
private final long gcTimeMs;
|
||||
private final List<String> warnings;
|
||||
|
||||
MemoryCheckResult(double heapRatio, double nonHeapRatio, long heapUsedMB, long heapMaxMB,
|
||||
long gcCount, long gcTimeMs, List<String> warnings) {
|
||||
this.heapRatio = heapRatio;
|
||||
this.nonHeapRatio = nonHeapRatio;
|
||||
this.heapUsedMB = heapUsedMB;
|
||||
this.heapMaxMB = heapMaxMB;
|
||||
this.gcCount = gcCount;
|
||||
this.gcTimeMs = gcTimeMs;
|
||||
this.warnings = warnings;
|
||||
}
|
||||
|
||||
public double getHeapRatio() { return heapRatio; }
|
||||
public long getHeapUsedMB() { return heapUsedMB; }
|
||||
public long getHeapMaxMB() { return heapMaxMB; }
|
||||
public long getGcTimeMs() { return gcTimeMs; }
|
||||
public List<String> getWarnings() { return warnings; }
|
||||
public boolean hasWarnings() { return !warnings.isEmpty(); }
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user