e2bc4a47cd
- 🔥 Brute Force & Credential Stuffing (view_form_bruteforce_detected) - 🧬 TCP/OS Spoofing (view_tcp_spoofing_detected, 86K détections) - 📡 Header Fingerprint Clustering (agg_header_fingerprint_1h, 1374 clusters) - ⏱️ Heatmap Temporelle (agg_host_ip_ja4_1h, pic à 20h) - 🌍 Botnets Distribués / JA4 spread (view_host_ja4_anomalies) - 🔄 Rotation JA4 & Persistance (view_host_ip_ja4_rotation + view_ip_recurrence) - 🤖 Features ML / Radar (view_ai_features_1h, radar SVG + scatter plot) Backend: 7 nouveaux router FastAPI avec requêtes ClickHouse optimisées Frontend: 7 nouveaux composants React + navigation 'Analyse Avancée' dans la sidebar Fixes: alias fuzzing_index → max_fuzzing (ORDER BY ClickHouse), normalisation IPs ::ffff: Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
106 lines
3.7 KiB
Python
106 lines
3.7 KiB
Python
"""
|
|
Endpoints pour l'analyse des botnets via la propagation des fingerprints JA4
|
|
"""
|
|
from fastapi import APIRouter, HTTPException, Query
|
|
|
|
from ..database import db
|
|
|
|
router = APIRouter(prefix="/api/botnets", tags=["botnets"])
|
|
|
|
|
|
def _botnet_class(unique_countries: int) -> str:
|
|
if unique_countries > 100:
|
|
return "global_botnet"
|
|
if unique_countries > 20:
|
|
return "regional_botnet"
|
|
return "concentrated"
|
|
|
|
|
|
@router.get("/ja4-spread")
|
|
async def get_ja4_spread():
|
|
"""Propagation des JA4 fingerprints à travers les pays et les IPs."""
|
|
try:
|
|
sql = """
|
|
SELECT
|
|
ja4,
|
|
unique_ips,
|
|
unique_countries,
|
|
targeted_hosts
|
|
FROM mabase_prod.view_host_ja4_anomalies
|
|
ORDER BY unique_countries DESC
|
|
"""
|
|
result = db.query(sql)
|
|
items = []
|
|
for row in result.result_rows:
|
|
ja4 = str(row[0])
|
|
unique_ips = int(row[1])
|
|
unique_countries = int(row[2])
|
|
targeted_hosts = int(row[3])
|
|
dist_score = round(
|
|
unique_countries / max(unique_ips ** 0.5, 0.001), 2
|
|
)
|
|
items.append({
|
|
"ja4": ja4,
|
|
"unique_ips": unique_ips,
|
|
"unique_countries": unique_countries,
|
|
"targeted_hosts": targeted_hosts,
|
|
"distribution_score":dist_score,
|
|
"botnet_class": _botnet_class(unique_countries),
|
|
})
|
|
return {"items": items, "total": len(items)}
|
|
except Exception as e:
|
|
raise HTTPException(status_code=500, detail=str(e))
|
|
|
|
|
|
@router.get("/ja4/{ja4}/countries")
|
|
async def get_ja4_countries(ja4: str, limit: int = Query(30, ge=1, le=200)):
|
|
"""Top pays pour un JA4 donné depuis agg_host_ip_ja4_1h."""
|
|
try:
|
|
sql = """
|
|
SELECT
|
|
src_country_code AS country_code,
|
|
uniq(replaceRegexpAll(toString(src_ip), '^::ffff:', '')) AS unique_ips,
|
|
sum(hits) AS hits
|
|
FROM mabase_prod.agg_host_ip_ja4_1h
|
|
WHERE ja4 = %(ja4)s
|
|
GROUP BY src_country_code
|
|
ORDER BY unique_ips DESC
|
|
LIMIT %(limit)s
|
|
"""
|
|
result = db.query(sql, {"ja4": ja4, "limit": limit})
|
|
items = [
|
|
{
|
|
"country_code": str(row[0]),
|
|
"unique_ips": int(row[1]),
|
|
"hits": int(row[2]),
|
|
}
|
|
for row in result.result_rows
|
|
]
|
|
return {"items": items, "total": len(items)}
|
|
except Exception as e:
|
|
raise HTTPException(status_code=500, detail=str(e))
|
|
|
|
|
|
@router.get("/summary")
|
|
async def get_botnets_summary():
|
|
"""Statistiques globales sur les botnets détectés."""
|
|
try:
|
|
sql = """
|
|
SELECT
|
|
countIf(unique_countries > 100) AS total_global_botnets,
|
|
sumIf(unique_ips, unique_countries > 50) AS total_ips_in_botnets,
|
|
argMax(ja4, unique_countries) AS most_spread_ja4,
|
|
argMax(ja4, unique_ips) AS most_ips_ja4
|
|
FROM mabase_prod.view_host_ja4_anomalies
|
|
"""
|
|
result = db.query(sql)
|
|
row = result.result_rows[0]
|
|
return {
|
|
"total_global_botnets": int(row[0]),
|
|
"total_ips_in_botnets": int(row[1]),
|
|
"most_spread_ja4": str(row[2]),
|
|
"most_ips_ja4": str(row[3]),
|
|
}
|
|
except Exception as e:
|
|
raise HTTPException(status_code=500, detail=str(e))
|