3dfeba860b
- Add docs/commenting-standard.md defining per-language comment standards (Go godoc, Python PEP-257, C Doxygen, Bash header blocks, SQL banners) - services/dashboard: 100% docstring coverage (100/100 functions) - All FastAPI route handlers, helpers, classes, and models documented - Language: French (project convention) - services/bot-detector: 100% docstring coverage (53/53 symbols) - bot_detector.py: 14 functions + module docstring - anubis/fetch_rules.py: 9 functions - shared/python/ja4_common: full docstrings on ClickHouseClient (7 methods) and ClickHouseSettings class - services/correlator: 24 godoc comments added across 6 Go files - correlation_service.go: 10 private helpers - unixsocket/source.go: 6 parsing/socket helpers - correlated_log.go: 4 field extraction helpers - orchestrator.go, logger.go, main.go: 4 comments - services/correlator/scripts/audit-architecture.sh: standardized header block Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
108 lines
3.8 KiB
Python
108 lines
3.8 KiB
Python
"""
|
|
Endpoints pour l'analyse des botnets via la propagation des fingerprints JA4
|
|
"""
|
|
from fastapi import APIRouter, HTTPException, Query
|
|
|
|
from ..database import db
|
|
from ..config import settings
|
|
|
|
router = APIRouter(prefix="/api/botnets", tags=["botnets"])
|
|
|
|
|
|
def _botnet_class(unique_countries: int) -> str:
|
|
"""Classifie un JA4 selon sa dispersion géographique."""
|
|
if unique_countries > 100:
|
|
return "global_botnet"
|
|
if unique_countries > 20:
|
|
return "regional_botnet"
|
|
return "concentrated"
|
|
|
|
|
|
@router.get("/ja4-spread")
|
|
async def get_ja4_spread():
|
|
"""Propagation des JA4 fingerprints à travers les pays et les IPs."""
|
|
try:
|
|
sql = f"""
|
|
SELECT
|
|
ja4,
|
|
unique_ips,
|
|
unique_countries,
|
|
targeted_hosts
|
|
FROM {settings.CLICKHOUSE_DB_PROCESSING}.view_host_ja4_anomalies
|
|
ORDER BY unique_countries DESC
|
|
"""
|
|
result = db.query(sql)
|
|
items = []
|
|
for row in result.result_rows:
|
|
ja4 = str(row[0])
|
|
unique_ips = int(row[1])
|
|
unique_countries = int(row[2])
|
|
targeted_hosts = int(row[3])
|
|
dist_score = round(
|
|
unique_countries / max(unique_ips ** 0.5, 0.001), 2
|
|
)
|
|
items.append({
|
|
"ja4": ja4,
|
|
"unique_ips": unique_ips,
|
|
"unique_countries": unique_countries,
|
|
"targeted_hosts": targeted_hosts,
|
|
"distribution_score":dist_score,
|
|
"botnet_class": _botnet_class(unique_countries),
|
|
})
|
|
return {"items": items, "total": len(items)}
|
|
except Exception as e:
|
|
raise HTTPException(status_code=500, detail=str(e))
|
|
|
|
|
|
@router.get("/ja4/{ja4}/countries")
|
|
async def get_ja4_countries(ja4: str, limit: int = Query(30, ge=1, le=200)):
|
|
"""Top pays pour un JA4 donné depuis agg_host_ip_ja4_1h."""
|
|
try:
|
|
sql = f"""
|
|
SELECT
|
|
src_country_code AS country_code,
|
|
uniq(replaceRegexpAll(toString(src_ip), '^::ffff:', '')) AS unique_ips,
|
|
sum(hits) AS hits
|
|
FROM {settings.CLICKHOUSE_DB_PROCESSING}.agg_host_ip_ja4_1h
|
|
WHERE ja4 = %(ja4)s
|
|
GROUP BY src_country_code
|
|
ORDER BY unique_ips DESC
|
|
LIMIT %(limit)s
|
|
"""
|
|
result = db.query(sql, {"ja4": ja4, "limit": limit})
|
|
items = [
|
|
{
|
|
"country_code": str(row[0]),
|
|
"unique_ips": int(row[1]),
|
|
"hits": int(row[2]),
|
|
}
|
|
for row in result.result_rows
|
|
]
|
|
return {"items": items, "total": len(items)}
|
|
except Exception as e:
|
|
raise HTTPException(status_code=500, detail=str(e))
|
|
|
|
|
|
@router.get("/summary")
|
|
async def get_botnets_summary():
|
|
"""Statistiques globales sur les botnets détectés."""
|
|
try:
|
|
sql = f"""
|
|
SELECT
|
|
countIf(unique_countries > 100) AS total_global_botnets,
|
|
sumIf(unique_ips, unique_countries > 50) AS total_ips_in_botnets,
|
|
argMax(ja4, unique_countries) AS most_spread_ja4,
|
|
argMax(ja4, unique_ips) AS most_ips_ja4
|
|
FROM {settings.CLICKHOUSE_DB_PROCESSING}.view_host_ja4_anomalies
|
|
"""
|
|
result = db.query(sql)
|
|
row = result.result_rows[0]
|
|
return {
|
|
"total_global_botnets": int(row[0]),
|
|
"total_ips_in_botnets": int(row[1]),
|
|
"most_spread_ja4": str(row[2]),
|
|
"most_ips_ja4": str(row[3]),
|
|
}
|
|
except Exception as e:
|
|
raise HTTPException(status_code=500, detail=str(e))
|