126 lines
3.3 KiB
Go
126 lines
3.3 KiB
Go
package detector
|
|
|
|
import (
|
|
"bufio"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"sysmonitord/internal/config"
|
|
"sysmonitord/internal/scanner/hash"
|
|
"sysmonitord/internal/scanner/process"
|
|
"sysmonitord/internal/storage"
|
|
"sysmonitord/pkg/logger"
|
|
"time"
|
|
|
|
"go.uber.org/zap"
|
|
)
|
|
|
|
type ProcessDetector struct {
|
|
cfg *config.Config
|
|
whiteList map[string]string
|
|
storagePath string
|
|
eventChan chan storage.DubiousProcessInfo
|
|
}
|
|
|
|
func NewProcessDetector(cfg *config.Config) (*ProcessDetector, error) {
|
|
p := &ProcessDetector{
|
|
cfg: cfg,
|
|
whiteList: make(map[string]string),
|
|
eventChan: make(chan storage.DubiousProcessInfo, 100),
|
|
}
|
|
|
|
p.loadWhiteList()
|
|
return p, nil
|
|
}
|
|
|
|
func (p *ProcessDetector) loadWhiteList() {
|
|
filepath := filepath.Join(p.cfg.Storage.DataDir, p.cfg.Storage.ProcessSystemFile)
|
|
file, err := os.Open(filepath)
|
|
if err != nil {
|
|
logger.Log.Error("[monitor] 加载进程白名单失败", zap.String("file", filepath), zap.Error(err))
|
|
return
|
|
}
|
|
defer file.Close()
|
|
|
|
scanner := bufio.NewScanner(file)
|
|
for scanner.Scan() {
|
|
line := scanner.Text()
|
|
if line == "" || strings.HasPrefix(line, "#") {
|
|
continue
|
|
}
|
|
|
|
parts := strings.Split(line, ":")
|
|
if len(parts) >= 3 {
|
|
p.whiteList[parts[1]] = parts[2] // name:path:hash
|
|
}
|
|
}
|
|
|
|
logger.Log.Info("[monitor] 进程白名单加载完成", zap.Int("count", len(p.whiteList)))
|
|
}
|
|
|
|
func (p *ProcessDetector) Run() error {
|
|
logger.Log.Info("[monitor] 进程检测已启动")
|
|
|
|
currentProcs, err := process.ScanAllProcesses(p.cfg)
|
|
if err != nil {
|
|
logger.Log.Error("[monitor] 扫描进程失败", zap.Error(err))
|
|
return nil
|
|
}
|
|
|
|
newCount := 0
|
|
for _, proc := range currentProcs {
|
|
_, exists := p.whiteList[proc.Path]
|
|
if !exists {
|
|
logger.Log.Warn("[monitor] 发现新进程", zap.String("name", proc.Name), zap.String("path", proc.Path))
|
|
newCount++
|
|
|
|
dubiousProcess := storage.DubiousProcessInfo{
|
|
PID: proc.PID,
|
|
Name: proc.Name,
|
|
Path: proc.Path,
|
|
Cmdline: proc.Cmdline,
|
|
DiscoveredAt: time.Now().Format("2006-01-02 15:04:05"),
|
|
}
|
|
|
|
select {
|
|
case p.eventChan <- dubiousProcess:
|
|
default:
|
|
logger.Log.Warn("[monitor] 进程事件通道已满，丢弃事件", zap.Int32("pid", proc.PID), zap.String("name", proc.Name))
|
|
}
|
|
}
|
|
}
|
|
|
|
logger.Log.Info("[monitor] 进程检测完成", zap.Int("total", len(currentProcs)), zap.Int("new", newCount))
|
|
return nil
|
|
}
|
|
|
|
func (p *ProcessDetector) Event() <-chan storage.DubiousProcessInfo {
|
|
return p.eventChan
|
|
}
|
|
|
|
func (p *ProcessDetector) HandleDubiousProcesses(proc storage.DubiousProcessInfo) {
|
|
|
|
hashCfg, err := p.cfg.GetHashConfig()
|
|
if err != nil {
|
|
logger.Log.Error("[monitor] 获取哈希配置失败", zap.Error(err))
|
|
}
|
|
|
|
logger.Log.Debug("[monitor] 处理可疑进程", zap.Int32("pid", proc.PID), zap.String("name", proc.Name), zap.String("path", proc.Path))
|
|
|
|
procHash, err := hash.Calculate(proc.Path, 0, hashCfg)
|
|
if err != nil {
|
|
logger.Log.Error("[monitor] 计算进程哈希失败", zap.String("path", proc.Path), zap.Error(err))
|
|
}
|
|
|
|
proc.FileHash = procHash
|
|
|
|
if err := storage.SaveDubiousProcesses(proc, p.cfg.Storage.DataDir, p.cfg.Storage.DubiousProcessListFile); err != nil {
|
|
logger.Log.Error("[monitor] 保存可疑进程失败", zap.Int32("pid", proc.PID), zap.String("name", proc.Name), zap.String("path", proc.Path), zap.Error(err))
|
|
}
|
|
|
|
}
|
|
|
|
func (p *ProcessDetector) Name() string {
|
|
return "ProcessMonitor"
|
|
}
|