A:增加GUID获取网卡信息；增加数据库Models

2025-08-01 14:57:35 +08:00
1 parent 6f2418af7b
commit 2fb4de59d9
@@ -16,6 +16,7 @@
      <PackageReference Include="Serilog.Settings.Configuration" Version="9.0.1-dev-02317" />
      <PackageReference Include="Serilog.Sinks.Console" Version="6.0.1-dev-00953" />
      <PackageReference Include="Serilog.Sinks.File" Version="7.0.0" />
+        <PackageReference Include="System.Management" Version="10.0.0-preview.6.25358.103"/>
    </ItemGroup>

 </Project>
@@ -0,0 +1,59 @@
+using System.Management;
+using System;
+
+
+namespace Common.Utils;
+
+public class NetworkAdapterHelper
+{
+    /// <summary>
+    /// 通过 GUID 获取网卡信息
+    /// </summary>
+    /// <param name="guid"></param>
+    /// <returns></returns>
+    public static NetworkInfo? GetNetworkInfoByGuid(string guid)
+    {
+        try
+        {
+            // 注意：WMI中的网卡ID格式，通常是网卡GUID，但带大括号和大小写等，处理一下格式
+            string formattedGuid = guid;
+            if (!guid.StartsWith("{"))
+                formattedGuid = "{" + guid + "}";
+            if (!guid.EndsWith("}"))
+                formattedGuid = formattedGuid + "}";
+
+            string query = $"SELECT * FROM Win32_NetworkAdapter WHERE GUID = '{formattedGuid}'";
+            using (var searcher = new ManagementObjectSearcher(query))
+            {
+                foreach (ManagementObject mo in searcher.Get())
+                {
+                    return new NetworkInfo
+                    {
+                        Name = mo["Name"]?.ToString(),
+                        Description = mo["Description"]?.ToString(),
+                        MACAddress = mo["MACAddress"]?.ToString(),
+                        NetConnectionID = mo["NetConnectionID"]?.ToString(),
+                        Speed = mo["Speed"] != null ? Convert.ToInt64(mo["Speed"]) : 0,
+                        Status = mo["Status"]?.ToString()
+                    };
+                }
+            }
+        }
+        catch (Exception ex)
+        {
+            Console.WriteLine("Error getting network info: " + ex.Message);
+        }
+
+        return null;
+    }
+}
+
+public class NetworkInfo
+{
+    public string? Name { get; set; }
+    public string? Description { get; set; }
+    public string? MACAddress { get; set; }
+    public string? NetConnectionID { get; set; }
+    public long Speed { get; set; }
+    public string? Status { get; set; }
+}
@@ -2,4 +2,101 @@

 public class Class1
 {
-}
+}
+
+/*
+
+软件信息的记录：
+名字、路径、版本、公司、ICON等
+
+归档与清理任务的调度
+使用 BackgroundWorker / Timer / Task 定期执行：
+按月归档
+删除旧数据
+合并压缩历史数据（比如求平均/最大/最小）
+
+异常崩溃后的恢复
+建议使用 WAL 模式 + 定期备份数据库文件。
+
+常见的异常事件类型：
+连接异常
+连接失败（如 TCP 三次握手失败）
+连接超时、断开异常
+流量异常
+突然流量暴增或骤降
+单个 IP/端口流量异常（过高或过低）
+安全告警
+访问黑名单 IP 或域名
+非法端口访问（比如非标准端口被访问）
+端口扫描行为检测
+异常登录/连接尝试
+软件异常
+某进程网络异常终止
+网络接口断开或重连
+系统网络错误（如 DNS 解析失败）
+
+
+
+事件日志的记录结构建议
+| 字段       | 说明                          |
+| -------- | --------------------------- |
+| 事件ID     | 唯一标识                        |
+| 时间戳      | 事件发生时间                      |
+| 事件类型     | 如“连接失败”、“异常流量”、“黑名单访问”等     |
+| 相关进程/应用  | 关联的进程路径或名称（如果有）             |
+| 本地 IP/端口 | 事件关联的本地地址                   |
+| 远程 IP/端口 | 事件关联的远程地址                   |
+| 事件描述     | 详细描述，如“连接 8.8.8.8:443 超过阈值” |
+| 严重等级     | Info/Warning/Error/Critical |
+| 额外数据     | 可 JSON 格式存储其他细节信息           |
+
+
+
+CREATE TABLE event_log (
+event_id INTEGER PRIMARY KEY AUTOINCREMENT,
+timestamp DATETIME NOT NULL,
+event_type TEXT NOT NULL,
+process_path TEXT,
+local_ip TEXT,
+local_port INTEGER,
+remote_ip TEXT,
+remote_port INTEGER,
+severity TEXT NOT NULL,
+description TEXT,
+extra_data TEXT -- JSON 格式可选
+);
+
+
+
+端口扫描行为如何检测？
+检测思路
+短时间内对多个端口发起连接尝试：
+
+同一源 IP 在短时间内向同一目标 IP 扫描多个端口。
+
+大量连接失败：
+
+多个端口连接失败，说明可能是扫描。
+
+连接速率异常：
+
+短时间内连接速率远高于正常业务连接。
+
+实现方法
+滑动时间窗口统计：记录单位时间内访问某目标IP的端口次数。
+
+阈值判断：超过阈值触发告警。
+
+结合连接失败率：如果大部分端口连接失败，更可能是扫描。
+
+黑名单过滤：过滤已知安全扫描器IP。
+
+
+
+
+第一个版本只记录和分析数据，不进行异常信息监控和警告
+
+
+
+
+ */
@@ -1,9 +1,18 @@
 <Project Sdk="Microsoft.NET.Sdk">

    <PropertyGroup>
-        <TargetFramework>net8.0</TargetFramework>
+        <TargetFramework>net8.0-windows</TargetFramework>
        <ImplicitUsings>enable</ImplicitUsings>
        <Nullable>enable</Nullable>
    </PropertyGroup>

+    <ItemGroup>
+        <ProjectReference Include="..\Utils.ETW\Utils.ETW.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <PackageReference Include="Dapper" Version="2.1.66"/>
+        <PackageReference Include="System.Data.SQLite.Core" Version="1.0.119"/>
+    </ItemGroup>
+
 </Project>
@@ -0,0 +1,36 @@
+namespace Data.Models;
+
+// 
+/// <summary>
+/// 软件信息
+/// </summary>
+public class AppInfo
+{
+    public int Id { get; set; }
+
+    /// <summary>
+    /// 名字
+    /// </summary>
+    public string Name { get; set; }
+
+    public string Path { get; set; }
+    public string Version { get; set; }
+    public string Company { get; set; }
+    public string Base64Icon { get; set; }
+    public string Hash { get; set; }
+
+    /// <summary>
+    /// 首次插入时间
+    /// </summary>
+    public long InsertTime { get; set; }
+
+    /// <summary>
+    /// 更新时间
+    /// </summary>
+    public long UpdateTime { get; set; }
+
+    /// <summary>
+    /// 删除时间 （-1 或 0 是未删除）
+    /// </summary>
+    public long DeleteTime { get; set; }
+}
@@ -0,0 +1,14 @@
+namespace Data.Models;
+
+public class AppNetwork
+{
+    //时间戳
+    //本地IP
+    //本地端口
+    //远程IP
+    //远程端口
+    //协议
+    //上传字节
+    //下载字节
+    //可执行文件路径
+}
@@ -0,0 +1,25 @@
+namespace Data.Models;
+
+public class GlobalNetwork
+{
+    /// <summary>
+    /// 时间戳
+    /// </summary>
+    public long Timestep { get; set; }
+
+    /// <summary>
+    /// 上传量    
+    /// </summary>
+    /// <returns></returns>
+    public long Upload { get; set; }
+
+    /// <summary>
+    /// 下载量
+    /// </summary>
+    public long Download { get; set; }
+
+    /// <summary>
+    /// 网卡 Guid
+    /// </summary>
+    public string NetworkCardGuid { get; set; }
+}
@@ -24,6 +24,7 @@
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003AINetFwRule_002Ecs_002Fl_003AC_0021_003FUsers_003Fcharlatans_003FAppData_003FRoaming_003FJetBrains_003FRider2025_002E1_003Fresharper_002Dhost_003FDecompilerCache_003Fdecompiler_003Fd2ed9a92e29d4a0f91826359e93c440c4c00_003F5c_003F4c2f5fe4_003FINetFwRule_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003AIPAddress_002Ecs_002Fl_003AC_0021_003FUsers_003Fcharlatans_003FAppData_003FRoaming_003FJetBrains_003FRider2025_002E1_003Fresharper_002Dhost_003FDecompilerCache_003Fdecompiler_003F5dc54dc133694e6ca1812e5e56e958df388a0_003F68_003F0bc1a452_003FIPAddress_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003AIPEndPoint_002Ecs_002Fl_003AC_0021_003FUsers_003Fyllyo_003FAppData_003FRoaming_003FJetBrains_003FRider2025_002E1_003Fresharper_002Dhost_003FDecompilerCache_003Fdecompiler_003Fdc231f7ab11c4da0b27a11c2ad4b9b4038938_003F06_003Fc689d816_003FIPEndPoint_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
+	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003AIPv4InterfaceStatistics_002Ecs_002Fl_003AC_0021_003FUsers_003Fyllyo_003FAppData_003FRoaming_003FJetBrains_003FRider2025_002E1_003Fresharper_002Dhost_003FDecompilerCache_003Fdecompiler_003F92cb821cac5045cbbf918dc41b2ea2ca26920_003F74_003Fe3a7e456_003FIPv4InterfaceStatistics_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003AIWebSocketConnectionInfo_002Ecs_002Fl_003AC_0021_003FUsers_003Fyllyo_003FAppData_003FRoaming_003FJetBrains_003FRider2025_002E1_003Fresharper_002Dhost_003FDecompilerCache_003Fdecompiler_003Fa7d96aff8e344c1d9aa8042f229d493cae00_003F54_003Ff0e67f89_003FIWebSocketConnectionInfo_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003AIWebSocketConnection_002Ecs_002Fl_003AC_0021_003FUsers_003Fcharlatans_003FAppData_003FRoaming_003FJetBrains_003FRider2025_002E1_003Fresharper_002Dhost_003FDecompilerCache_003Fdecompiler_003Fa7d96aff8e344c1d9aa8042f229d493cae00_003Fc1_003Fb154f2eb_003FIWebSocketConnection_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003AIWebSocketConnection_002Ecs_002Fl_003AC_0021_003FUsers_003Fyllyo_003FAppData_003FRoaming_003FJetBrains_003FRider2025_002E1_003Fresharper_002Dhost_003FDecompilerCache_003Fdecompiler_003Fa7d96aff8e344c1d9aa8042f229d493cae00_003Fc1_003Fb154f2eb_003FIWebSocketConnection_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
@@ -35,6 +36,7 @@
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003AMonitor_002Ecs_002Fl_003AC_0021_003FUsers_003Fcharlatans_003FAppData_003FRoaming_003FJetBrains_003FRider2025_002E1_003Fresharper_002Dhost_003FDecompilerCache_003Fdecompiler_003F211e6f3b24fa438a92f1815153647ce2c8f908_003Fb5_003F0c446809_003FMonitor_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003ANetworkInterfaceType_002Ecs_002Fl_003AC_0021_003FUsers_003Fyllyo_003FAppData_003FRoaming_003FJetBrains_003FRider2025_002E1_003Fresharper_002Dhost_003FDecompilerCache_003Fdecompiler_003F92cb821cac5045cbbf918dc41b2ea2ca26920_003Fa4_003F57cbd2f9_003FNetworkInterfaceType_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003ANetworkInterface_002Ecs_002Fl_003AC_0021_003FUsers_003Fcharlatans_003FAppData_003FRoaming_003FJetBrains_003FRider2025_002E1_003Fresharper_002Dhost_003FDecompilerCache_003Fdecompiler_003F9c72a65889eb40ae9d8e0f130d1572e0268a0_003F34_003F49f5e6ff_003FNetworkInterface_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
+	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003ANetworkInterface_002Ecs_002Fl_003AC_0021_003FUsers_003Fyllyo_003FAppData_003FRoaming_003FJetBrains_003FRider2025_002E1_003Fresharper_002Dhost_003FDecompilerCache_003Fdecompiler_003F92cb821cac5045cbbf918dc41b2ea2ca26920_003F35_003Fdb05c251_003FNetworkInterface_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003AProcessModule_002Ecs_002Fl_003AC_0021_003FUsers_003Fyllyo_003FAppData_003FRoaming_003FJetBrains_003FRider2025_002E1_003Fresharper_002Dhost_003FDecompilerCache_003Fdecompiler_003Fa70eaad10e4f42d4a1f24ff3865c6c6252928_003Fec_003F0881d57a_003FProcessModule_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003AProcess_002Ecs_002Fl_003AC_0021_003FUsers_003Fcharlatans_003FAppData_003FRoaming_003FJetBrains_003FRider2025_002E1_003Fresharper_002Dhost_003FDecompilerCache_003Fdecompiler_003F0d82aa51d3914b469b94baa8bc2312c052910_003F11_003Fa7f7fe71_003FProcess_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
 	<s:String x:Key="/Default/CodeInspection/ExcludedFiles/FilesAndFoldersToSkip2/=7020124F_002D9FFC_002D4AC3_002D8F3D_002DAAB8E0240759_002Ff_003AProcess_002Ecs_002Fl_003AC_0021_003FUsers_003Fcharlatans_003FAppData_003FRoaming_003FJetBrains_003FRider2025_002E1_003Fresharper_002Dhost_003FDecompilerCache_003Fdecompiler_003F4a26a752ec6249c4a090905d31c0cdfa528a0_003F8f_003F7037e590_003FProcess_002Ecs/@EntryIndexedValue">ForceIncluded</s:String>
@@ -323,7 +323,7 @@ public sealed class GlobalNetworkMonitor
            },
            (key, existing) =>
            {
-                // ✅ 修复：防止流量统计出现负数
+                // 防止流量统计出现负数
                if (isLocal)
                {
                    // 如果新值小于现有值，可能是计数器重置，累加当前值