U:调整结构性目录
This commit is contained in:
jimmy committed
1 parent
693b390df0
commit
c255419412
172 files changed
+839
-18898
No files matched your search
@@ -0,0 +1,159 @@
|
||||
using System.Net;
|
||||
|
||||
namespace Utils.ETW.Models;
|
||||
|
||||
/// <summary>
|
||||
/// 网络事件公共数据结构定义
|
||||
/// </summary>
|
||||
public class NetworkEventData
|
||||
{
|
||||
/// <summary>
|
||||
/// 记录产生时间
|
||||
/// </summary>
|
||||
public DateTime Timestamp { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// 事件类型
|
||||
/// </summary>
|
||||
public string EventType { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// 进程 ID
|
||||
/// </summary>
|
||||
public int ProcessId { get; set; }
|
||||
|
||||
public int ThreadId { get; set; }
|
||||
public string ProcessName { get; set; }
|
||||
public IPAddress SourceIp { get; set; }
|
||||
public IPAddress DestinationIp { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// 源端口
|
||||
/// </summary>
|
||||
public int SourcePort { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// 目标端口
|
||||
/// </summary>
|
||||
public int DestinationPort { get; set; }
|
||||
|
||||
public string Protocol { get; set; }
|
||||
public int DataLength { get; set; }
|
||||
public TrafficDirection Direction { get; set; } // Inbound/Outbound
|
||||
public Dictionary<string, object> AdditionalProperties { get; set; }
|
||||
|
||||
public NetworkEventData()
|
||||
{
|
||||
AdditionalProperties = new Dictionary<string, object>();
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// TCP 连接数据配置
|
||||
/// </summary>
|
||||
public class TcpConnectionSession : NetworkEventData
|
||||
{
|
||||
public long ConnectionId { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// 开始时间
|
||||
/// </summary>
|
||||
public DateTime StartTime { get; set; }
|
||||
|
||||
public DateTime? EndTime { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// 发送的字节数
|
||||
/// </summary>
|
||||
public long BytesSent { get; set; }
|
||||
|
||||
public long BytesReceived { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// 持续时间
|
||||
/// </summary>
|
||||
public TimeSpan Duration => (EndTime ?? DateTime.Now) - StartTime;
|
||||
|
||||
public List<string> Events { get; set; } = new List<string>();
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// TCP连接事件数据
|
||||
/// </summary>
|
||||
public class TcpConnectionEventData : NetworkEventData
|
||||
{
|
||||
/// <summary>
|
||||
/// 连接状态
|
||||
/// </summary>
|
||||
public string ConnectionState { get; set; } // ESTABLISHED, CLOSED, LISTEN等
|
||||
public long ConnectionId { get; set; }
|
||||
/// <summary>
|
||||
/// 顺序
|
||||
/// </summary>
|
||||
public int SequenceNumber { get; set; }
|
||||
public int AcknowledgmentNumber { get; set; }
|
||||
public int WindowSize { get; set; }
|
||||
public string TcpFlags { get; set; }
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// UDP数据包事件数据
|
||||
/// </summary>
|
||||
public class UdpPacketEventData : NetworkEventData
|
||||
{
|
||||
public int UdpLength { get; set; }
|
||||
public int Checksum { get; set; }
|
||||
}
|
||||
|
||||
// DNS查询事件数据
|
||||
public class DnsEventData : NetworkEventData
|
||||
{
|
||||
public string QueryName { get; set; }
|
||||
public string QueryType { get; set; }
|
||||
public string ResponseCode { get; set; }
|
||||
public List<string> ResolvedAddresses { get; set; }
|
||||
public int QueryId { get; set; }
|
||||
|
||||
public DnsEventData()
|
||||
{
|
||||
ResolvedAddresses = new List<string>();
|
||||
}
|
||||
}
|
||||
|
||||
// HTTP事件数据
|
||||
public class HttpEventData : NetworkEventData
|
||||
{
|
||||
public string HttpMethod { get; set; }
|
||||
public string Url { get; set; }
|
||||
public int StatusCode { get; set; }
|
||||
public string UserAgent { get; set; }
|
||||
public string Host { get; set; }
|
||||
public Dictionary<string, string> Headers { get; set; }
|
||||
public long ContentLength { get; set; }
|
||||
|
||||
public HttpEventData()
|
||||
{
|
||||
Headers = new Dictionary<string, string>();
|
||||
}
|
||||
}
|
||||
|
||||
// 网络接口事件数据
|
||||
public class NetworkInterfaceEventData : NetworkEventData
|
||||
{
|
||||
public string InterfaceName { get; set; }
|
||||
public string InterfaceType { get; set; }
|
||||
public string MacAddress { get; set; }
|
||||
public string InterfaceState { get; set; } // Up/Down
|
||||
public long BytesSent { get; set; }
|
||||
public long BytesReceived { get; set; }
|
||||
public long PacketsSent { get; set; }
|
||||
public long PacketsReceived { get; set; }
|
||||
}
|
||||
|
||||
// 网络错误事件数据
|
||||
public class NetworkErrorEventData : NetworkEventData
|
||||
{
|
||||
public int ErrorCode { get; set; }
|
||||
public string ErrorDescription { get; set; }
|
||||
public string ErrorCategory { get; set; }
|
||||
}
|
||||
@@ -0,0 +1,174 @@
|
||||
using System.Net;
|
||||
|
||||
namespace Utils.ETW.Models;
|
||||
|
||||
/// <summary>
|
||||
/// 网络连接模型
|
||||
/// </summary>
|
||||
public class NetworkModel
|
||||
{
|
||||
// RemoteCountry 地理位置归属地，供安全分析
|
||||
|
||||
/// <summary>
|
||||
/// 进程 ID
|
||||
/// </summary>
|
||||
public required int ProcessId { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// 线程 ID
|
||||
/// </summary>
|
||||
public required int ThreadId { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// 进程名称
|
||||
/// </summary>
|
||||
public required string ProcessName { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// 源地址
|
||||
/// </summary>
|
||||
public required IPAddress SourceIp { get; set; }
|
||||
|
||||
public required IPAddress DestinationIp { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// 最新活动时间
|
||||
/// </summary>
|
||||
public required DateTime LastSeenTime { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// 记录产生时间
|
||||
/// </summary>
|
||||
public required DateTime RecordTime { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// 发送的数据量
|
||||
/// </summary>
|
||||
public long BytesSent { get; set; }
|
||||
|
||||
public long BytesReceived { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// 连接状态
|
||||
/// </summary>
|
||||
public required ConnectionState State { get; set; } // 如 ESTABLISHED, CLOSED, TIME_WAIT, 或 UDP/Unknown
|
||||
|
||||
/// <summary>
|
||||
/// 源端口
|
||||
/// </summary>
|
||||
public required int SourcePort { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// 目标端口
|
||||
/// </summary>
|
||||
public required int DestinationPort { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// 连接类型
|
||||
/// </summary>
|
||||
public required ProtocolType ConnectType { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// 开始时间
|
||||
/// </summary>
|
||||
public DateTime? StartTime { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// 进站或是出站
|
||||
/// </summary>
|
||||
public TrafficDirection Direction { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// 结束时间
|
||||
/// </summary>
|
||||
public DateTime? EndTime { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// 是否是完整会话【如果在软件打开前会话已经创建则不认为是完整会话】
|
||||
/// </summary>
|
||||
public required bool IsPartialConnection { get; set; }
|
||||
|
||||
|
||||
/// <summary>
|
||||
/// 会话持续时间
|
||||
/// </summary>
|
||||
public TimeSpan Duration => (EndTime ?? DateTime.Now) - (StartTime ?? RecordTime);
|
||||
|
||||
// 近 1 分钟平均网速
|
||||
// 近 1 分钟流量统计
|
||||
// 近 10 分钟流量统计
|
||||
|
||||
public string GetKey()
|
||||
{
|
||||
return GetKey(this);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// 获取唯一 ID
|
||||
/// </summary>
|
||||
/// <returns></returns>
|
||||
public static string GetKey(NetworkModel networkModel)
|
||||
{
|
||||
return GetKey(networkModel.SourceIp,
|
||||
networkModel.SourcePort,
|
||||
networkModel.DestinationIp,
|
||||
networkModel.DestinationPort,
|
||||
networkModel.ProcessId,
|
||||
networkModel.ConnectType);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// 获取唯一 ID
|
||||
/// </summary>
|
||||
/// <param name="sourceIp">源 Ip</param>
|
||||
/// <param name="sourcePort">源端口</param>
|
||||
/// <param name="destinationIp">目标 Ip</param>
|
||||
/// <param name="destinationPort">目标端口</param>
|
||||
/// <param name="processId">进程 ID</param>
|
||||
/// <param name="connectType">连接类型</param>
|
||||
/// <param name="recordTime">记录时间</param>
|
||||
/// <returns></returns>
|
||||
public static string GetKey(
|
||||
IPAddress sourceIp,
|
||||
int sourcePort,
|
||||
IPAddress destinationIp,
|
||||
int destinationPort,
|
||||
int processId,
|
||||
ProtocolType connectType)
|
||||
{
|
||||
var key =
|
||||
$"{sourceIp}:{sourcePort}-{destinationIp}:" +
|
||||
$"{destinationPort}-{processId}-{connectType}";
|
||||
return key;
|
||||
}
|
||||
}
|
||||
|
||||
public enum ConnectionState
|
||||
{
|
||||
/// <summary>
|
||||
/// 正在尝试连接
|
||||
/// </summary>
|
||||
Connecting,
|
||||
Connected, // 当前连接活跃（发送/接收中）
|
||||
Disconnected, // 已断开或未活跃
|
||||
Listening, // 监听状态（如本地服务器）
|
||||
Unknown // 无法判断状态
|
||||
}
|
||||
|
||||
public enum ProtocolType
|
||||
{
|
||||
TCP,
|
||||
UDP,
|
||||
ICMP, // 可选
|
||||
Unknown
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// 进出站类型
|
||||
/// </summary>
|
||||
public enum TrafficDirection
|
||||
{
|
||||
Inbound,
|
||||
Outbound,
|
||||
// Unknown
|
||||
}
|
||||
Reference in new issue
Block a user