kilyabin
46 lines
910 B
Go
46 lines
910 B
Go
package analyzer
|
|
|
|
import (
|
|
"time"
|
|
|
|
"dip-ids/internal/storage"
|
|
|
|
"github.com/google/gopacket"
|
|
)
|
|
|
|
// Detector — интерфейс детектора атак
|
|
type Detector interface {
|
|
Name() string
|
|
Analyze(pkt gopacket.Packet) []storage.Alert
|
|
Reset()
|
|
}
|
|
|
|
// timeWindow скользящее временное окно для хранения меток времени
|
|
type timeWindow struct {
|
|
entries []time.Time
|
|
size time.Duration
|
|
}
|
|
|
|
func newTimeWindow(seconds int) *timeWindow {
|
|
return &timeWindow{size: time.Duration(seconds) * time.Second}
|
|
}
|
|
|
|
func (w *timeWindow) add(t time.Time) {
|
|
w.entries = append(w.entries, t)
|
|
w.evict(t)
|
|
}
|
|
|
|
func (w *timeWindow) evict(now time.Time) {
|
|
cutoff := now.Add(-w.size)
|
|
i := 0
|
|
for i < len(w.entries) && w.entries[i].Before(cutoff) {
|
|
i++
|
|
}
|
|
w.entries = w.entries[i:]
|
|
}
|
|
|
|
func (w *timeWindow) count(now time.Time) int {
|
|
w.evict(now)
|
|
return len(w.entries)
|
|
}
|