288 lines
12 KiB
Python
288 lines
12 KiB
Python
"""Detector helpers for BGP anomaly generation."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from collections import Counter, defaultdict
|
|
from datetime import UTC, datetime
|
|
from typing import Any
|
|
|
|
from app.models.bgp_anomaly import BGPAnomaly
|
|
|
|
|
|
def _iter_event_regions(events: list[dict[str, Any]]) -> list[dict[str, Any]]:
|
|
regions: list[dict[str, Any]] = []
|
|
seen: set[tuple[Any, ...]] = set()
|
|
for event in events:
|
|
metadata = event.get("metadata") or {}
|
|
location = metadata.get("collector_location") or {}
|
|
region = {
|
|
"collector": metadata.get("collector"),
|
|
"country": location.get("country"),
|
|
"city": location.get("city"),
|
|
"latitude": location.get("latitude"),
|
|
"longitude": location.get("longitude"),
|
|
}
|
|
region_key = (
|
|
region.get("collector"),
|
|
region.get("country"),
|
|
region.get("city"),
|
|
region.get("latitude"),
|
|
region.get("longitude"),
|
|
)
|
|
if region_key in seen:
|
|
continue
|
|
seen.add(region_key)
|
|
regions.append(region)
|
|
return regions
|
|
|
|
|
|
def _unique_collectors(events: list[dict[str, Any]]) -> list[str]:
|
|
return sorted(
|
|
{
|
|
str((event.get("metadata") or {}).get("collector"))
|
|
for event in events
|
|
if (event.get("metadata") or {}).get("collector")
|
|
}
|
|
)
|
|
|
|
|
|
def _unique_peers(events: list[dict[str, Any]]) -> list[int]:
|
|
peers: set[int] = set()
|
|
for event in events:
|
|
peer_asn = (event.get("metadata") or {}).get("peer_asn")
|
|
if peer_asn is not None:
|
|
peers.add(int(peer_asn))
|
|
return sorted(peers)
|
|
|
|
|
|
def detect_origin_change_anomalies(
|
|
*,
|
|
source: str,
|
|
snapshot_id: int | None,
|
|
task_id: int | None,
|
|
events: list[dict[str, Any]],
|
|
previous_origin_map: dict[str, set[int]],
|
|
) -> list[BGPAnomaly]:
|
|
prefix_to_origins: defaultdict[str, set[int]] = defaultdict(set)
|
|
for event in events:
|
|
metadata = event.get("metadata") or {}
|
|
prefix = metadata.get("prefix")
|
|
origin_asn = metadata.get("origin_asn")
|
|
if prefix and origin_asn is not None:
|
|
prefix_to_origins[str(prefix)].add(int(origin_asn))
|
|
|
|
anomalies: list[BGPAnomaly] = []
|
|
for prefix, origins in prefix_to_origins.items():
|
|
historic = previous_origin_map.get(prefix, set())
|
|
new_origins = sorted(origin for origin in origins if origin not in historic)
|
|
related_events = [
|
|
event
|
|
for event in events
|
|
if (event.get("metadata") or {}).get("prefix") == prefix
|
|
]
|
|
related_collectors = _unique_collectors(related_events)
|
|
related_regions = _iter_event_regions(related_events)
|
|
|
|
moas_candidate = not historic and len(origins) >= 2 and len(related_collectors) >= 2
|
|
if (not historic or not new_origins) and not moas_candidate:
|
|
continue
|
|
|
|
target_origins = new_origins or sorted(origins)
|
|
for new_origin in target_origins:
|
|
sample_event = next(
|
|
(
|
|
event
|
|
for event in related_events
|
|
if (event.get("metadata") or {}).get("prefix") == prefix
|
|
and int((event.get("metadata") or {}).get("origin_asn") or -1) == new_origin
|
|
),
|
|
{},
|
|
)
|
|
sample_metadata = sample_event.get("metadata") or {}
|
|
sample_enrichment = sample_metadata.get("enrichment") or {}
|
|
anomaly_type = "origin_change"
|
|
severity = "critical"
|
|
confidence = 0.86
|
|
summary = f"Prefix {prefix} is now originated by AS{new_origin}, outside the current baseline."
|
|
evidence_previous_origins = sorted(historic)
|
|
if moas_candidate and not historic:
|
|
anomaly_type = "origin_conflict"
|
|
severity = "high"
|
|
confidence = 0.74
|
|
summary = (
|
|
f"Prefix {prefix} is being originated by multiple ASNs "
|
|
f"{sorted(origins)} across {len(related_collectors)} collectors."
|
|
)
|
|
evidence_previous_origins = []
|
|
anomalies.append(
|
|
BGPAnomaly(
|
|
snapshot_id=snapshot_id,
|
|
task_id=task_id,
|
|
source=source,
|
|
anomaly_type=anomaly_type,
|
|
severity=severity,
|
|
status="active",
|
|
entity_key=f"{anomaly_type}:{prefix}:{new_origin}",
|
|
prefix=prefix,
|
|
origin_asn=sorted(historic)[0] if historic else None,
|
|
new_origin_asn=new_origin,
|
|
peer_scope=related_collectors,
|
|
started_at=datetime.now(UTC),
|
|
confidence=confidence,
|
|
summary=summary,
|
|
evidence={
|
|
"previous_origins": evidence_previous_origins,
|
|
"current_origins": sorted(origins),
|
|
"events": [
|
|
(item.get("metadata") or {})
|
|
for item in related_events[:10]
|
|
],
|
|
"origin_asn_profile": sample_enrichment.get("origin_asn_profile"),
|
|
"new_origin_asn_profile": sample_enrichment.get("new_origin_asn_profile"),
|
|
"rpki_validation": sample_enrichment.get("rpki_validation"),
|
|
"prefix_scope": sample_enrichment.get("prefix_scope"),
|
|
"impacted_regions": related_regions
|
|
or sample_enrichment.get("prefix_scope", {}).get("regions", []),
|
|
},
|
|
)
|
|
)
|
|
|
|
return anomalies
|
|
|
|
|
|
def detect_more_specific_burst_anomalies(
|
|
*,
|
|
source: str,
|
|
snapshot_id: int | None,
|
|
task_id: int | None,
|
|
events: list[dict[str, Any]],
|
|
) -> list[BGPAnomaly]:
|
|
prefix_to_more_specifics: defaultdict[str, list[dict[str, Any]]] = defaultdict(list)
|
|
for event in events:
|
|
metadata = event.get("metadata") or {}
|
|
enrichment = metadata.get("enrichment") or {}
|
|
root_prefix = enrichment.get("prefix_supernet")
|
|
if root_prefix and enrichment.get("is_more_specific"):
|
|
prefix_to_more_specifics[str(root_prefix)].append(event)
|
|
|
|
anomalies: list[BGPAnomaly] = []
|
|
for root_prefix, more_specifics in prefix_to_more_specifics.items():
|
|
unique_prefixes = sorted(
|
|
{
|
|
str((item.get("metadata") or {}).get("prefix"))
|
|
for item in more_specifics
|
|
if (item.get("metadata") or {}).get("prefix")
|
|
}
|
|
)
|
|
related_collectors = _unique_collectors(more_specifics)
|
|
if len(unique_prefixes) < 2 and len(related_collectors) < 2:
|
|
continue
|
|
|
|
sample = more_specifics[0].get("metadata") or {}
|
|
sample_enrichment = sample.get("enrichment") or {}
|
|
event_count = len(more_specifics)
|
|
anomalies.append(
|
|
BGPAnomaly(
|
|
snapshot_id=snapshot_id,
|
|
task_id=task_id,
|
|
source=source,
|
|
anomaly_type="more_specific_burst",
|
|
severity="high",
|
|
status="active",
|
|
entity_key=f"more_specific_burst:{root_prefix}:{len(unique_prefixes)}:{len(related_collectors)}",
|
|
prefix=sample.get("prefix"),
|
|
origin_asn=sample.get("origin_asn"),
|
|
new_origin_asn=None,
|
|
peer_scope=related_collectors,
|
|
started_at=datetime.now(UTC),
|
|
confidence=min(0.64 + (0.04 * min(event_count, 5)), 0.88),
|
|
summary=(
|
|
f"{len(unique_prefixes)} more-specific prefixes clustered under {root_prefix} "
|
|
f"across {len(related_collectors) or 1} collectors."
|
|
),
|
|
evidence={
|
|
"events": [item.get("metadata") for item in more_specifics[:10]],
|
|
"unique_prefixes": unique_prefixes,
|
|
"rpki_validation": sample_enrichment.get("rpki_validation"),
|
|
"origin_asn_profile": sample_enrichment.get("origin_asn_profile"),
|
|
"prefix_scope": sample_enrichment.get("prefix_scope"),
|
|
"impacted_regions": _iter_event_regions(more_specifics)
|
|
or sample_enrichment.get("prefix_scope", {}).get("regions", []),
|
|
},
|
|
)
|
|
)
|
|
|
|
return anomalies
|
|
|
|
|
|
def detect_mass_withdrawal_anomalies(
|
|
*,
|
|
source: str,
|
|
snapshot_id: int | None,
|
|
task_id: int | None,
|
|
events: list[dict[str, Any]],
|
|
) -> list[BGPAnomaly]:
|
|
withdrawal_counter: Counter[tuple[str, int | None]] = Counter()
|
|
withdrawal_events_by_key: defaultdict[tuple[str, int | None], list[dict[str, Any]]] = defaultdict(list)
|
|
for event in events:
|
|
metadata = event.get("metadata") or {}
|
|
prefix = metadata.get("prefix")
|
|
if prefix and metadata.get("event_type") == "withdrawal":
|
|
key = (str(prefix), metadata.get("origin_asn"))
|
|
withdrawal_counter[key] += 1
|
|
withdrawal_events_by_key[key].append(event)
|
|
|
|
anomalies: list[BGPAnomaly] = []
|
|
for (prefix, origin_asn), count in withdrawal_counter.items():
|
|
related_events = withdrawal_events_by_key[(prefix, origin_asn)]
|
|
related_collectors = _unique_collectors(related_events)
|
|
related_peers = _unique_peers(related_events)
|
|
if count < 3 and not (count >= 2 and len(related_collectors) >= 2):
|
|
continue
|
|
sample_event = related_events[0] if related_events else {}
|
|
sample_metadata = sample_event.get("metadata") or {}
|
|
sample_enrichment = sample_metadata.get("enrichment") or {}
|
|
severity = "medium"
|
|
if count >= 4 or len(related_collectors) >= 3:
|
|
severity = "high"
|
|
if count >= 8:
|
|
severity = "critical"
|
|
|
|
anomalies.append(
|
|
BGPAnomaly(
|
|
snapshot_id=snapshot_id,
|
|
task_id=task_id,
|
|
source=source,
|
|
anomaly_type="mass_withdrawal",
|
|
severity=severity,
|
|
status="active",
|
|
entity_key=f"mass_withdrawal:{prefix}:{origin_asn}:{len(related_collectors)}:{count}",
|
|
prefix=prefix,
|
|
origin_asn=origin_asn,
|
|
new_origin_asn=None,
|
|
peer_scope=related_collectors,
|
|
started_at=datetime.now(UTC),
|
|
confidence=min(0.5 + (count * 0.06) + (0.04 * max(len(related_collectors) - 1, 0)), 0.95),
|
|
summary=(
|
|
f"{count} withdrawal events observed for {prefix} "
|
|
f"across {len(related_collectors) or 1} collectors in the current ingest window."
|
|
),
|
|
evidence={
|
|
"withdrawal_count": count,
|
|
"collector_count": len(related_collectors),
|
|
"peer_count": len(related_peers),
|
|
"events": [
|
|
(item.get("metadata") or {})
|
|
for item in related_events[:10]
|
|
],
|
|
"origin_asn_profile": sample_enrichment.get("origin_asn_profile"),
|
|
"rpki_validation": sample_enrichment.get("rpki_validation"),
|
|
"prefix_scope": sample_enrichment.get("prefix_scope"),
|
|
"impacted_regions": _iter_event_regions(related_events)
|
|
or sample_enrichment.get("prefix_scope", {}).get("regions", []),
|
|
},
|
|
)
|
|
)
|
|
|
|
return anomalies
|