com.mozilla.secops

Class DetectNat.UserAgentBased

java.lang.Object

org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Event>,org.apache.beam.sdk.values.PCollection<org.apache.beam.sdk.values.KV<String,Boolean>>>

com.mozilla.secops.DetectNat.UserAgentBased

All Implemented Interfaces:

Serializable, org.apache.beam.sdk.transforms.display.HasDisplayData

Enclosing class:

DetectNat

public static class DetectNat.UserAgentBased
extends org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Event>,org.apache.beam.sdk.values.PCollection<org.apache.beam.sdk.values.KV<String,Boolean>>>

Provides a basic NAT detection transform

Currently this transform only operates on normalized Normalized.Type.HTTP_REQUEST events and is based on the detection of multiple user agents being identified for requests within the window for the same source IP address.

The output from the transform is a PCollection of KV pairs where the key is a source IP address identified in the window and the value is a boolean set to true if there is a possibility the source address is a NAT gateway. If it is not suspected the source address is a NAT gateway, it will not be included in the output set.

See Also:

Serialized Form

Method Summary

Modifier and Type	Method and Description
org.apache.beam.sdk.values.PCollection<org.apache.beam.sdk.values.KV<String,Boolean>>	expand(org.apache.beam.sdk.values.PCollection<Event> events)
DetectNat.UserAgentBased	withKnownGateways(Map<String,Boolean> knownGateways) Returns a UserAgentBased PTransform like this one but with a map of ip addresses that are known already to be gateways.
DetectNat.UserAgentBased	withKnownGateways(String path) Returns a UserAgentBased PTransform like this one but with a list of known gateways that are parsed from a file.

Methods inherited from class org.apache.beam.sdk.transforms.PTransform

compose, compose, getAdditionalInputs, getDefaultOutputCoder, getName, getResourceHints, populateDisplayData, setResourceHints, toString, validate

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, wait, wait, wait

Method Detail

expand

public org.apache.beam.sdk.values.PCollection<org.apache.beam.sdk.values.KV<String,Boolean>> expand(org.apache.beam.sdk.values.PCollection<Event> events)

Specified by:

expand in class org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Event>,org.apache.beam.sdk.values.PCollection<org.apache.beam.sdk.values.KV<String,Boolean>>>

withKnownGateways

public DetectNat.UserAgentBased withKnownGateways(String path)

Returns a UserAgentBased PTransform like this one but with a list of known gateways that are parsed from a file. The file should contain an ip per line.

Parameters:

path - Path to load inital gateway list from

Returns:

A UserAgentBased PTransform

withKnownGateways

public DetectNat.UserAgentBased withKnownGateways(Map<String,Boolean> knownGateways)

Returns a UserAgentBased PTransform like this one but with a map of ip addresses that are known already to be gateways.

Parameters:

knownGateways - map containing known gateway ips as keys and True as the value

Returns:

A UserAgentBased PTransform