com.mozilla.secops

Class DetectNat

java.lang.Object

com.mozilla.secops.DetectNat

public class DetectNat
extends Object

Provides NAT detection transforms

Currently this transform only operates on normalized Normalized.Type.HTTP_REQUEST events and is based on the detection of multiple user agents being identified for requests within the window for the same source IP address.

The output from the transform is a PCollection of KV pairs where the key is a source IP address identified in the window and the value is a boolean set to true if there is a possibility the source address is a NAT gateway. If it is not suspected the source address is a NAT gateway, it will not be included in the output set.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	DetectNat.UserAgentBased Provides a basic NAT detection transform

Constructor Summary

Constructors

Constructor and Description
DetectNat()

Method Summary

Modifier and Type	Method and Description
static DetectNat.UserAgentBased	byUserAgent() Creates a User Agent Based Nat Detection transform
static org.apache.beam.sdk.values.PCollectionView<Map<String,Boolean>>	getEmptyView(org.apache.beam.sdk.Pipeline p) Return an empty NAT view, suitable as a placeholder if NAT detection is not desired
static org.apache.beam.sdk.values.PCollectionView<Map<String,Boolean>>	getView(org.apache.beam.sdk.values.PCollection<Event> events, String knownGatewaysPath) Execute nat detection transforms returning a PCollectionView suitable for use as a side input, currently only User Agent Based
static Map<String,Boolean>	loadGatewayList(String path) Load detect nat manager configuration from a resource file

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

DetectNat

public DetectNat()

Method Detail

getEmptyView

public static org.apache.beam.sdk.values.PCollectionView<Map<String,Boolean>> getEmptyView(org.apache.beam.sdk.Pipeline p)

Return an empty NAT view, suitable as a placeholder if NAT detection is not desired

Parameters:

p - Pipeline to create view for

Returns:

Empty PCollectionView

getView

public static org.apache.beam.sdk.values.PCollectionView<Map<String,Boolean>> getView(org.apache.beam.sdk.values.PCollection<Event> events,
                                                                                      String knownGatewaysPath)

Execute nat detection transforms returning a PCollectionView suitable for use as a side input, currently only User Agent Based

Parameters:

events - Input events

knownGatewaysPath - path to file with known gateway ip addresses

Returns:

PCollectionView representing output of analysis

byUserAgent

public static DetectNat.UserAgentBased byUserAgent()

Creates a User Agent Based Nat Detection transform

Returns:

A UserAgentBased PTransform

loadGatewayList

public static Map<String,Boolean> loadGatewayList(String path)

Load detect nat manager configuration from a resource file

Parameters:

path - Path to load file file from, resource path or GCS URL

Returns:

a map containing each ip and the value true