com.mozilla.secops.customs

Class ContentServerVarianceDetector

java.lang.Object

com.mozilla.secops.customs.ContentServerVarianceDetector

public class ContentServerVarianceDetector
extends Object

Provides transforms to detect if an ip is making a variety of requests to the content server or is just abusing auth server APIs. This is similar to the variance substrings for EndpointAbuseAnalysis in the HTTPRequest pipeline.

Currently, this has only one transform, whether an ip exists in the content server logs. Eventually this could be extended to only consider certain events (such as metrics) or meet more complex conditions.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	ContentServerVarianceDetector.PresenceBased Provides a basic transform for detecting variance based on whether an ip exists

Constructor Summary

Constructors

Constructor and Description
ContentServerVarianceDetector()

Method Summary

Modifier and Type	Method and Description
static org.apache.beam.sdk.values.PCollectionView<Map<String,Boolean>>	getEmptyView(org.apache.beam.sdk.Pipeline p) Return an empty variance view, suitable as a placeholder if variance detection is not desired
static org.apache.beam.sdk.values.PCollectionView<Map<String,Boolean>>	getView(org.apache.beam.sdk.values.PCollection<Event> events) Execute transform returning a PCollectionView of ips accessing content server resources, that can be used as a side input.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

ContentServerVarianceDetector

public ContentServerVarianceDetector()

Method Detail

getEmptyView

public static org.apache.beam.sdk.values.PCollectionView<Map<String,Boolean>> getEmptyView(org.apache.beam.sdk.Pipeline p)

Return an empty variance view, suitable as a placeholder if variance detection is not desired

Parameters:

p - Pipeline to create view for

Returns:

Empty PCollectionView

getView

public static org.apache.beam.sdk.values.PCollectionView<Map<String,Boolean>> getView(org.apache.beam.sdk.values.PCollection<Event> events)

Execute transform returning a PCollectionView of ips accessing content server resources, that can be used as a side input.

Parameters:

events - Input events

Returns:

PCollectionView representing output of analysis