com.mozilla.secops.httprequest.heuristics

Class EndpointSequenceAbuse

java.lang.Object

org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Event>,org.apache.beam.sdk.values.PCollection<Alert>>

com.mozilla.secops.httprequest.heuristics.EndpointSequenceAbuse

All Implemented Interfaces:

DocumentingTransform, Serializable, org.apache.beam.sdk.transforms.display.HasDisplayData

public class EndpointSequenceAbuse
extends org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Event>,org.apache.beam.sdk.values.PCollection<Alert>>
implements DocumentingTransform

Transform for detection of a single source making a sequence of requests at a speed faster than what we expect from a normal user.

Generates alerts where the request profile violates path thresholds specified in the endpointAbusePath pipeline option configuration.

See Also:

Serialized Form

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	EndpointSequenceAbuse.EndpointSequenceAbuseTimingInfo Internal class for configured endpoints in EPA

Constructor Summary

Constructors

Constructor and Description
EndpointSequenceAbuse(HTTPRequestToggles toggles, Boolean enableIprepdDatastoreExemptions, String iprepdDatastoreExemptionsProject, org.apache.beam.sdk.values.PCollectionView<Map<String,Boolean>> natView) Static initializer for EndpointAbuseAnalysis

Method Summary

Modifier and Type	Method and Description
org.apache.beam.sdk.values.PCollection<Alert>	expand(org.apache.beam.sdk.values.PCollection<Event> input)
String	getTransformDoc() Get documentation string from transform based on it's current configuration

Methods inherited from class org.apache.beam.sdk.transforms.PTransform

compose, compose, getAdditionalInputs, getDefaultOutputCoder, getName, getResourceHints, populateDisplayData, setResourceHints, toString, validate

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

EndpointSequenceAbuse

public EndpointSequenceAbuse(HTTPRequestToggles toggles,
                             Boolean enableIprepdDatastoreExemptions,
                             String iprepdDatastoreExemptionsProject,
                             org.apache.beam.sdk.values.PCollectionView<Map<String,Boolean>> natView)

Static initializer for EndpointAbuseAnalysis

Parameters:

toggles - HTTPRequestToggles

enableIprepdDatastoreExemptions - True to enable datastore exemptions

iprepdDatastoreExemptionsProject - Project to look for datastore entities in

natView - Use DetectNat view, or null to disable

Method Detail

getTransformDoc

public String getTransformDoc()

Get documentation string from transform based on it's current configuration

Specified by:

getTransformDoc in interface DocumentingTransform

Returns:

String

expand

public org.apache.beam.sdk.values.PCollection<Alert> expand(org.apache.beam.sdk.values.PCollection<Event> input)

Specified by:

expand in class org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Event>,org.apache.beam.sdk.values.PCollection<Alert>>