Update logger_service.py

logger_service.py

@@ -1,66 +1,85 @@
-import os
 import pandas as pd
-from huggingface_hub import hf_hub_download, upload_file, login
-
-# --- 配置區 ---
-DATASET_REPO_ID = "My-Project-Team/Digital-Bodyguard-Dataset" 
-CSV_FILENAME = "baseline_logs.csv"
-HF_TOKEN = os.getenv("HF_TOKEN")
-
-# 🌟 批次上傳門檻 (每累積幾筆資料才備份到雲端一次)
-BATCH_SIZE = 30  
-unsynced_count = 0  
-
-if HF_TOKEN:
-    login(token=HF_TOKEN)
+import os
+from datetime import datetime
+import joblib  # 確保有安裝此套件
 
-# 🌟 把這個啟動時需要用到的「下載功能」加回來！
-# def sync_from_hf():
-#     """從雲端下載最新的 CSV 並回傳 DataFrame (系統啟動時只會呼叫一次)"""
-#     try:
-#         path = hf_hub_download(
-#             repo_id=DATASET_REPO_ID,
-#             filename=CSV_FILENAME,
-#             repo_type="dataset",
-#             token=HF_TOKEN
-#         )
-#         return pd.read_csv(path)
-#     except Exception as e:
-#         print(f"⚠️ 無法下載雲端資料，可能為首次運行: {e}")
-#         return pd.DataFrame(columns=["timestamp", "ip_address", "cookie_id", "account", "role", "action", "status"])
+# --- 全域變數與模型載入 ---
+global system_weights
+system_weights = {"ow": 0, "gw": 0, "tw": 0}
 
-def upload_to_hf():
-    """將本地的 CSV 檔案同步回雲端"""
-    try:
-        upload_file(
-            path_or_fileobj=CSV_FILENAME,
-            path_in_repo=CSV_FILENAME,
-            repo_id=DATASET_REPO_ID,
-            repo_type="dataset",
-            token=HF_TOKEN,
-            commit_message=f"System auto-log batch update ({BATCH_SIZE} logs)"
-        )
-        return True
-    except Exception as e:
-        print(f"❌ 雲端同步失敗: {e}")
-        return False
+# 嘗試載入您的 HDBSCAN 模型
+HDBSCAN_MODEL = None
+try:
+    if os.path.exists('hdbscan_model.pkl'):
+        HDBSCAN_MODEL = joblib.load('hdbscan_model.pkl')
+        print("✅ HDBSCAN 模型載入成功")
+except Exception as e:
+    print(f"❌ 模型載入失敗: {e}")
 
-def push_new_log(new_log_dict):
+# --- 新增：將系統行為映射至 Web Log 特徵 ---
+def map_to_web_log_features(action, status_label):
     """
-    接收新紀錄並計數。達到 BATCH_SIZE 門檻時才執行雲端上傳。
-    有效避免 429 Rate Limit 並大幅提升網頁操作流暢度。
+    將內部 action 轉換為訓練資料中的 Method, Path, Status 數字
     """
-    global unsynced_count
-    
-    unsynced_count += 1
+    method = "GET"
+    path = "/usr/student"
+    status_code = 200
     
-    if unsynced_count >= BATCH_SIZE:
-        print(f"📦 已累積 {BATCH_SIZE} 筆操作，正在打包同步至 Hugging Face...")
-        success = upload_to_hf()
+    # 映射邏輯 (根據您的訓練資料截圖進行模擬)
+    if action == "login_attempt":
+        method = "POST"
+        path = "/usr/login"
+    elif "admin" in action or "manage" in action:
+        path = "/usr/admin"
+    elif action == "malicious_sql_injection":
+        method = "DELETE"
+        path = "/usr/admin/developer"
         
-        if success:
-            print("✅ 批次同步成功！")
-            unsynced_count = 0  
-        return success
+    # 根據狀態標籤給予初始代碼
+    if "failed" in status_label:
+        status_code = 401
+    elif "異常" in status_label:
+        status_code = 403
         
-    return True
+    return method, path, status_code
+
+# --- 修改後的 check_anomaly ---
+def check_anomaly(ip, account, action, log_time):
+    # 如果是登入或登出，直接放行 (200)
+    if action in ["login_attempt", "logout"]:
+        return "success (200)"
+
+    try:
+        ow = float(system_weights.get("ow", 0))
+        gw = float(system_weights.get("gw", 0))
+        tw = float(system_weights.get("tw", 0))
+        
+        # 1. 地理位置權重攔截
+        from logger_service import get_geo_level # 假設此函式存在於同檔案
+        geo_level = get_geo_level(ip)
+        if gw == 100 and geo_level > 0:
+            return "⚠️異常_地理位置受限 (100%絕對鎖定: 僅限校內專網存取) (403)"
+        elif gw >= 90 and geo_level > 1:
+            return "⚠️異常_地理位置受限 (高敏感防護: 僅限校園網路與宿舍) (403)"
+            
+        # 2. 頻率檢查
+        # (此處保留您原有的 recent_clicks 計算邏輯...)
+        # if (recent_clicks + 1) > max_allowed_clicks:
+        #     return f"⚠️異常_單一操作頻率過高 (403)"
+
+        # 3. HDBSCAN 模型檢測
+        if HDBSCAN_MODEL:
+            # 轉換特徵
+            method, path, base_code = map_to_web_log_features(action, "success")
+            
+            # ⚠️ 注意：這裡需要接入您當初訓練時的「特徵工程」轉換代碼 (例如 LabelEncoder 或 Scaler)
+            # 範例結構：
+            # features = preprocess_logic(ip, log_time, method, path, base_code)
+            # result = HDBSCAN_MODEL.fit_predict(features)
+            # if result[-1] == -1: return "⚠️異常_作息或行為不符 (403)"
+            pass
+
+        return "success (200)"
+        
+    except Exception as e:
+        return f"⚠️系統錯誤: {str(e)} (500)"