星云如何利用开源风控系统防止撞库？( 二 ) _撞库

如上所述 Nebula 开源项目分为 Sniffer 流量抓取服务、 Nebula 服务两块，建议直接采用docker方式部署，部署参考如下github文档：
https://github.com/threathunterX/ nebula _doc/blob/master/chapter2/section2/section2.2.md
2.1 Nebula服务
参考github教程部署完之后，运行./ctrl.sh status可查看Nebula服务的运行状态，如下图则代表部署成功，默认配置下Nebula的web控制中心是通过9001端口访问：
Name Command State Ports -------------------------------------------------------------------------------------------------- nebula /entrypoint.sh /usr/bin/su ... Up 0.0.0.0:9001->9001/tcp nebula-aerospike /entrypoint.sh asd --foreg ... Up 3000/tcp, 3001/tcp,3002/tcp, 3003/tcp nebula-db docker-entrypoint.sh MySQLd Up 3306/tcp nebula-redis docker-entrypoint.sh redis ... Up 0.0.0.0:16379->6379/tcp cron RUNNING pid 27, uptime 4 days, 22:23:47 JAVA_web RUNNING pid 33, uptime 4 days, 22:23:47 labrador RUNNING pid 10286, uptime 2 days, 21:26:41 nebula:incident_babel_db_writer RUNNING pid 19, uptime 4 days, 22:23:47 nebula:nebula_db_query_web RUNNING pid 12, uptime 4 days, 22:23:47 nebula:nebula_offline RUNNING pid 14, uptime 4 days, 22:23:47 nebula:nebula_online RUNNING pid 19720, uptime 0:29:22 nebula:nebula_query_web RUNNING pid 15, uptime 4 days, 22:23:47 nebula:nebula_web RUNNING pid 11, uptime 4 days, 22:23:47 nebula:notice_babel_db_writer RUNNING pid 13, uptime 4 days, 22:23:47 nginx RUNNING pid 29, uptime 4 days, 22:23:472.2 Sniffer服务
这里为了方便后面模拟测试，建议就直接采用最简单旁路流量方式(bro驱动)启动 Sniffer 服务，即git上默认配置：
.... - SOURCES=default #default driver - DRIVER_INTERFACE=eth0 - DRIVER_PORT=80,8080,9001 ....说明：
DRIVER_PORT代表监听的流量端口，此处除了监听80,8080外。还监听了9001端口的流量，这是为了方便测试，可以捕获到Nebula服务自身的web控制中心流量。实际生产环境可以去掉。
把Nebula和Sniffer两块服务正常启动起来，则可通过http://IP:9001端口的方式访问TH- Nebula界面了，如图：

文章插图

2.3 配置防止撞库规则
部署完Nebula服务之后，在策略管理tag中可以看到，Nebula系统针对账号风险规则，已经默认配置了基本的防撞库策略。如下图：

文章插图

用户也可以自定义新规则或者修改默认规则，参考如下github文档：
https://github.com/threathunterX/ nebula _doc/blob/master/chapter3/section3/section3.1.md
0×03 模拟撞库测试
部署并配置好规则之后，接下来就是通过模拟撞库的过程，校验系统的风险检测逻辑。
模拟脚本原理就是针对 Sniffer 模块监听的9001端口连续发起1000次登录请求（这里为了方便测试没有在服务端实现login接口，但风控系统对于404的访问也同样会捕获到）。具体Python代码如下
#!/usr/bin/env python # -*- coding: utf-8 -*- from requests import get from requests import put from requests import post from requests import deleteport = 9001class NewRequestsData(object): def __init__(self, url, data, cookies, method='get'): self.data = https://www.isolves.com/it/aq/rj/2019-07-04/data self.url = url self.cookies = cookies self.method = methoddef request(self): m = dict( get=get, put=put, post=post, delete=delete, ) method = m[self.method] text = '默认模式' code = 'None' header = { "connection": "close", "content-type": 'application/json', } try: if self.method in ['get', 'delete']: response = method(self.url, params=self.data, cookies=self.cookies, timeout=10, headers=header) elif self.method in ['post', 'put']: data = dumps(self.data, ensure_ascii=False).encode('utf8') response = method(self.url, data=data, timeout=8, headers=header,cookies=self.cookies) else: raise ValueError text = response.text code = response.status_code except Exception as e: print("error", e)finally: return (text, code)def attack_login(): data = dict( username="threathunter@threathunter.cn" ) r = NewRequestsData('http://127.0.0.1:{}/login'.format(port), data, {}) code, text = r.request()if __name__ == '__main__': i = 0 for i in range(1000): attack_login() print('总访问次数:', i)捕获流量的截图：