Collect samples for attack wave detection

Author: hansott

library/agent/Agent.ts

@@ -30,7 +30,10 @@ import { AttackLogger } from "./AttackLogger";
 import { Packages } from "./Packages";
 import { AIStatistics } from "./AIStatistics";
 import { isNewInstrumentationUnitTest } from "../helpers/isNewInstrumentationUnitTest";
-import { AttackWaveDetector } from "../vulnerabilities/attack-wave-detection/AttackWaveDetector";
+import {
+  AttackWaveDetector,
+  SuspiciousRequest,
+} from "../vulnerabilities/attack-wave-detection/AttackWaveDetector";
 import type { FetchListsAPI } from "./api/FetchListsAPI";
 import { PendingEvents } from "./PendingEvents";
 
@@ -649,18 +652,19 @@ export class Agent {
    */
   onDetectedAttackWave({
     request,
-    metadata,
+    samples,
   }: {
     request: Context;
-    metadata: Record<string, string>;
+    samples: SuspiciousRequest[];
   }) {
     const attack: DetectedAttackWave = {
       type: "detected_attack_wave",
       time: Date.now(),
       attack: {
-        metadata: limitLengthMetadata(metadata, 4096),
+        metadata: {},
         user: request.user,
       },
+      samples: samples,
       request: {
         ipAddress: request.remoteAddress,
         userAgent:

library/agent/api/Event.ts

@@ -166,6 +166,10 @@ export type DetectedAttackWave = {
     metadata: Record<string, string>;
     user: User | undefined;
   };
+  samples: {
+    method: string;
+    url: string;
+  }[];
   agent: AgentInfo;
   time: number;
 };

library/sources/http-server/createRequestListener.ts

@@ -113,8 +113,13 @@ function onFinishRequestHandler(
       agent.onRouteRateLimited(context.rateLimitedEndpoint);
     }
 
-    if (agent.getAttackWaveDetector().check(context)) {
-      agent.onDetectedAttackWave({ request: context, metadata: {} });
+    const attackWaveDetector = agent.getAttackWaveDetector();
+
+    if (attackWaveDetector.check(context) && context.remoteAddress) {
+      agent.onDetectedAttackWave({
+        request: context,
+        samples: attackWaveDetector.getSamplesForIP(context.remoteAddress),
+      });
       agent.getInspectionStatistics().onAttackWaveDetected();
     }
   }

library/sources/http-server/http2/createStreamListener.ts

@@ -76,8 +76,13 @@ function discoverRouteFromStream(
         agent.onRouteRateLimited(context.rateLimitedEndpoint);
       }
 
-      if (agent.getAttackWaveDetector().check(context)) {
-        agent.onDetectedAttackWave({ request: context, metadata: {} });
+      const attackWaveDetector = agent.getAttackWaveDetector();
+
+      if (attackWaveDetector.check(context) && context.remoteAddress) {
+        agent.onDetectedAttackWave({
+          request: context,
+          samples: attackWaveDetector.getSamplesForIP(context.remoteAddress),
+        });
         agent.getInspectionStatistics().onAttackWaveDetected();
       }
     }

library/vulnerabilities/attack-wave-detection/AttackWaveDetector.ts

@@ -2,8 +2,13 @@ import { LRUMap } from "../../ratelimiting/LRUMap";
 import type { Context } from "../../agent/Context";
 import { isWebScanner } from "./isWebScanner";
 
+export type SuspiciousRequest = {
+  method: string;
+  url: string;
+};
+
 export class AttackWaveDetector {
-  private suspiciousRequestsMap: LRUMap<string, number>;
+  private suspiciousRequestsMap: LRUMap<string, SuspiciousRequest[]>;
   private sentEventsMap: LRUMap<string, number>;
 
   // How many suspicious requests are allowed before triggering an alert
@@ -57,19 +62,33 @@ export class AttackWaveDetector {
       return false;
     }
 
+    // In isWebScanner we use `context.route`, `context.route` is always created from `context.url`
+    if (!context.method || !context.url) {
+      return false;
+    }
+
     if (!isWebScanner(context)) {
       return false;
     }
 
-    const suspiciousRequests = (this.suspiciousRequestsMap.get(ip) || 0) + 1;
+    const suspiciousRequests = this.suspiciousRequestsMap.get(ip) || [];
+    suspiciousRequests.push({
+      method: context.method,
+      url: context.url,
+    });
+
     this.suspiciousRequestsMap.set(ip, suspiciousRequests);
 
-    if (suspiciousRequests < this.attackWaveThreshold) {
+    if (suspiciousRequests.length < this.attackWaveThreshold) {
       return false;
     }
 
     this.sentEventsMap.set(ip, performance.now());
 
     return true;
   }
+
+  getSamplesForIP(ip: string) {
+    return this.suspiciousRequestsMap.get(ip) || [];
+  }
 }