OCA\RansomwareDetection\Connector\Sabre\RequestPlugin

Complexity

Total Complexity

16

Size/Duplication

Total Lines	153
Duplicated Lines	0 %

Importance

Changes	2
Bugs	1	Features	0

9 Methods

Rating	Name	Duplication	Size	Complexity
A	beforeHttpGet()	0	2	1
A	triggerNotification()	0	9	1
A	initialize()	0	8	1
A	beforeHttpDelete()	0	2	1
A	beforeHttpPropFind()	0	18	5
A	__construct()	0	18	1
A	beforeHttpPut()	0	2	1
A	classifySequence()	0	19	4
A	beforeHttpPost()	0	2	1

<?php

/**
 * @copyright Copyright (c) 2018 Matthias Held <matthias.held@uni-konstanz.de>
 * @author Matthias Held <matthias.held@uni-konstanz.de>
 * @license GNU AGPL version 3 or any later version
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as
 * published by the Free Software Foundation, either version 3 of the
 * License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

namespace OCA\RansomwareDetection\Connector\Sabre;

use OCA\RansomwareDetection\Classifier;
use OCA\RansomwareDetection\AppInfo\Application;
use OCA\RansomwareDetection\Analyzer\SequenceAnalyzer;
use OCA\RansomwareDetection\Service\FileOperationService;
use OCP\Notification\IManager;

The type OCP\Notification\IManager was not found. Maybe you did not declare it correctly or list all dependencies?

use OCP\IUserSession;

The type OCP\IUserSession was not found. Maybe you did not declare it correctly or list all dependencies?

use OCP\ISession;

The type OCP\ISession was not found. Maybe you did not declare it correctly or list all dependencies?

use OCP\ILogger;

The type OCP\ILogger was not found. Maybe you did not declare it correctly or list all dependencies?

use OCP\IConfig;

The type OCP\IConfig was not found. Maybe you did not declare it correctly or list all dependencies?

use Sabre\DAV\Server;

The type Sabre\DAV\Server was not found. Maybe you did not declare it correctly or list all dependencies?

use Sabre\DAV\ServerPlugin;

The type Sabre\DAV\ServerPlugin was not found. Maybe you did not declare it correctly or list all dependencies?

use Sabre\HTTP\RequestInterface;

The type Sabre\HTTP\RequestInterface was not found. Maybe you did not declare it correctly or list all dependencies?

use Sabre\HTTP\ResponseInterface;

The type Sabre\HTTP\ResponseInterface was not found. Maybe you did not declare it correctly or list all dependencies?

class RequestPlugin extends ServerPlugin
{
    /** @var Server */
    protected $server;

    /** @var ILogger */
    protected $logger;

    /** @var IConfig */
    protected $config;

    /** @var IUserSession */
    protected $userSession;

    /** @var ISession */
    protected $session;

    /** @var FileOperationService */
    protected $service;

    /** @var IManager */
    protected $notifications;

    /** @var Classifier */
    protected $classifier;

    /** @var SequenceAnalyzer */
    protected $sequenceAnalyzer;

    const PROPFIND_COUNT = 6;

    /**
     * @param ILogger              $logger
     * @param IConfig              $config
     * @param IUserSession         $userSession
     * @param ISession             $session
     * @param FileOperationService $service
     * @param IManager             $notifications
     * @param Classifier           $classifer
     * @param SequenceAnalyzer     $sequenceAnalyzer
     */
    public function __construct(
        ILogger $logger,
        IConfig $config,
        IUserSession $userSession,
        ISession $session,
        FileOperationService $service,
        IManager $notifications,
        Classifier $classifier,
        SequenceAnalyzer $sequenceAnalyzer
    ) {
        $this->logger = $logger;
        $this->config = $config;
        $this->userSession = $userSession;
        $this->session = $session;
        $this->service = $service;
        $this->notifications = $notifications;
        $this->classifier = $classifier;
        $this->sequenceAnalyzer = $sequenceAnalyzer;
    }

    public function initialize(Server $server)
    {
        $this->server = $server;
        $server->on('method:PROPFIND', [$this, 'beforeHttpPropFind'], 100);
        $server->on('method:PUT', [$this, 'beforeHttpPut'], 100);
        $server->on('method:DELETE', [$this, 'beforeHttpDelete'], 100);
        $server->on('method:GET', [$this, 'beforeHttpGet'], 100);
        $server->on('method:POST', [$this, 'beforeHttpPost'], 100);
    }

    public function beforeHttpPropFind(RequestInterface $request, ResponseInterface $response)
    {
        if ($this->userSession !== null && $this->userSession->getUser() !== null) {
            // only process the propfind request if there is a active user session
            $propfindCount = $this->config->getUserValue($this->userSession->getUser()->getUID(), Application::APP_ID, 'propfind_count:'.$this->session->getId(), 0);
            if ($propfindCount + 1 < self::PROPFIND_COUNT) {
                // less than PROPFIND_COUNT + 1 PROPFIND requests
                $this->config->setUserValue($this->userSession->getUser()->getUID(), Application::APP_ID, 'propfind_count:'.$this->session->getId(), $propfindCount + 1);
            } else {
                // more than PROPFIND_COUNT PROPFIND requests and no file is uploading
                $sequenceId = $this->config->getUserValue($this->userSession->getUser()->getUID(), Application::APP_ID, 'sequence_id', 0);
                $sequence = $this->service->findSequenceById([$sequenceId]);
                if (sizeof($sequence) > 0) {
                    // get old sequence id
                    // start a new sequence by increasing the sequence id
                    $this->config->setUserValue($this->userSession->getUser()->getUID(), Application::APP_ID, 'sequence_id', $sequenceId + 1);
                    $this->config->setUserValue($this->userSession->getUser()->getUID(), Application::APP_ID, 'propfind_count:'.$this->session->getId(), 0);
                    $this->classifySequence($sequence);
                }
            }
        }
    }

    public function beforeHttpPut(RequestInterface $request, ResponseInterface $response)
    {
        // extend if necessary
    }

    public function beforeHttpDelete(RequestInterface $request, ResponseInterface $response)
    {
        // extend if necessary
    }

    public function beforeHttpGet(RequestInterface $request, ResponseInterface $response)
    {
        // extend if necessary
    }

    public function beforeHttpPost(RequestInterface $request, ResponseInterface $response)
    {
        // extend if necessary
    }

    /**
     * Triggers a notification.
     */
    private function triggerNotification($notification)
    {
        $notification->setApp(Application::APP_ID);
        $notification->setDateTime(new \DateTime());
        $notification->setObject('ransomware', 'ransomware');
        $notification->setSubject('ransomware_attack_detected', []);
        $notification->setUser($this->userSession->getUser()->getUID());

        $this->notifications->notify($notification);
    }

    /**
     * Classify sequence and if suspicion level is reached
     * trigger a notification.
     *
     * @param array $sequence
     */
    private function classifySequence($sequence)
    {
        $sequenceSuspicionLevel = $this->config->getAppValue(Application::APP_ID, 'suspicion_level', 2);

        foreach ($sequence as $file) {
            $this->classifier->classifyFile($file);
        }

        // sequence suspicion level
        if ($sequenceSuspicionLevel === 1) {
            $level = 2;
        } else {
            $level = 4;
        }

        // sequence id is irrelevant so we use 0
        $sequenceResult = $this->sequenceAnalyzer->analyze(0, $sequence);
        if ($sequenceResult->getSuspicionScore() >= $level) {
            $this->triggerNotification($this->notifications->createNotification());
        }
    }
}