diff --git a/Server/config.py b/Server/config.py index 1e43f02..5efcb30 100644 --- a/Server/config.py +++ b/Server/config.py @@ -1,4 +1,4 @@ # 检出阈值,越高越难检出但是也会越准确 MAX_THREAT_SCORE = 170 # 授权访问主站的IP列表.如果不在后台里面则不能访问后台 -ALLOW_ACCESS_IP = ['127.0.0.1'] +ALLOW_ACCESS_IP = ['127.0.0.1', '192.168.111.189', '192.168.111.187'] diff --git a/Server/log.py b/Server/log.py index a0ab24d..1cfd59d 100644 --- a/Server/log.py +++ b/Server/log.py @@ -58,6 +58,8 @@ def process_log(host, json_log, raw_log): child = process.Process( pid, ppid, path, params, create_time, hash, parent_user, host, is_white_list ) + parent_process.parent_process = parent_process + child.parent_process = parent_process chain = process.create_chain(parent_process) chain.add_process(child, parent_pid) current_process = child @@ -69,6 +71,7 @@ def process_log(host, json_log, raw_log): child = process.Process( pid, ppid, path, params, create_time, hash, user, host, is_white_list ) + child.parent_process = parent_process parent_process.chain.add_process(child, ppid) current_process = child if score > 0: diff --git a/Server/process.py b/Server/process.py index 2e8932a..28023b7 100644 --- a/Server/process.py +++ b/Server/process.py @@ -87,6 +87,7 @@ g_ProcessChainList = [] class Process: def __init__(self, pid, ppid, path, params, time, md5, user, host, is_white=False): self.pid = pid + self.parent_process = None self.ppid = ppid self.path = path self.params = params @@ -120,7 +121,7 @@ class Process: self.rmppid = rmppid def set_score(self, new_score, opertion): - if self.is_white: + if self.is_white or self.chain.root_process.is_white or self.parent_process.is_white: return if opertion not in self.operationlist: self.risk_score += new_score