michael/michaelschiemer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enable Discovery debug logging for production troubleshooting

Browse Source 
- Add DISCOVERY_LOG_LEVEL=debug
- Add DISCOVERY_SHOW_PROGRESS=true
- Temporary changes for debugging InitializerProcessor fixes on production
This commit is contained in:
Michael Schiemer
2025-08-11 20:13:26 +02:00
parent 59fd3dd3b1
commit 55a330b223
3683 changed files with 2956207 additions and 16948 deletions
Download Patch File Download Diff File Expand all files Collapse all files

341
tests/Framework/Waf/MachineLearning/Detectors/ClusteringAnomalyDetectorTest.php Normal file
View File

@@ -0,0 +1,341 @@
<?php
declare(strict_types=1);
namespace Tests\Framework\Waf\MachineLearning\Detectors;
use App\Framework\Core\ValueObjects\Duration;
use App\Framework\Core\ValueObjects\Timestamp;
use App\Framework\DateTime\DateTime;
use App\Framework\Waf\MachineLearning\AnomalyType;
use App\Framework\Waf\MachineLearning\BehaviorType;
use App\Framework\Waf\MachineLearning\Detectors\ClusteringAnomalyDetector;
use App\Framework\Waf\MachineLearning\ValueObjects\BehaviorBaseline;
use App\Framework\Waf\MachineLearning\ValueObjects\BehaviorFeature;
// Hilfsfunktion zum Erstellen einer Baseline für Tests
function createTestBaseline(?BehaviorType $type = null): BehaviorBaseline
{
$type = $type ?? BehaviorType::PATH_PATTERNS;
$now = Timestamp::fromDateTime(DateTime::fromTimestamp(time()));
return new BehaviorBaseline(
type: $type,
identifier: 'test-client',
mean: 10.0,
standardDeviation: 5.0,
median: 10.0,
minimum: 5.0,
maximum: 25.0,
percentiles: [
25 => 7.5,
75 => 15.0,
90 => 18.0,
95 => 20.0,
99 => 22.0,
],
sampleCount: 20,
createdAt: $now,
lastUpdated: $now,
windowSize: Duration::fromMinutes(30),
confidence: 0.8
);
}
// Hilfsfunktion zum Erstellen von Testfeatures
function createTestFeatures(): array
{
return [
new BehaviorFeature(
type: BehaviorType::PATH_PATTERNS,
name: 'path_depth',
value: 3.0,
unit: 'count'
),
new BehaviorFeature(
type: BehaviorType::PATH_PATTERNS,
name: 'path_segments',
value: 4.0,
unit: 'count'
),
new BehaviorFeature(
type: BehaviorType::PATH_PATTERNS,
name: 'path_length',
value: 25.0,
unit: 'characters'
),
new BehaviorFeature(
type: BehaviorType::PARAMETER_PATTERNS,
name: 'param_count',
value: 2.0,
unit: 'count'
),
new BehaviorFeature(
type: BehaviorType::PARAMETER_PATTERNS,
name: 'param_length_avg',
value: 8.0,
unit: 'characters'
),
];
}
test('erkennt Cluster-Abweichungen', function () {
// Arrange
$detector = new ClusteringAnomalyDetector(
enabled: true,
confidenceThreshold: 0.5,
maxClusters: 3,
minClusterSize: 2,
outlierThreshold: 0.8,
maxIterations: 10,
convergenceThreshold: 0.01,
enableDensityAnalysis: true,
enableGroupAnomalyDetection: true,
clusterCenters: [],
clusterAssignments: [],
featureVectors: []
);
// Normale Features
$normalFeatures = createTestFeatures();
// Anomales Feature mit deutlich abweichenden Werten
$anomalousFeature = new BehaviorFeature(
type: BehaviorType::PATH_PATTERNS,
name: 'path_length',
value: 150.0, // Deutlich höher als normal
unit: 'characters'
);
$features = array_merge($normalFeatures, [$anomalousFeature]);
// Act
$anomalies = $detector->detectAnomalies($features, null);
// Assert
expect($anomalies)->not->toBeEmpty();
expect($anomalies[0]->type)->toBe(AnomalyType::CLUSTERING_DEVIATION);
});
test('gruppiert Features nach Typ', function () {
// Arrange
$detector = new ClusteringAnomalyDetector(
enabled: true,
confidenceThreshold: 0.5,
maxClusters: 3,
minClusterSize: 2,
outlierThreshold: 0.8,
maxIterations: 10,
convergenceThreshold: 0.01,
enableDensityAnalysis: true,
enableGroupAnomalyDetection: true,
clusterCenters: [],
clusterAssignments: [],
featureVectors: []
);
// Features mit verschiedenen Typen
$features = [
new BehaviorFeature(
type: BehaviorType::PATH_PATTERNS,
name: 'path_feature',
value: 10.0,
unit: 'count'
),
new BehaviorFeature(
type: BehaviorType::PARAMETER_PATTERNS,
name: 'param_feature',
value: 5.0,
unit: 'count'
),
new BehaviorFeature(
type: BehaviorType::REQUEST_FREQUENCY,
name: 'freq_feature',
value: 2.0,
unit: 'requests/second'
),
];
// Wir können die private Methode nicht direkt testen, aber wir können testen,
// dass der Detektor die Features analysieren kann
// Act & Assert
expect($detector->canAnalyze($features))->toBeTrue();
});
test('unterstützt verschiedene Verhaltenstypen', function () {
// Arrange
$detector = new ClusteringAnomalyDetector(
enabled: true,
confidenceThreshold: 0.5,
maxClusters: 3,
minClusterSize: 2,
outlierThreshold: 0.8,
maxIterations: 10,
convergenceThreshold: 0.01,
enableDensityAnalysis: true,
enableGroupAnomalyDetection: true,
clusterCenters: [],
clusterAssignments: [],
featureVectors: []
);
// Act
$supportedTypes = $detector->getSupportedBehaviorTypes();
// Assert
expect($supportedTypes)->toBeArray();
expect($supportedTypes)->toContain(BehaviorType::REQUEST_FREQUENCY);
expect($supportedTypes)->toContain(BehaviorType::PATH_PATTERNS);
expect($supportedTypes)->toContain(BehaviorType::PARAMETER_PATTERNS);
expect($supportedTypes)->toContain(BehaviorType::USER_AGENT_PATTERNS);
});
test('erkennt Dichte-Anomalien wenn aktiviert', function () {
// Arrange
$detector = new ClusteringAnomalyDetector(
enabled: true,
confidenceThreshold: 0.5,
maxClusters: 3,
minClusterSize: 2,
outlierThreshold: 0.8,
maxIterations: 10,
convergenceThreshold: 0.01,
enableDensityAnalysis: true,
enableGroupAnomalyDetection: false,
clusterCenters: [],
clusterAssignments: [],
featureVectors: []
);
// Normale Features mit ähnlichen Werten
$normalFeatures = [
new BehaviorFeature(
type: BehaviorType::PATH_PATTERNS,
name: 'path_length',
value: 20.0,
unit: 'characters'
),
new BehaviorFeature(
type: BehaviorType::PATH_PATTERNS,
name: 'path_length',
value: 22.0,
unit: 'characters'
),
new BehaviorFeature(
type: BehaviorType::PATH_PATTERNS,
name: 'path_length',
value: 19.0,
unit: 'characters'
),
new BehaviorFeature(
type: BehaviorType::PATH_PATTERNS,
name: 'path_length',
value: 21.0,
unit: 'characters'
),
];
// Isoliertes Feature
$isolatedFeature = new BehaviorFeature(
type: BehaviorType::PATH_PATTERNS,
name: 'path_length',
value: 100.0, // Deutlich abseits der anderen
unit: 'characters'
);
$features = array_merge($normalFeatures, [$isolatedFeature]);
// Act
$anomalies = $detector->detectAnomalies($features, null);
// Assert
expect($anomalies)->not->toBeEmpty();
// Je nach Implementierung könnte es verschiedene Anomalietypen sein
expect($anomalies[0]->type)->toBe(AnomalyType::CLUSTERING_DEVIATION);
});
test('aktualisiert Modell mit neuen Daten', function () {
// Arrange
$detector = new ClusteringAnomalyDetector(
enabled: true,
confidenceThreshold: 0.5,
maxClusters: 3,
minClusterSize: 2,
outlierThreshold: 0.8,
maxIterations: 10,
convergenceThreshold: 0.01,
enableDensityAnalysis: true,
enableGroupAnomalyDetection: true,
clusterCenters: [],
clusterAssignments: [],
featureVectors: []
);
$features = createTestFeatures();
// Act - Keine Assertion möglich, da interne Daten private sind
// Wir testen nur, dass keine Exception geworfen wird
$detector->updateModel($features);
// Assert
expect(true)->toBeTrue(); // Dummy assertion
});
test('gibt Konfiguration korrekt zurück', function () {
// Arrange
$detector = new ClusteringAnomalyDetector(
enabled: true,
confidenceThreshold: 0.75,
maxClusters: 5,
minClusterSize: 3,
outlierThreshold: 0.9,
maxIterations: 20,
convergenceThreshold: 0.005,
enableDensityAnalysis: true,
enableGroupAnomalyDetection: false,
clusterCenters: [],
clusterAssignments: [],
featureVectors: []
);
// Act
$config = $detector->getConfiguration();
// Assert
expect($config)->toBeArray();
expect($config['enabled'])->toBeTrue();
expect($config['confidence_threshold'])->toBe(0.75);
expect($config['max_clusters'])->toBe(5);
expect($config['min_cluster_size'])->toBe(3);
expect($config['outlier_threshold'])->toBe(0.9);
expect($config['max_iterations'])->toBe(20);
expect($config['enable_density_analysis'])->toBeTrue();
expect($config['enable_group_anomaly_detection'])->toBeFalse();
});
test('gibt leere Ergebnisse zurück wenn deaktiviert', function () {
// Arrange
$detector = new ClusteringAnomalyDetector(
enabled: false,
confidenceThreshold: 0.5,
maxClusters: 3,
minClusterSize: 2,
outlierThreshold: 0.8,
maxIterations: 10,
convergenceThreshold: 0.01,
enableDensityAnalysis: true,
enableGroupAnomalyDetection: true,
clusterCenters: [],
clusterAssignments: [],
featureVectors: []
);
$features = createTestFeatures();
// Act
$anomalies = $detector->detectAnomalies($features, null);
// Assert
expect($anomalies)->toBeEmpty();
});

280
tests/Framework/Waf/MachineLearning/Detectors/StatisticalAnomalyDetectorTest.php Normal file
View File

@@ -0,0 +1,280 @@
<?php
declare(strict_types=1);
namespace Tests\Framework\Waf\MachineLearning\Detectors;
use App\Framework\Core\ValueObjects\Duration;
use App\Framework\Core\ValueObjects\Timestamp;
use App\Framework\DateTime\DateTime;
use App\Framework\Waf\MachineLearning\AnomalyType;
use App\Framework\Waf\MachineLearning\BehaviorType;
use App\Framework\Waf\MachineLearning\Detectors\StatisticalAnomalyDetector;
use App\Framework\Waf\MachineLearning\ValueObjects\AnomalyDetection;
use App\Framework\Waf\MachineLearning\ValueObjects\BehaviorBaseline;
use App\Framework\Waf\MachineLearning\ValueObjects\BehaviorFeature;
// Hilfsfunktion zum Erstellen einer Baseline für Tests
function createTestBaselineSAD(?BehaviorType $type = null): BehaviorBaseline
{
$type = $type ?? BehaviorType::PATH_PATTERNS;
$now = Timestamp::fromDateTime(DateTime::fromTimestamp(time()));
return new BehaviorBaseline(
type: $type,
identifier: 'test-client',
mean: 10.0,
standardDeviation: 5.0,
median: 10.0,
minimum: 5.0,
maximum: 25.0,
percentiles: [
25 => 7.5,
75 => 15.0,
90 => 18.0,
95 => 20.0,
99 => 22.0,
],
sampleCount: 20,
createdAt: $now,
lastUpdated: $now,
windowSize: Duration::fromMinutes(30),
confidence: 0.8
);
}
test('erkennt Z-Score-Anomalien korrekt', function () {
// Arrange
$detector = new StatisticalAnomalyDetector(
enabled: true,
confidenceThreshold: 0.5,
zScoreThreshold: 2.0,
extremeZScoreThreshold: 3.0,
minSampleSize: 5,
enableOutlierDetection: true,
enableTrendAnalysis: true,
featureHistory: []
);
$feature = new BehaviorFeature(
type: BehaviorType::PATH_PATTERNS,
name: 'test_feature',
value: 42.0,
unit: 'count'
);
$baseline = createTestBaselineSAD();
// Act
$anomalies = $detector->detectAnomalies([$feature], $baseline);
// Assert
expect($anomalies)->toHaveCount(1);
expect($anomalies[0])->toBeInstanceOf(AnomalyDetection::class);
expect($anomalies[0]->type)->toBe(AnomalyType::STATISTICAL_ANOMALY);
expect($anomalies[0]->behaviorType)->toBe(BehaviorType::PATH_PATTERNS);
expect($anomalies[0]->confidence->getValue())->toBeGreaterThan(50.0);
// Z-Score sollte (42 - 10) / 5 = 6.4 sein, was deutlich über dem Schwellenwert liegt
expect($anomalies[0]->anomalyScore)->toBeGreaterThan(0.7);
});
test('ignoriert Werte innerhalb des normalen Bereichs', function () {
// Arrange
$detector = new StatisticalAnomalyDetector(
enabled: true,
confidenceThreshold: 0.5,
zScoreThreshold: 2.0,
extremeZScoreThreshold: 3.0,
minSampleSize: 5,
enableOutlierDetection: true,
enableTrendAnalysis: true,
featureHistory: []
);
$feature = new BehaviorFeature(
type: BehaviorType::PATH_PATTERNS,
name: 'test_feature',
value: 12.0, // Nahe am Mittelwert
unit: 'count'
);
$baseline = createTestBaselineSAD();
// Act
$anomalies = $detector->detectAnomalies([$feature], $baseline);
// Assert
expect($anomalies)->toBeEmpty();
});
test('erkennt Ausreißer ohne Baseline', function () {
// Arrange
$detector = new StatisticalAnomalyDetector(
enabled: true,
confidenceThreshold: 0.5,
zScoreThreshold: 2.0,
extremeZScoreThreshold: 3.0,
minSampleSize: 5,
enableOutlierDetection: true,
enableTrendAnalysis: false,
featureHistory: [
BehaviorType::PATH_PATTERNS->value => [
'test_feature' => [10, 12, 9, 11, 10, 13, 8, 11, 10, 12],
],
]
);
$feature = new BehaviorFeature(
type: BehaviorType::PATH_PATTERNS,
name: 'test_feature',
value: 30.0, // Deutlicher Ausreißer
unit: 'count'
);
// Act
$anomalies = $detector->detectAnomalies([$feature], null);
// Assert
expect($anomalies)->not->toBeEmpty();
expect($anomalies[0]->type)->toBe(AnomalyType::OUTLIER_DETECTION);
});
test('unterstützt verschiedene Verhaltenstypen', function () {
// Arrange
$detector = new StatisticalAnomalyDetector(
enabled: true,
confidenceThreshold: 0.5,
zScoreThreshold: 2.0,
extremeZScoreThreshold: 3.0,
minSampleSize: 5,
enableOutlierDetection: true,
enableTrendAnalysis: true,
featureHistory: []
);
// Act
$supportedTypes = $detector->getSupportedBehaviorTypes();
// Assert
expect($supportedTypes)->toBeArray();
expect($supportedTypes)->toContain(BehaviorType::REQUEST_FREQUENCY);
expect($supportedTypes)->toContain(BehaviorType::PATH_PATTERNS);
expect($supportedTypes)->toContain(BehaviorType::PARAMETER_PATTERNS);
});
test('aktualisiert Modell mit neuen Daten', function () {
// Arrange
$detector = new StatisticalAnomalyDetector(
enabled: true,
confidenceThreshold: 0.5,
zScoreThreshold: 2.0,
extremeZScoreThreshold: 3.0,
minSampleSize: 5,
enableOutlierDetection: true,
enableTrendAnalysis: true,
featureHistory: []
);
$feature1 = new BehaviorFeature(
type: BehaviorType::PATH_PATTERNS,
name: 'test_feature',
value: 15.0,
unit: 'count'
);
$feature2 = new BehaviorFeature(
type: BehaviorType::REQUEST_FREQUENCY,
name: 'request_rate',
value: 5.0,
unit: 'requests/second'
);
// Act - Keine Assertion möglich, da featureHistory private ist
// Wir testen nur, dass keine Exception geworfen wird
$detector->updateModel([$feature1, $feature2]);
// Assert
expect(true)->toBeTrue(); // Dummy assertion
});
test('gibt Konfiguration korrekt zurück', function () {
// Arrange
$detector = new StatisticalAnomalyDetector(
enabled: true,
confidenceThreshold: 0.75,
zScoreThreshold: 2.5,
extremeZScoreThreshold: 4.0,
minSampleSize: 10,
enableOutlierDetection: true,
enableTrendAnalysis: false,
featureHistory: []
);
// Act
$config = $detector->getConfiguration();
// Assert
expect($config)->toBeArray();
expect($config['enabled'])->toBeTrue();
expect($config['confidence_threshold'])->toBe(0.75);
expect($config['z_score_threshold'])->toBe(2.5);
expect($config['extreme_z_score_threshold'])->toBe(4.0);
expect($config['min_sample_size'])->toBe(10);
expect($config['enable_outlier_detection'])->toBeTrue();
expect($config['enable_trend_analysis'])->toBeFalse();
});
test('kann Analyse durchführen wenn aktiviert', function () {
// Arrange
$detector = new StatisticalAnomalyDetector(
enabled: true,
confidenceThreshold: 0.5,
zScoreThreshold: 2.0,
extremeZScoreThreshold: 3.0,
minSampleSize: 5,
enableOutlierDetection: true,
enableTrendAnalysis: true,
featureHistory: []
);
$feature = new BehaviorFeature(
type: BehaviorType::PATH_PATTERNS,
name: 'test_feature',
value: 42.0,
unit: 'count'
);
// Act & Assert
expect($detector->isEnabled())->toBeTrue();
expect($detector->canAnalyze([$feature]))->toBeTrue();
});
test('gibt leere Ergebnisse zurück wenn deaktiviert', function () {
// Arrange
$detector = new StatisticalAnomalyDetector(
enabled: false,
confidenceThreshold: 0.5,
zScoreThreshold: 2.0,
extremeZScoreThreshold: 3.0,
minSampleSize: 5,
enableOutlierDetection: true,
enableTrendAnalysis: true,
featureHistory: []
);
$feature = new BehaviorFeature(
type: BehaviorType::PATH_PATTERNS,
name: 'test_feature',
value: 42.0,
unit: 'count'
);
$baseline = createTestBaselineSAD();
// Act
$anomalies = $detector->detectAnomalies([$feature], $baseline);
// Assert
expect($anomalies)->toBeEmpty();
});