Enable Discovery debug logging for production troubleshooting
- Add DISCOVERY_LOG_LEVEL=debug - Add DISCOVERY_SHOW_PROGRESS=true - Temporary changes for debugging InitializerProcessor fixes on production
This commit is contained in:
@@ -0,0 +1,289 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Tests\Framework\Waf\MachineLearning\Integration;
|
||||
|
||||
use App\Framework\Core\ValueObjects\Duration;
|
||||
use App\Framework\Core\ValueObjects\Percentage;
|
||||
use App\Framework\DateTime\Clock;
|
||||
use App\Framework\Waf\Analysis\ValueObjects\RequestAnalysisData;
|
||||
use App\Framework\Waf\MachineLearning\AnomalyDetectorInterface;
|
||||
use App\Framework\Waf\MachineLearning\AnomalyType;
|
||||
use App\Framework\Waf\MachineLearning\BehaviorType;
|
||||
use App\Framework\Waf\MachineLearning\FeatureExtractorInterface;
|
||||
use App\Framework\Waf\MachineLearning\MachineLearningEngine;
|
||||
use App\Framework\Waf\MachineLearning\ValueObjects\AnomalyDetection;
|
||||
use App\Framework\Waf\MachineLearning\ValueObjects\BehaviorFeature;
|
||||
use Mockery;
|
||||
use Mockery\MockInterface;
|
||||
|
||||
/**
|
||||
* Integrationstests für die WAF Machine Learning Pipeline
|
||||
*
|
||||
* Diese Tests überprüfen das Zusammenspiel der verschiedenen Komponenten:
|
||||
* - Feature-Extraktion
|
||||
* - Anomalie-Erkennung
|
||||
* - Gesamtprozess der Analyse
|
||||
*/
|
||||
|
||||
// Hilfsfunktion zum Erstellen von Testanfragen
|
||||
function createNormalRequest(): RequestAnalysisData
|
||||
{
|
||||
return RequestAnalysisData::minimal(
|
||||
method: 'GET',
|
||||
path: '/products/category/electronics',
|
||||
headers: [
|
||||
'User-Agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36',
|
||||
'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
|
||||
'Accept-Language' => 'de,en-US;q=0.7,en;q=0.3',
|
||||
]
|
||||
);
|
||||
}
|
||||
|
||||
function createAnomalousRequest(): RequestAnalysisData
|
||||
{
|
||||
return RequestAnalysisData::minimal(
|
||||
method: 'GET',
|
||||
path: '/admin/config/system/../../../../../../etc/passwd',
|
||||
headers: [
|
||||
'User-Agent' => 'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)',
|
||||
'Accept' => '*/*',
|
||||
'X-Forwarded-For' => '192.168.1.1, 10.0.0.1, 172.16.0.1',
|
||||
]
|
||||
);
|
||||
}
|
||||
|
||||
// Hilfsfunktion zum Erstellen eines Mock-Extraktors
|
||||
function createMockExtractor(bool $enabled = true, ?BehaviorType $behaviorType = null, array $features = []): MockInterface
|
||||
{
|
||||
$behaviorType = $behaviorType ?? BehaviorType::PATH_PATTERNS;
|
||||
|
||||
$extractor = Mockery::mock(FeatureExtractorInterface::class);
|
||||
$extractor->shouldReceive('isEnabled')->andReturn($enabled);
|
||||
$extractor->shouldReceive('getBehaviorType')->andReturn($behaviorType);
|
||||
$extractor->shouldReceive('getPriority')->andReturn(10);
|
||||
$extractor->shouldReceive('canExtract')->andReturn(true);
|
||||
$extractor->shouldReceive('extractFeatures')->andReturn($features);
|
||||
|
||||
return $extractor;
|
||||
}
|
||||
|
||||
// Hilfsfunktion zum Erstellen eines Mock-Detektors
|
||||
function createMockDetector(bool $enabled = true, array $supportedTypes = [], array $anomalies = []): MockInterface
|
||||
{
|
||||
$supportedTypes = $supportedTypes ?: [BehaviorType::PATH_PATTERNS];
|
||||
|
||||
$detector = Mockery::mock(AnomalyDetectorInterface::class);
|
||||
$detector->shouldReceive('isEnabled')->andReturn($enabled);
|
||||
$detector->shouldReceive('getName')->andReturn('MockDetector');
|
||||
$detector->shouldReceive('getSupportedBehaviorTypes')->andReturn($supportedTypes);
|
||||
$detector->shouldReceive('canAnalyze')->andReturn(true);
|
||||
$detector->shouldReceive('detectAnomalies')->andReturn($anomalies);
|
||||
$detector->shouldReceive('updateModel')->andReturn(null);
|
||||
|
||||
return $detector;
|
||||
}
|
||||
|
||||
// Hilfsfunktion zum Erstellen eines Mock-Clocks
|
||||
function createMockClock(): MockInterface
|
||||
{
|
||||
$clock = Mockery::mock(Clock::class);
|
||||
$dateTime = \App\Framework\DateTime\DateTime::fromString('2025-07-31 13:42:00');
|
||||
$timestamp = \App\Framework\Core\ValueObjects\Timestamp::fromDateTime($dateTime);
|
||||
$clock->shouldReceive('time')->andReturn($timestamp);
|
||||
|
||||
return $clock;
|
||||
}
|
||||
|
||||
test('vollständige ML-Pipeline erkennt normale Anfragen korrekt', function () {
|
||||
// Arrange
|
||||
$clock = createMockClock();
|
||||
|
||||
// Feature für normale Anfrage
|
||||
$normalFeature = new BehaviorFeature(
|
||||
type: BehaviorType::PATH_PATTERNS,
|
||||
name: 'path_depth',
|
||||
value: 3.0,
|
||||
unit: 'count'
|
||||
);
|
||||
|
||||
// Mock-Extraktoren erstellen
|
||||
$extractor = createMockExtractor(true, BehaviorType::PATH_PATTERNS, [$normalFeature]);
|
||||
|
||||
// Mock-Detektor erstellen (keine Anomalien für normale Anfrage)
|
||||
$detector = createMockDetector(true, [BehaviorType::PATH_PATTERNS], []);
|
||||
|
||||
// ML-Engine erstellen
|
||||
$engine = new MachineLearningEngine(
|
||||
enabled: true,
|
||||
extractors: [$extractor],
|
||||
detectors: [$detector],
|
||||
clock: $clock,
|
||||
analysisTimeout: Duration::fromSeconds(5),
|
||||
confidenceThreshold: Percentage::from(60.0)
|
||||
);
|
||||
|
||||
// Normale Anfrage erstellen
|
||||
$request = createNormalRequest();
|
||||
|
||||
// Act
|
||||
$result = $engine->analyzeRequest($request);
|
||||
|
||||
// Assert
|
||||
expect($result->features)->toHaveCount(1);
|
||||
expect($result->anomalies)->toBeEmpty();
|
||||
expect($result->confidence->getValue())->toBe(0.0);
|
||||
expect($result->error)->toBeNull();
|
||||
});
|
||||
|
||||
test('vollständige ML-Pipeline erkennt anomale Anfragen', function () {
|
||||
// Arrange
|
||||
$clock = createMockClock();
|
||||
|
||||
// Feature für anomale Anfrage
|
||||
$anomalousFeature = new BehaviorFeature(
|
||||
type: BehaviorType::PATH_PATTERNS,
|
||||
name: 'path_traversal',
|
||||
value: 5.0,
|
||||
unit: 'count'
|
||||
);
|
||||
|
||||
// Anomalie für die anomale Anfrage
|
||||
$anomaly = new AnomalyDetection(
|
||||
type: AnomalyType::STATISTICAL_ANOMALY,
|
||||
behaviorType: BehaviorType::PATH_PATTERNS,
|
||||
confidence: Percentage::from(80.0),
|
||||
anomalyScore: 0.9,
|
||||
description: 'Path traversal detected',
|
||||
features: [$anomalousFeature],
|
||||
evidence: [
|
||||
'path' => '/admin/config/system/../../../../../../etc/passwd',
|
||||
'traversal_depth' => 6,
|
||||
]
|
||||
);
|
||||
|
||||
// Mock-Extraktoren erstellen
|
||||
$extractor = createMockExtractor(true, BehaviorType::PATH_PATTERNS, [$anomalousFeature]);
|
||||
|
||||
// Mock-Detektor erstellen (gibt Anomalie zurück)
|
||||
$detector = createMockDetector(true, [BehaviorType::PATH_PATTERNS], [$anomaly]);
|
||||
|
||||
// ML-Engine erstellen
|
||||
$engine = new MachineLearningEngine(
|
||||
enabled: true,
|
||||
extractors: [$extractor],
|
||||
detectors: [$detector],
|
||||
clock: $clock,
|
||||
analysisTimeout: Duration::fromSeconds(5),
|
||||
confidenceThreshold: Percentage::from(60.0)
|
||||
);
|
||||
|
||||
// Anomale Anfrage erstellen
|
||||
$request = createAnomalousRequest();
|
||||
|
||||
// Act
|
||||
$result = $engine->analyzeRequest($request);
|
||||
|
||||
// Assert
|
||||
expect($result->features)->toHaveCount(1);
|
||||
expect($result->anomalies)->toHaveCount(1);
|
||||
expect($result->anomalies[0]->type)->toBe(AnomalyType::STATISTICAL_ANOMALY);
|
||||
expect($result->confidence->getValue())->toBeGreaterThan(70.0);
|
||||
expect($result->error)->toBeNull();
|
||||
});
|
||||
|
||||
test('ML-Pipeline mit deaktivierten Komponenten funktioniert korrekt', function () {
|
||||
// Arrange
|
||||
$clock = createMockClock();
|
||||
|
||||
// Feature für normale Anfrage
|
||||
$feature = new BehaviorFeature(
|
||||
type: BehaviorType::PATH_PATTERNS,
|
||||
name: 'path_depth',
|
||||
value: 3.0,
|
||||
unit: 'count'
|
||||
);
|
||||
|
||||
// Mock-Extraktoren erstellen (einer deaktiviert)
|
||||
$activeExtractor = createMockExtractor(true, BehaviorType::PATH_PATTERNS, [$feature]);
|
||||
$inactiveExtractor = createMockExtractor(false, BehaviorType::PARAMETER_PATTERNS, []);
|
||||
|
||||
// Mock-Detektoren erstellen (einer deaktiviert)
|
||||
$activeDetector = createMockDetector(true, [BehaviorType::PATH_PATTERNS], []);
|
||||
$inactiveDetector = createMockDetector(false, [BehaviorType::PARAMETER_PATTERNS], []);
|
||||
|
||||
// ML-Engine erstellen
|
||||
$engine = new MachineLearningEngine(
|
||||
enabled: true,
|
||||
extractors: [$activeExtractor, $inactiveExtractor],
|
||||
detectors: [$activeDetector, $inactiveDetector],
|
||||
clock: $clock,
|
||||
analysisTimeout: Duration::fromSeconds(5),
|
||||
confidenceThreshold: Percentage::from(60.0)
|
||||
);
|
||||
|
||||
// Anfrage erstellen
|
||||
$request = createNormalRequest();
|
||||
|
||||
// Act
|
||||
$result = $engine->analyzeRequest($request);
|
||||
|
||||
// Assert
|
||||
expect($result->features)->toHaveCount(1);
|
||||
expect($result->error)->toBeNull();
|
||||
|
||||
// Extractor-Ergebnisse prüfen
|
||||
$extractorResults = $result->extractorResults;
|
||||
expect($extractorResults)->toBeArray();
|
||||
|
||||
// Detector-Ergebnisse prüfen
|
||||
$detectorResults = $result->detectorResults;
|
||||
expect($detectorResults)->toBeArray();
|
||||
});
|
||||
|
||||
test('ML-Pipeline mit deaktivierter Engine gibt leeres Ergebnis zurück', function () {
|
||||
// Arrange
|
||||
$clock = createMockClock();
|
||||
|
||||
// Feature für normale Anfrage
|
||||
$feature = new BehaviorFeature(
|
||||
type: BehaviorType::PATH_PATTERNS,
|
||||
name: 'path_depth',
|
||||
value: 3.0,
|
||||
unit: 'count'
|
||||
);
|
||||
|
||||
// Mock-Extraktoren erstellen
|
||||
$extractor = createMockExtractor(true, BehaviorType::PATH_PATTERNS, [$feature]);
|
||||
|
||||
// Mock-Detektor erstellen
|
||||
$detector = createMockDetector(true, [BehaviorType::PATH_PATTERNS], []);
|
||||
|
||||
// ML-Engine erstellen (deaktiviert)
|
||||
$engine = new MachineLearningEngine(
|
||||
enabled: false,
|
||||
extractors: [$extractor],
|
||||
detectors: [$detector],
|
||||
clock: $clock,
|
||||
analysisTimeout: Duration::fromSeconds(5),
|
||||
confidenceThreshold: Percentage::from(60.0)
|
||||
);
|
||||
|
||||
// Anfrage erstellen
|
||||
$request = createNormalRequest();
|
||||
|
||||
// Act
|
||||
$result = $engine->analyzeRequest($request);
|
||||
|
||||
// Assert
|
||||
expect($result->enabled)->toBeFalse();
|
||||
expect($result->features)->toBeEmpty();
|
||||
expect($result->anomalies)->toBeEmpty();
|
||||
expect($result->confidence->getValue())->toBe(0.0);
|
||||
});
|
||||
|
||||
// Bereinigung nach jedem Test
|
||||
afterEach(function () {
|
||||
Mockery::close();
|
||||
});
|
||||
Reference in New Issue
Block a user