MalwareHits.java

Go to the documentation of this file.

/*
 * Autopsy Forensic Browser
 *
 * Copyright 2023 Basis Technology Corp.
 * Contact: carrier <at> sleuthkit <dot> org
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.autopsy.datamodel;
 
import java.beans.PropertyChangeEvent;
import java.beans.PropertyChangeListener;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.ArrayList;
import java.util.Collections;
import java.util.EnumSet;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Observable;
import java.util.Observer;
import java.util.Set;
import java.util.logging.Level;
import org.openide.nodes.Children;
import org.openide.nodes.Node;
import org.openide.nodes.Sheet;
import org.openide.util.NbBundle;
import org.openide.util.WeakListeners;
import org.openide.util.lookup.Lookups;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.ingest.IngestManager;
import org.sleuthkit.autopsy.ingest.ModuleDataEvent;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.SleuthkitCase.CaseDbQuery;
import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.autopsy.datamodel.Artifacts.UpdatableCountTypeNode;
import org.sleuthkit.datamodel.AnalysisResult;
import static org.sleuthkit.datamodel.BlackboardArtifact.Type.TSK_MALWARE;
import org.sleuthkit.datamodel.Score;

public class MalwareHits implements AutopsyVisitableItem {
 
    private static final Logger logger = Logger.getLogger(MalwareHits.class.getName());
    private static final Set<IngestManager.IngestJobEvent> INGEST_JOB_EVENTS_OF_INTEREST = EnumSet.of(IngestManager.IngestJobEvent.COMPLETED, IngestManager.IngestJobEvent.CANCELLED);
    private static final Set<IngestManager.IngestModuleEvent> INGEST_MODULE_EVENTS_OF_INTEREST = EnumSet.of(IngestManager.IngestModuleEvent.DATA_ADDED);
    private SleuthkitCase skCase;
    private final MalwareResults malwareResults;
    private final long filteringDSObjId; // 0 if not filtering/grouping by data source

    public MalwareHits(SleuthkitCase skCase) {
        this(skCase, 0);
    }

    public MalwareHits(SleuthkitCase skCase, long objId) {
        this.skCase = skCase;
        this.filteringDSObjId = objId;
        malwareResults = new MalwareResults();
    }
 
    @Override
    public <T> T accept(AutopsyItemVisitor<T> visitor) {
        return visitor.visit(this);
    }

    private class MalwareResults extends Observable implements Observer {
 
        // list of artifacts
        // NOTE: the list can be accessed by multiple worker threads and needs to be synchronized
        private final Set<Long> malwareHits = new HashSet<>();
 
        MalwareResults() {
            addNotify();
            update();
        }
 
        Set<Long> getArtifactIds() {
            synchronized (malwareHits) {
                return Collections.unmodifiableSet(malwareHits);
            }
        }
 
        @SuppressWarnings("deprecation")
        final void update() {
            synchronized (malwareHits) {
                malwareHits.clear();
            }
 
            if (skCase == null) {
                return;
            }
 
            String query = "SELECT blackboard_artifacts.artifact_obj_id " //NON-NLS
                    + "FROM blackboard_artifacts,tsk_analysis_results WHERE " //NON-NLS
                    + "blackboard_artifacts.artifact_type_id=" + TSK_MALWARE.getTypeID() //NON-NLS
                    + " AND tsk_analysis_results.artifact_obj_id=blackboard_artifacts.artifact_obj_id" //NON-NLS
                    + " AND (tsk_analysis_results.significance=" + Score.Significance.NOTABLE.getId() //NON-NLS
                    + " OR tsk_analysis_results.significance=" + Score.Significance.LIKELY_NOTABLE.getId() + " )"; //NON-NLS
            if (filteringDSObjId > 0) {
                query += "  AND blackboard_artifacts.data_source_obj_id = " + filteringDSObjId; //NON-NLS
            }
 
            try (CaseDbQuery dbQuery = skCase.executeQuery(query)) {
                ResultSet resultSet = dbQuery.getResultSet();
                synchronized (malwareHits) {
                    while (resultSet.next()) {
                        long artifactObjId = resultSet.getLong("artifact_obj_id"); //NON-NLS
                        malwareHits.add(artifactObjId);
                    }
                }
            } catch (TskCoreException | SQLException ex) {
                logger.log(Level.WARNING, "SQL Exception occurred: ", ex); //NON-NLS
            }
 
            setChanged();
            notifyObservers();
        }
 
        private final PropertyChangeListener pcl = new PropertyChangeListener() {
            @Override
            public void propertyChange(PropertyChangeEvent evt) {
                String eventType = evt.getPropertyName();
                if (eventType.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
                    try {
                        Case.getCurrentCaseThrows();
                        ModuleDataEvent eventData = (ModuleDataEvent) evt.getOldValue();
                        if (null != eventData && eventData.getBlackboardArtifactType().getTypeID() == TSK_MALWARE.getTypeID()) {
                            malwareResults.update();
                        }
                    } catch (NoCurrentCaseException notUsed) {
                    }
                } else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
                        || eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
                    try {
                        Case.getCurrentCaseThrows();
                        malwareResults.update();
                    } catch (NoCurrentCaseException notUsed) {
                    }
                } else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
                    // case was closed. Remove listeners so that we don't get called with a stale case handle
                    if (evt.getNewValue() == null) {
                        removeNotify();
                        skCase = null;
                    }
                }
            }
        };
 
        private final PropertyChangeListener weakPcl = WeakListeners.propertyChange(pcl, null);
 
        protected void addNotify() {
            IngestManager.getInstance().addIngestJobEventListener(INGEST_JOB_EVENTS_OF_INTEREST, weakPcl);
            IngestManager.getInstance().addIngestModuleEventListener(INGEST_MODULE_EVENTS_OF_INTEREST, weakPcl);
            Case.addEventTypeSubscriber(EnumSet.of(Case.Events.CURRENT_CASE), weakPcl);
        }
        
        protected void removeNotify() {
            IngestManager.getInstance().removeIngestJobEventListener(weakPcl);
            IngestManager.getInstance().removeIngestModuleEventListener(weakPcl);
            Case.removeEventTypeSubscriber(EnumSet.of(Case.Events.CURRENT_CASE), weakPcl);            
        }
 
        @Override
        protected void finalize() throws Throwable {
            super.finalize();
            removeNotify();
        }
 
        @Override
        public void update(Observable o, Object arg) {
            update();
        }
    }

    public class RootNode extends UpdatableCountTypeNode {
 
        public RootNode() {
            super(Children.create(new HitFactory(TSK_MALWARE.getDisplayName()), true),
                    Lookups.singleton(TSK_MALWARE.getDisplayName()),
                    TSK_MALWARE.getDisplayName(),
                    filteringDSObjId,
                    TSK_MALWARE);
 
            super.setName(TSK_MALWARE.getTypeName());
            // TODO make an icon
            this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/artifact-icon.png");
        }
 
        @Override
        public boolean isLeafTypeNode() {
            return true;
        }
 
        @Override
        public <T> T accept(DisplayableItemNodeVisitor<T> visitor) {
            return visitor.visit(this);
        }
 
        @Override
        protected Sheet createSheet() {
            Sheet sheet = super.createSheet();
            Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
            if (sheetSet == null) {
                sheetSet = Sheet.createPropertiesSet();
                sheet.put(sheetSet);
            }
 
            sheetSet.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "MalwareHits.createSheet.name.name"),
                    NbBundle.getMessage(this.getClass(), "MalwareHits.createSheet.name.displayName"),
                    NbBundle.getMessage(this.getClass(), "MalwareHits.createSheet.name.desc"),
                    getName()));
 
            return sheet;
        }
 
        @Override
        public String getItemType() {
            return getClass().getName();
        }

        @Override
        void updateDisplayName() {
            super.setDisplayName(TSK_MALWARE.getDisplayName() + " (" + malwareResults.getArtifactIds().size() + ")");
        }
    }

    private class HitFactory extends BaseChildFactory<AnalysisResult> implements Observer {
 
        private final Map<Long, AnalysisResult> artifactHits = new HashMap<>();
 
        private HitFactory(String nodeName) {
            super(nodeName);
        }
 
        @Override
        protected void onAdd() {
            malwareResults.addObserver(this);
        }
 
        @Override
        protected void onRemove() {
            malwareResults.deleteObserver(this);
        }
 
        @Override
        protected Node createNodeForKey(AnalysisResult key) {
            return new BlackboardArtifactNode(key);
        }
 
        @Override
        public void update(Observable o, Object arg) {
            refresh(true);
        }
 
        @Override
        protected List<AnalysisResult> makeKeys() {
            if (skCase != null) {
 
                malwareResults.getArtifactIds().forEach((id) -> {
                    try {
                        if (!artifactHits.containsKey(id)) {
                            AnalysisResult art = skCase.getBlackboard().getAnalysisResultById(id);
                            //Cache attributes while we are off the EDT.
                            //See JIRA-5969
                            art.getAttributes();
                            artifactHits.put(id, art);
                        }
                    } catch (TskCoreException ex) {
                        logger.log(Level.SEVERE, "TSK Exception occurred", ex); //NON-NLS
                    }
                });
                return new ArrayList<>(artifactHits.values());
            }
            return Collections.emptyList();
        }
    }
}