1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
|
# 去重指令
distinct = '''
match (n:NodeResolver53)
WITH n ORDER BY n.W DESC
with n.IP as IP,collect(n) as nodes,count(*) as c
where c>1
CALL apoc.refactor.mergeNodes(nodes,
{properties:'discard',mergeRels:true})
YIELD node
RETURN count(*)
'''
# 新建catelog
gds_newgraph = '''
CALL gds.graph.project(
'myGraph',
'NodeResolver53',
'IP_LINK',
{
relationshipProperties: 'W'
}
)
'''
# 删除旧的catelog
gds_delgraph = '''
CALL gds.graph.drop('myGraph', false) YIELD graphName
'''
# 高风险节点
dangerous_nodes = '''
CALL gds.pageRank.stream('myGraph')
YIELD nodeId, score
with gds.util.asNode(nodeId) as n
WHERE n.IPType contains "6"
RETURN n.IP as ip, n.ISP as isp,n.CCODE as ccode,n.COU as cou,n.PROV as prov, n.LAT as lat,n.LNG as lng ,score
ORDER BY score DESC limit %s'''
# 高危节点邻居
dnode_neighbor = '''
CALL gds.pageRank.stream('myGraph')
YIELD nodeId, score
WHERE gds.util.asNode(nodeId).IPType contains "6"
with gds.util.asNode(nodeId) AS no, score ORDER BY score DESC limit %s
with collect(no) as nlist
MATCH (m:NodeResolver53)-[r:IP_LINK]->(n:NodeResolver53)
WHERE n in nlist and m.IPType contains "4"
RETURN n.IP,r.W,m'''
# 节点邻居
node_neighbors = '''MATCH(n:NodeResolver53{IP:'%s'})-[]->(m:NodeResolver53) RETURN m'''
# 节点全部信息
# IP关联数据，以地理位置代表
IP_relate = '''MATCH (n:NodeResolver53)-[]->(m:NodeResolver53)
with n.LAT as flat,n.LNG as flng,m.LAT as tlat,m.LNG as tlng ,count(*) as c
RETURN flat,flng,tlat,tlng,c
order by c DESC limit 10000
'''
# AS关联数据
AS_relate = '''
MATCH(n:NodeResolver53)-[l:IP_LINK]->(d:NodeResolver53)
WITH n.AS AS fasn, d.AS AS tasn, count(*) AS c
RETURN fasn,tasn,c
order by c DESC limit 10000
'''
# ISP关联数据
ISP_relate = '''MATCH(n:NodeResolver53)-[l:IP_LINK]->(d:NodeResolver53)
WITH n.ISP AS fisp, d.ISP AS tisp, count(*) AS c
RETURN fisp,tisp,c
order by c DESC limit 10000'''
# AS分布
AS_dist = '''MATCH(n:NodeResolver53{IPType:"v6"})
with n.AS as asn,count(*) as c
RETURN asn,c
order by c DESC limit 10000
'''
# ISP分布统计
ISP_dist = '''MATCH(n:NodeResolver53{IPType:"v6"})
with n.ISP as isp,count(*) as c
RETURN isp,c
order by c DESC limit 10000
'''
# 国家分布统计
cou_dist = '''MATCH(n:NodeResolver53{IPType:"v6"}) with n.COU as cou,count(*) as c RETURN cou,c'''
ccode_dist = '''MATCH(n:NodeResolver53{IPType:"v6"}) with n.CCODE as ccode,count(*) as c RETURN ccode,c'''
# 双栈服务数量统计
dualcountcypher = '''
CALL gds.wcc.stream('myGraph')
YIELD nodeId,componentId
with componentId as cid,count(*) as c
where 1<c<4
with collect(cid) as cc
CALL gds.wcc.stream('myGraph')
YIELD nodeId,componentId
where componentId in cc
with gds.util.asNode(nodeId).IP as ip,componentId
where ip contains ":"
return count(distinct componentId)
'''
# 双栈服务详细数据
dualdatacypher = '''
CALL gds.wcc.stream('myGraph')
YIELD nodeId,componentId
with componentId as cid,count(*) as c
where 1<c<4
with collect(cid) as cc
CALL gds.wcc.stream('myGraph')
YIELD nodeId,componentId
where componentId in cc
with gds.util.asNode(nodeId).IP as ip,componentId
where ip contains ":"
with collect(componentId) as ccl
CALL gds.wcc.stream('myGraph')
YIELD nodeId,componentId
where componentId in ccl
with gds.util.asNode(nodeId) as n,componentId
return n.IP,n.ISP,n.COU,n.CCODE,n.PROV,n.LAT,n.LNG,componentId
order by componentId limit 30
'''
# v6dns计数
v6count = '''
match (n:NodeResolver53) where n.IPType contains "6" return count(n)'''
delQuery = '''
CALL apoc.periodic.commit("MATCH (n:NodeResolverQuery)
WITH n LIMIT $limit DETACH DELETE n RETURN count(*)",{limit: 10000})
YIELD updates, executions, runtime, batches
RETURN updates, executions, runtime, batches;'''
|
