初始提交：恶意 IP 特征+行为融合检测系统

- 特征检测（规则/签名）与行为检测（24h 统计）单进程运行
- 融合名单按首次发现时间倒序，展示位置/归属（GeoIP + ASN）
- 钉钉融合推送（加签、24h 节流、去重）
- 页面状态灯、CSV 导出、Docker 镜像构建文件

docker-build/Dockerfile

@@ -0,0 +1,30 @@
+FROM python:3.12-slim
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    DATA_DIR=/data
+
+WORKDIR /app
+
+# application code (no credentials, no config files)
+COPY app/graylog_ops /app/graylog_ops
+COPY app/bin /app/bin
+COPY app/profiles /app/profiles
+COPY app/allowlist.example.txt /app/allowlist.example.txt
+COPY app/asn_brand_map.json /app/asn_brand_map.json
+
+# seed data: current production snapshot (sqlite + geo + asn + blocklist)
+COPY seed /app/seed
+
+COPY entrypoint.sh /app/entrypoint.sh
+RUN chmod +x /app/entrypoint.sh
+
+VOLUME ["/data"]
+EXPOSE 8088
+
+HEALTHCHECK --interval=60s --timeout=5s --start-period=30s \
+  CMD python3 -c "import os,urllib.request,sys; \
+url='http://127.0.0.1:%s/healthz' % os.environ.get('APP_PORT','8088'); \
+sys.exit(0 if urllib.request.urlopen(url, timeout=4).status == 200 else 1)"
+
+ENTRYPOINT ["/app/entrypoint.sh"]

docker-build/entrypoint.sh

@@ -0,0 +1,30 @@
+#!/bin/sh
+set -eu
+DATA_DIR="${DATA_DIR:-/data}"
+if [ ! -f "$DATA_DIR/ips.db" ]; then
+  echo "[init] 初始化数据目录: $DATA_DIR"
+  mkdir -p "$DATA_DIR"
+  cp -a /app/seed/. "$DATA_DIR"/
+fi
+
+set -- watch \
+  --stream "${GRAYLOG_STREAM:-F5_Accesslog}" \
+  --profile "${PROFILE:-/app/profiles/f5.json}" \
+  --interval "${CHECK_INTERVAL:-60}" \
+  --window "${WINDOW:-3600}" \
+  --forget "${FORGET:-604800}" \
+  --db "$DATA_DIR/ips.db" \
+  --host 0.0.0.0 \
+  --port "${APP_PORT:-8088}" \
+  --path-prefix "${APP_PATH_PREFIX:-}" \
+  --geo-db "$DATA_DIR/geo/geo.db" \
+  --asn-db "$DATA_DIR/geo/asn.db" \
+  --allow /app/allowlist.example.txt \
+  --export "$DATA_DIR/blocklist.txt" \
+  --behavior-interval "${BEHAVIOR_INTERVAL:-900}" \
+  --warm-limit "${WARM_LIMIT:-5}"
+
+if [ "${NO_BEHAVIOR:-0}" = "1" ]; then
+  set -- "$@" --no-behavior
+fi
+exec python3 -m graylog_ops "$@"