File Integrity Monitoring (FIM) is a security control that detects and alerts on changes to files and directories. This guide covers comprehensive FIM implementation for Java applications.
Core Concepts
What is File Integrity Monitoring?
- Real-time monitoring of file system changes
- Detection of unauthorized modifications
- Integrity verification through cryptographic hashing
- Alerting and reporting on suspicious activities
Key Features:
- Real-time file monitoring using watch services
- Cryptographic hashing for integrity verification
- Change detection and classification
- Alerting mechanisms for suspicious activities
- Compliance reporting (PCI DSS, HIPAA, SOX)
Dependencies and Setup
1. Maven Dependencies
<properties>
<jackson.version>2.15.2</jackson.version>
<commons-io.version>2.13.0</commons-io.version>
<guava.version>32.1.2-jre</guava.version>
<logback.version>1.4.11</logback.version>
</properties>
<dependencies>
<!-- File Utilities -->
<dependency>
<groupId>commons-io</groupId>
<artifactId>commons-io</artifactId>
<version>${commons-io.version}</version>
</dependency>
<!-- Hashing and Crypto -->
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>${guava.version}</version>
</dependency>
<!-- JSON Processing -->
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>${jackson.version}</version>
</dependency>
<!-- Logging -->
<dependency>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
<version>${logback.version}</version>
</dependency>
<!-- Watch Service (JDK built-in) -->
</dependencies>
2. Directory Structure
src/main/java/ ├── fim/ │ ├── core/ │ │ ├── FileIntegrityMonitor.java │ │ ├── FileWatcherService.java │ │ └── HashCalculator.java │ ├── model/ │ │ ├── FileEvent.java │ │ ├── FileMetadata.java │ │ └── MonitorConfig.java │ ├── storage/ │ │ ├── BaselineStorage.java │ │ └── EventStorage.java │ ├── alert/ │ │ ├── AlertManager.java │ │ └── NotificationService.java │ └── report/ │ ├── ReportGenerator.java │ └── ComplianceReporter.java
Core Implementation
1. File Event Model
// FileEvent.java
package com.example.fim.model;
import java.io.File;
import java.time.Instant;
import java.util.Map;
public class FileEvent {
public enum EventType {
CREATED, MODIFIED, DELETED, RENAMED, ATTRIBUTES_CHANGED
}
public enum ChangeType {
CONTENT, PERMISSIONS, OWNERSHIP, TIMESTAMP, ALL
}
private String eventId;
private EventType eventType;
private ChangeType changeType;
private String filePath;
private String fileName;
private long fileSize;
private Instant timestamp;
private String oldFilePath; // For rename events
private String newFilePath; // For rename events
private String oldHash;
private String newHash;
private Map<String, Object> metadata;
private String user;
private String process;
private int severity; // 1-10 scale
private boolean suspicious;
// Constructors
public FileEvent() {
this.eventId = java.util.UUID.randomUUID().toString();
this.timestamp = Instant.now();
}
public FileEvent(EventType eventType, String filePath) {
this();
this.eventType = eventType;
this.filePath = filePath;
this.fileName = new File(filePath).getName();
}
// Getters and setters
public String getEventId() { return eventId; }
public void setEventId(String eventId) { this.eventId = eventId; }
public EventType getEventType() { return eventType; }
public void setEventType(EventType eventType) { this.eventType = eventType; }
public ChangeType getChangeType() { return changeType; }
public void setChangeType(ChangeType changeType) { this.changeType = changeType; }
public String getFilePath() { return filePath; }
public void setFilePath(String filePath) { this.filePath = filePath; }
public String getFileName() { return fileName; }
public void setFileName(String fileName) { this.fileName = fileName; }
public long getFileSize() { return fileSize; }
public void setFileSize(long fileSize) { this.fileSize = fileSize; }
public Instant getTimestamp() { return timestamp; }
public void setTimestamp(Instant timestamp) { this.timestamp = timestamp; }
public String getOldFilePath() { return oldFilePath; }
public void setOldFilePath(String oldFilePath) { this.oldFilePath = oldFilePath; }
public String getNewFilePath() { return newFilePath; }
public void setNewFilePath(String newFilePath) { this.newFilePath = newFilePath; }
public String getOldHash() { return oldHash; }
public void setOldHash(String oldHash) { this.oldHash = oldHash; }
public String getNewHash() { return newHash; }
public void setNewHash(String newHash) { this.newHash = newHash; }
public Map<String, Object> getMetadata() { return metadata; }
public void setMetadata(Map<String, Object> metadata) { this.metadata = metadata; }
public String getUser() { return user; }
public void setUser(String user) { this.user = user; }
public String getProcess() { return process; }
public void setProcess(String process) { this.process = process; }
public int getSeverity() { return severity; }
public void setSeverity(int severity) { this.severity = severity; }
public boolean isSuspicious() { return suspicious; }
public void setSuspicious(boolean suspicious) { this.suspicious = suspicious; }
@Override
public String toString() {
return String.format("FileEvent[type=%s, file=%s, time=%s, suspicious=%s]",
eventType, filePath, timestamp, suspicious);
}
}
2. File Metadata Model
// FileMetadata.java
package com.example.fim.model;
import java.nio.file.attribute.*;
import java.time.Instant;
import java.util.HashMap;
import java.util.Map;
public class FileMetadata {
private String filePath;
private long size;
private Instant createdTime;
private Instant modifiedTime;
private Instant accessedTime;
private String owner;
private String group;
private String permissions;
private String hash;
private String hashAlgorithm;
private Map<String, Object> additionalAttributes;
public FileMetadata() {
this.additionalAttributes = new HashMap<>();
}
public FileMetadata(String filePath) {
this();
this.filePath = filePath;
}
// Static factory method from BasicFileAttributes
public static FileMetadata fromBasicAttributes(String filePath, BasicFileAttributes attrs) {
FileMetadata metadata = new FileMetadata(filePath);
metadata.setSize(attrs.size());
metadata.setCreatedTime(Instant.from(attrs.creationTime()));
metadata.setModifiedTime(Instant.from(attrs.lastModifiedTime()));
metadata.setAccessedTime(Instant.from(attrs.lastAccessTime()));
return metadata;
}
// Static factory method from PosixFileAttributes
public static FileMetadata fromPosixAttributes(String filePath, PosixFileAttributes attrs) {
FileMetadata metadata = fromBasicAttributes(filePath, attrs);
metadata.setOwner(attrs.owner().getName());
metadata.setGroup(attrs.group().getName());
metadata.setPermissions(attrs.permissions().toString());
return metadata;
}
// Getters and setters
public String getFilePath() { return filePath; }
public void setFilePath(String filePath) { this.filePath = filePath; }
public long getSize() { return size; }
public void setSize(long size) { this.size = size; }
public Instant getCreatedTime() { return createdTime; }
public void setCreatedTime(Instant createdTime) { this.createdTime = createdTime; }
public Instant getModifiedTime() { return modifiedTime; }
public void setModifiedTime(Instant modifiedTime) { this.modifiedTime = modifiedTime; }
public Instant getAccessedTime() { return accessedTime; }
public void setAccessedTime(Instant accessedTime) { this.accessedTime = accessedTime; }
public String getOwner() { return owner; }
public void setOwner(String owner) { this.owner = owner; }
public String getGroup() { return group; }
public void setGroup(String group) { this.group = group; }
public String getPermissions() { return permissions; }
public void setPermissions(String permissions) { this.permissions = permissions; }
public String getHash() { return hash; }
public void setHash(String hash) { this.hash = hash; }
public String getHashAlgorithm() { return hashAlgorithm; }
public void setHashAlgorithm(String hashAlgorithm) { this.hashAlgorithm = hashAlgorithm; }
public Map<String, Object> getAdditionalAttributes() { return additionalAttributes; }
public void setAdditionalAttributes(Map<String, Object> additionalAttributes) {
this.additionalAttributes = additionalAttributes;
}
public void addAttribute(String key, Object value) {
this.additionalAttributes.put(key, value);
}
public Object getAttribute(String key) {
return this.additionalAttributes.get(key);
}
}
3. Monitor Configuration
// MonitorConfig.java
package com.example.fim.model;
import java.util.*;
import java.util.regex.Pattern;
public class MonitorConfig {
private List<String> monitoredDirectories;
private List<String> excludedDirectories;
private List<Pattern> includedPatterns;
private List<Pattern> excludedPatterns;
private boolean recursive = true;
private long pollInterval = 5000; // milliseconds
private int maxDepth = Integer.MAX_VALUE;
private String hashAlgorithm = "SHA-256";
private boolean monitorContentChanges = true;
private boolean monitorPermissionChanges = true;
private boolean monitorOwnershipChanges = true;
private boolean monitorTimestampChanges = false;
private int alertThreshold = 7; // 1-10 scale
private Map<String, Object> alertRules;
private boolean realTimeMonitoring = true;
private boolean baselineValidation = true;
private long baselineInterval = 3600000; // 1 hour in milliseconds
public MonitorConfig() {
this.monitoredDirectories = new ArrayList<>();
this.excludedDirectories = new ArrayList<>();
this.includedPatterns = new ArrayList<>();
this.excludedPatterns = new ArrayList<>();
this.alertRules = new HashMap<>();
initializeDefaultRules();
}
private void initializeDefaultRules() {
// Default alert rules
alertRules.put("system_files", true);
alertRules.put("executable_changes", true);
alertRules.put("config_changes", true);
alertRules.put("after_hours", true);
alertRules.put("multiple_changes", true);
alertRules.put("suspicious_extensions", Arrays.asList(".exe", ".dll", ".bat", ".sh"));
}
// Builder pattern for fluent configuration
public static class Builder {
private MonitorConfig config;
public Builder() {
config = new MonitorConfig();
}
public Builder addMonitoredDirectory(String directory) {
config.monitoredDirectories.add(directory);
return this;
}
public Builder addExcludedDirectory(String directory) {
config.excludedDirectories.add(directory);
return this;
}
public Builder addIncludedPattern(String pattern) {
config.includedPatterns.add(Pattern.compile(pattern));
return this;
}
public Builder addExcludedPattern(String pattern) {
config.excludedPatterns.add(Pattern.compile(pattern));
return this;
}
public Builder recursive(boolean recursive) {
config.recursive = recursive;
return this;
}
public Builder pollInterval(long pollInterval) {
config.pollInterval = pollInterval;
return this;
}
public Builder hashAlgorithm(String hashAlgorithm) {
config.hashAlgorithm = hashAlgorithm;
return this;
}
public Builder alertThreshold(int threshold) {
config.alertThreshold = threshold;
return this;
}
public MonitorConfig build() {
return config;
}
}
// Getters and setters
public List<String> getMonitoredDirectories() { return monitoredDirectories; }
public void setMonitoredDirectories(List<String> monitoredDirectories) {
this.monitoredDirectories = monitoredDirectories;
}
public List<String> getExcludedDirectories() { return excludedDirectories; }
public void setExcludedDirectories(List<String> excludedDirectories) {
this.excludedDirectories = excludedDirectories;
}
public List<Pattern> getIncludedPatterns() { return includedPatterns; }
public void setIncludedPatterns(List<Pattern> includedPatterns) {
this.includedPatterns = includedPatterns;
}
public List<Pattern> getExcludedPatterns() { return excludedPatterns; }
public void setExcludedPatterns(List<Pattern> excludedPatterns) {
this.excludedPatterns = excludedPatterns;
}
public boolean isRecursive() { return recursive; }
public void setRecursive(boolean recursive) { this.recursive = recursive; }
public long getPollInterval() { return pollInterval; }
public void setPollInterval(long pollInterval) { this.pollInterval = pollInterval; }
public int getMaxDepth() { return maxDepth; }
public void setMaxDepth(int maxDepth) { this.maxDepth = maxDepth; }
public String getHashAlgorithm() { return hashAlgorithm; }
public void setHashAlgorithm(String hashAlgorithm) { this.hashAlgorithm = hashAlgorithm; }
public boolean isMonitorContentChanges() { return monitorContentChanges; }
public void setMonitorContentChanges(boolean monitorContentChanges) {
this.monitorContentChanges = monitorContentChanges;
}
public boolean isMonitorPermissionChanges() { return monitorPermissionChanges; }
public void setMonitorPermissionChanges(boolean monitorPermissionChanges) {
this.monitorPermissionChanges = monitorPermissionChanges;
}
public boolean isMonitorOwnershipChanges() { return monitorOwnershipChanges; }
public void setMonitorOwnershipChanges(boolean monitorOwnershipChanges) {
this.monitorOwnershipChanges = monitorOwnershipChanges;
}
public boolean isMonitorTimestampChanges() { return monitorTimestampChanges; }
public void setMonitorTimestampChanges(boolean monitorTimestampChanges) {
this.monitorTimestampChanges = monitorTimestampChanges;
}
public int getAlertThreshold() { return alertThreshold; }
public void setAlertThreshold(int alertThreshold) { this.alertThreshold = alertThreshold; }
public Map<String, Object> getAlertRules() { return alertRules; }
public void setAlertRules(Map<String, Object> alertRules) { this.alertRules = alertRules; }
public boolean isRealTimeMonitoring() { return realTimeMonitoring; }
public void setRealTimeMonitoring(boolean realTimeMonitoring) {
this.realTimeMonitoring = realTimeMonitoring;
}
public boolean isBaselineValidation() { return baselineValidation; }
public void setBaselineValidation(boolean baselineValidation) {
this.baselineValidation = baselineValidation;
}
public long getBaselineInterval() { return baselineInterval; }
public void setBaselineInterval(long baselineInterval) { this.baselineInterval = baselineInterval; }
// Utility methods
public boolean shouldMonitorFile(String filePath) {
// Check excluded patterns first
for (Pattern pattern : excludedPatterns) {
if (pattern.matcher(filePath).matches()) {
return false;
}
}
// Check included patterns
if (!includedPatterns.isEmpty()) {
for (Pattern pattern : includedPatterns) {
if (pattern.matcher(filePath).matches()) {
return true;
}
}
return false;
}
return true;
}
public boolean isDirectoryExcluded(String directoryPath) {
return excludedDirectories.stream()
.anyMatch(excluded -> directoryPath.startsWith(excluded));
}
}
Core Monitoring Engine
1. Hash Calculator
// HashCalculator.java
package com.example.fim.core;
import java.io.*;
import java.nio.file.Files;
import java.nio.file.Path;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.HexFormat;
public class HashCalculator {
private final String algorithm;
private final int bufferSize;
public HashCalculator(String algorithm) {
this.algorithm = algorithm;
this.bufferSize = 8192; // 8KB buffer
}
public HashCalculator() {
this("SHA-256");
}
public String calculateHash(File file) throws IOException {
try (InputStream inputStream = new FileInputStream(file)) {
return calculateHash(inputStream);
}
}
public String calculateHash(Path path) throws IOException {
try (InputStream inputStream = Files.newInputStream(path)) {
return calculateHash(inputStream);
}
}
public String calculateHash(InputStream inputStream) throws IOException {
try {
MessageDigest digest = MessageDigest.getInstance(algorithm);
byte[] buffer = new byte[bufferSize];
int bytesRead;
while ((bytesRead = inputStream.read(buffer)) != -1) {
digest.update(buffer, 0, bytesRead);
}
byte[] hashBytes = digest.digest();
return HexFormat.of().formatHex(hashBytes);
} catch (NoSuchAlgorithmException e) {
throw new IOException("Hash algorithm not supported: " + algorithm, e);
}
}
public String calculateHash(byte[] data) {
try {
MessageDigest digest = MessageDigest.getInstance(algorithm);
byte[] hashBytes = digest.digest(data);
return HexFormat.of().formatHex(hashBytes);
} catch (NoSuchAlgorithmException e) {
throw new RuntimeException("Hash algorithm not supported: " + algorithm, e);
}
}
// Quick hash for small files (in-memory)
public String calculateQuickHash(File file) throws IOException {
byte[] fileContent = Files.readAllBytes(file.toPath());
return calculateHash(fileContent);
}
public String getAlgorithm() {
return algorithm;
}
// Verify file integrity
public boolean verifyIntegrity(File file, String expectedHash) throws IOException {
String actualHash = calculateHash(file);
return MessageDigest.isEqual(
HexFormat.of().parseHex(expectedHash),
HexFormat.of().parseHex(actualHash)
);
}
// Compare two files
public boolean compareFiles(File file1, File file2) throws IOException {
String hash1 = calculateHash(file1);
String hash2 = calculateHash(file2);
return hash1.equals(hash2);
}
}
2. File Watcher Service
// FileWatcherService.java
package com.example.fim.core;
import com.example.fim.model.FileEvent;
import com.example.fim.model.MonitorConfig;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.io.IOException;
import java.nio.file.*;
import java.util.*;
import java.util.concurrent.*;
import static java.nio.file.StandardWatchEventKinds.*;
public class FileWatcherService {
private static final Logger logger = LoggerFactory.getLogger(FileWatcherService.class);
private final MonitorConfig config;
private final HashCalculator hashCalculator;
private final WatchService watchService;
private final Map<WatchKey, Path> watchKeys;
private final ExecutorService executorService;
private volatile boolean running = false;
private final List<FileEventListener> listeners;
public FileWatcherService(MonitorConfig config) throws IOException {
this.config = config;
this.hashCalculator = new HashCalculator(config.getHashAlgorithm());
this.watchService = FileSystems.getDefault().newWatchService();
this.watchKeys = new ConcurrentHashMap<>();
this.executorService = Executors.newSingleThreadExecutor(r -> {
Thread t = new Thread(r, "file-watcher");
t.setDaemon(true);
return t;
});
this.listeners = new CopyOnWriteArrayList<>();
}
public void start() {
if (running) {
logger.warn("File watcher is already running");
return;
}
running = true;
executorService.submit(this::watchLoop);
registerDirectories();
logger.info("File Integrity Monitoring started for {} directories",
config.getMonitoredDirectories().size());
}
public void stop() {
running = false;
executorService.shutdown();
try {
if (!executorService.awaitTermination(5, TimeUnit.SECONDS)) {
executorService.shutdownNow();
}
} catch (InterruptedException e) {
executorService.shutdownNow();
Thread.currentThread().interrupt();
}
try {
watchService.close();
} catch (IOException e) {
logger.error("Error closing watch service", e);
}
logger.info("File Integrity Monitoring stopped");
}
private void registerDirectories() {
for (String directoryPath : config.getMonitoredDirectories()) {
try {
Path directory = Paths.get(directoryPath);
if (!Files.exists(directory) || !Files.isDirectory(directory)) {
logger.warn("Directory does not exist or is not a directory: {}", directoryPath);
continue;
}
if (config.isDirectoryExcluded(directoryPath)) {
logger.debug("Skipping excluded directory: {}", directoryPath);
continue;
}
registerDirectory(directory);
// Register subdirectories recursively if enabled
if (config.isRecursive()) {
registerSubdirectories(directory, config.getMaxDepth());
}
} catch (Exception e) {
logger.error("Failed to register directory: {}", directoryPath, e);
}
}
}
private void registerDirectory(Path directory) throws IOException {
WatchKey key = directory.register(watchService,
ENTRY_CREATE, ENTRY_DELETE, ENTRY_MODIFY);
watchKeys.put(key, directory);
logger.debug("Registered directory for monitoring: {}", directory);
}
private void registerSubdirectories(Path directory, int maxDepth) throws IOException {
if (maxDepth <= 0) return;
try (DirectoryStream<Path> stream = Files.newDirectoryStream(directory)) {
for (Path entry : stream) {
if (Files.isDirectory(entry) && !Files.isSymbolicLink(entry)) {
String entryPath = entry.toString();
if (config.shouldMonitorFile(entryPath) &&
!config.isDirectoryExcluded(entryPath)) {
registerDirectory(entry);
registerSubdirectories(entry, maxDepth - 1);
}
}
}
} catch (IOException e) {
logger.error("Error registering subdirectories for: {}", directory, e);
}
}
private void watchLoop() {
logger.info("Starting file watch loop");
while (running) {
try {
WatchKey key = watchService.poll(config.getPollInterval(), TimeUnit.MILLISECONDS);
if (key == null) {
continue;
}
Path directory = watchKeys.get(key);
if (directory == null) {
logger.warn("WatchKey not recognized");
key.cancel();
continue;
}
processWatchKeyEvents(key, directory);
// Reset key and remove if no longer valid
boolean valid = key.reset();
if (!valid) {
watchKeys.remove(key);
logger.debug("WatchKey no longer valid for: {}", directory);
}
} catch (InterruptedException e) {
Thread.currentThread().interrupt();
logger.info("File watch loop interrupted");
break;
} catch (ClosedWatchServiceException e) {
logger.info("Watch service closed");
break;
} catch (Exception e) {
logger.error("Unexpected error in file watch loop", e);
}
}
logger.info("File watch loop stopped");
}
private void processWatchKeyEvents(WatchKey key, Path directory) {
for (WatchEvent<?> event : key.pollEvents()) {
WatchEvent.Kind<?> kind = event.kind();
// Handle OVERFLOW event
if (kind == OVERFLOW) {
logger.warn("File system events may have been lost for directory: {}", directory);
continue;
}
@SuppressWarnings("unchecked")
WatchEvent<Path> pathEvent = (WatchEvent<Path>) event;
Path relativePath = pathEvent.context();
Path absolutePath = directory.resolve(relativePath);
// Check if file should be monitored
if (!config.shouldMonitorFile(absolutePath.toString())) {
continue;
}
// Process the file event
processFileEvent(kind, absolutePath);
}
}
private void processFileEvent(WatchEvent.Kind<?> kind, Path filePath) {
try {
FileEvent fileEvent = createFileEvent(kind, filePath);
if (fileEvent != null) {
notifyListeners(fileEvent);
}
} catch (Exception e) {
logger.error("Error processing file event for: {}", filePath, e);
}
}
private FileEvent createFileEvent(WatchEvent.Kind<?> kind, Path filePath) {
FileEvent.EventType eventType = mapEventType(kind);
if (eventType == null) return null;
FileEvent event = new FileEvent(eventType, filePath.toString());
try {
// Collect file metadata
FileMetadata metadata = collectFileMetadata(filePath);
event.setFileSize(metadata.getSize());
event.setUser(metadata.getOwner());
// Calculate hash for content changes
if (config.isMonitorContentChanges() &&
(eventType == FileEvent.EventType.CREATED ||
eventType == FileEvent.EventType.MODIFIED)) {
String hash = hashCalculator.calculateHash(filePath.toFile());
event.setNewHash(hash);
}
// Determine change type
event.setChangeType(determineChangeType(eventType, filePath));
// Analyze event for suspicious activity
analyzeEvent(event);
} catch (Exception e) {
logger.debug("Could not collect complete metadata for: {}", filePath, e);
}
return event;
}
private FileEvent.EventType mapEventType(WatchEvent.Kind<?> kind) {
if (kind == ENTRY_CREATE) return FileEvent.EventType.CREATED;
if (kind == ENTRY_DELETE) return FileEvent.EventType.DELETED;
if (kind == ENTRY_MODIFY) return FileEvent.EventType.MODIFIED;
return null;
}
private FileEvent.ChangeType determineChangeType(FileEvent.EventType eventType, Path filePath) {
if (eventType == FileEvent.EventType.CREATED ||
eventType == FileEvent.EventType.DELETED) {
return FileEvent.ChangeType.ALL;
}
// For modifications, we'd need to compare with previous state
// This is a simplified implementation
return FileEvent.ChangeType.CONTENT;
}
private FileMetadata collectFileMetadata(Path filePath) throws IOException {
try {
BasicFileAttributes attrs = Files.readAttributes(filePath, BasicFileAttributes.class);
FileMetadata metadata = FileMetadata.fromBasicAttributes(filePath.toString(), attrs);
// Try to get POSIX attributes if available
try {
PosixFileAttributes posixAttrs = Files.readAttributes(filePath, PosixFileAttributes.class);
metadata.setOwner(posixAttrs.owner().getName());
metadata.setGroup(posixAttrs.group().getName());
metadata.setPermissions(posixAttrs.permissions().toString());
} catch (UnsupportedOperationException e) {
// POSIX attributes not supported on this system
logger.debug("POSIX attributes not supported for: {}", filePath);
}
return metadata;
} catch (IOException e) {
logger.debug("Could not read file attributes for: {}", filePath, e);
throw e;
}
}
private void analyzeEvent(FileEvent event) {
int severity = calculateEventSeverity(event);
event.setSeverity(severity);
event.setSuspicious(severity >= config.getAlertThreshold());
// Additional suspicious activity detection
if (isSuspiciousFile(event.getFilePath())) {
event.setSuspicious(true);
event.setSeverity(Math.max(event.getSeverity(), 8));
}
}
private int calculateEventSeverity(FileEvent event) {
int baseSeverity = 1;
// Increase severity based on event type
switch (event.getEventType()) {
case DELETED:
baseSeverity = 6;
break;
case MODIFIED:
baseSeverity = 4;
break;
case CREATED:
baseSeverity = 3;
break;
default:
baseSeverity = 2;
}
// Increase severity for system files
if (isSystemFile(event.getFilePath())) {
baseSeverity += 2;
}
// Increase severity for executable files
if (isExecutableFile(event.getFilePath())) {
baseSeverity += 2;
}
// Increase severity for configuration files
if (isConfigurationFile(event.getFilePath())) {
baseSeverity += 1;
}
return Math.min(baseSeverity, 10);
}
private boolean isSuspiciousFile(String filePath) {
String lowerPath = filePath.toLowerCase();
return lowerPath.contains("/etc/passwd") ||
lowerPath.contains("/etc/shadow") ||
lowerPath.contains("/bin/") ||
lowerPath.contains("/sbin/") ||
lowerPath.endsWith(".ssh/authorized_keys") ||
lowerPath.endsWith(".bashrc") ||
lowerPath.endsWith(".profile");
}
private boolean isSystemFile(String filePath) {
return filePath.startsWith("/etc/") ||
filePath.startsWith("/bin/") ||
filePath.startsWith("/sbin/") ||
filePath.startsWith("/usr/bin/") ||
filePath.startsWith("/usr/sbin/");
}
private boolean isExecutableFile(String filePath) {
return filePath.endsWith(".exe") ||
filePath.endsWith(".bin") ||
filePath.endsWith(".sh") ||
filePath.endsWith(".bat") ||
!filePath.contains("."); // No extension often indicates executable
}
private boolean isConfigurationFile(String filePath) {
return filePath.endsWith(".conf") ||
filePath.endsWith(".config") ||
filePath.endsWith(".properties") ||
filePath.endsWith(".yml") ||
filePath.endsWith(".yaml") ||
filePath.endsWith(".xml") ||
filePath.endsWith(".json");
}
// Listener management
public void addListener(FileEventListener listener) {
listeners.add(listener);
}
public void removeListener(FileEventListener listener) {
listeners.remove(listener);
}
private void notifyListeners(FileEvent event) {
for (FileEventListener listener : listeners) {
try {
listener.onFileEvent(event);
} catch (Exception e) {
logger.error("Error notifying listener", e);
}
}
}
public interface FileEventListener {
void onFileEvent(FileEvent event);
}
}
3. File Integrity Monitor
// FileIntegrityMonitor.java
package com.example.fim.core;
import com.example.fim.model.*;
import com.example.fim.alert.AlertManager;
import com.example.fim.storage.BaselineStorage;
import com.example.fim.storage.EventStorage;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.io.IOException;
import java.time.Instant;
import java.util.*;
import java.util.concurrent.*;
public class FileIntegrityMonitor implements FileWatcherService.FileEventListener {
private static final Logger logger = LoggerFactory.getLogger(FileIntegrityMonitor.class);
private final MonitorConfig config;
private final FileWatcherService fileWatcher;
private final HashCalculator hashCalculator;
private final BaselineStorage baselineStorage;
private final EventStorage eventStorage;
private final AlertManager alertManager;
private final ScheduledExecutorService scheduler;
private final Map<String, FileMetadata> currentBaseline;
public FileIntegrityMonitor(MonitorConfig config) throws IOException {
this.config = config;
this.fileWatcher = new FileWatcherService(config);
this.hashCalculator = new HashCalculator(config.getHashAlgorithm());
this.baselineStorage = new BaselineStorage();
this.eventStorage = new EventStorage();
this.alertManager = new AlertManager(config);
this.scheduler = Executors.newScheduledThreadPool(2);
this.currentBaseline = new ConcurrentHashMap<>();
// Register as listener for file events
fileWatcher.addListener(this);
}
public void start() {
logger.info("Starting File Integrity Monitor");
// Establish initial baseline
if (config.isBaselineValidation()) {
establishBaseline();
}
// Start real-time monitoring
if (config.isRealTimeMonitoring()) {
fileWatcher.start();
}
// Schedule periodic baseline validation
if (config.isBaselineValidation()) {
scheduler.scheduleAtFixedRate(
this::validateBaseline,
config.getBaselineInterval(),
config.getBaselineInterval(),
TimeUnit.MILLISECONDS
);
}
// Schedule periodic cleanup
scheduler.scheduleAtFixedRate(
this::cleanupOldEvents,
24, 24, TimeUnit.HOURS
);
logger.info("File Integrity Monitor started successfully");
}
public void stop() {
logger.info("Stopping File Integrity Monitor");
fileWatcher.stop();
scheduler.shutdown();
try {
if (!scheduler.awaitTermination(10, TimeUnit.SECONDS)) {
scheduler.shutdownNow();
}
} catch (InterruptedException e) {
scheduler.shutdownNow();
Thread.currentThread().interrupt();
}
logger.info("File Integrity Monitor stopped");
}
private void establishBaseline() {
logger.info("Establishing file integrity baseline");
int filesProcessed = 0;
int errors = 0;
for (String directoryPath : config.getMonitoredDirectories()) {
try {
filesProcessed += scanDirectoryForBaseline(directoryPath);
} catch (Exception e) {
logger.error("Error establishing baseline for directory: {}", directoryPath, e);
errors++;
}
}
// Save baseline to persistent storage
baselineStorage.saveBaseline(currentBaseline);
logger.info("Baseline established: {} files processed, {} errors",
filesProcessed, errors);
}
private int scanDirectoryForBaseline(String directoryPath) throws IOException {
return scanDirectoryForBaseline(
java.nio.file.Paths.get(directoryPath),
config.getMaxDepth()
);
}
private int scanDirectoryForBaseline(java.nio.file.Path directory, int maxDepth)
throws IOException {
if (maxDepth < 0) return 0;
if (config.isDirectoryExcluded(directory.toString())) return 0;
int filesProcessed = 0;
try (var stream = java.nio.file.Files.list(directory)) {
for (java.nio.file.Path path : stream.collect(java.util.stream.Collectors.toList())) {
if (java.nio.file.Files.isDirectory(path)) {
// Recursively scan subdirectories
filesProcessed += scanDirectoryForBaseline(path, maxDepth - 1);
} else if (java.nio.file.Files.isRegularFile(path)) {
// Process file
if (config.shouldMonitorFile(path.toString())) {
try {
FileMetadata metadata = createFileMetadata(path);
currentBaseline.put(path.toString(), metadata);
filesProcessed++;
} catch (Exception e) {
logger.warn("Could not process file for baseline: {}", path, e);
}
}
}
}
}
return filesProcessed;
}
private FileMetadata createFileMetadata(java.nio.file.Path filePath) throws IOException {
FileMetadata metadata = FileMetadata.fromBasicAttributes(
filePath.toString(),
java.nio.file.Files.readAttributes(filePath, java.nio.file.attribute.BasicFileAttributes.class)
);
// Calculate file hash
String hash = hashCalculator.calculateHash(filePath.toFile());
metadata.setHash(hash);
metadata.setHashAlgorithm(config.getHashAlgorithm());
// Add POSIX attributes if available
try {
java.nio.file.attribute.PosixFileAttributes posixAttrs =
java.nio.file.Files.readAttributes(filePath, java.nio.file.attribute.PosixFileAttributes.class);
metadata.setOwner(posixAttrs.owner().getName());
metadata.setGroup(posixAttrs.group().getName());
metadata.setPermissions(posixAttrs.permissions().toString());
} catch (UnsupportedOperationException e) {
// POSIX not supported, skip
}
return metadata;
}
private void validateBaseline() {
logger.info("Starting periodic baseline validation");
int changesDetected = 0;
List<FileEvent> validationEvents = new ArrayList<>();
for (Map.Entry<String, FileMetadata> entry : currentBaseline.entrySet()) {
String filePath = entry.getKey();
FileMetadata baselineMetadata = entry.getValue();
try {
java.nio.file.Path path = java.nio.file.Paths.get(filePath);
if (!java.nio.file.Files.exists(path)) {
// File was deleted
FileEvent event = new FileEvent(FileEvent.EventType.DELETED, filePath);
event.setOldHash(baselineMetadata.getHash());
event.setSuspicious(true);
event.setSeverity(8);
validationEvents.add(event);
changesDetected++;
continue;
}
// Check if file content changed
FileMetadata currentMetadata = createFileMetadata(path);
if (!baselineMetadata.getHash().equals(currentMetadata.getHash())) {
FileEvent event = new FileEvent(FileEvent.EventType.MODIFIED, filePath);
event.setOldHash(baselineMetadata.getHash());
event.setNewHash(currentMetadata.getHash());
event.setChangeType(FileEvent.ChangeType.CONTENT);
analyzeEvent(event);
validationEvents.add(event);
changesDetected++;
// Update baseline
currentBaseline.put(filePath, currentMetadata);
}
// Check permission changes
if (config.isMonitorPermissionChanges() &&
!Objects.equals(baselineMetadata.getPermissions(), currentMetadata.getPermissions())) {
FileEvent event = new FileEvent(FileEvent.EventType.MODIFIED, filePath);
event.setChangeType(FileEvent.ChangeType.PERMISSIONS);
analyzeEvent(event);
validationEvents.add(event);
changesDetected++;
}
} catch (Exception e) {
logger.warn("Error validating file: {}", filePath, e);
}
}
// Process validation events
for (FileEvent event : validationEvents) {
processFileEvent(event);
}
// Save updated baseline
baselineStorage.saveBaseline(currentBaseline);
logger.info("Baseline validation completed: {} changes detected", changesDetected);
}
@Override
public void onFileEvent(FileEvent event) {
processFileEvent(event);
}
private void processFileEvent(FileEvent event) {
try {
// Store event
eventStorage.storeEvent(event);
// Check against baseline for real-time events
if (config.isBaselineValidation()) {
checkAgainstBaseline(event);
}
// Send alert if suspicious
if (event.isSuspicious()) {
alertManager.sendAlert(event);
}
// Log the event
if (event.getSeverity() >= 5) {
logger.warn("File integrity event: {}", event);
} else {
logger.info("File integrity event: {}", event);
}
} catch (Exception e) {
logger.error("Error processing file event: {}", event, e);
}
}
private void checkAgainstBaseline(FileEvent event) {
String filePath = event.getFilePath();
FileMetadata baselineMetadata = currentBaseline.get(filePath);
if (baselineMetadata == null) {
// New file not in baseline
if (event.getEventType() == FileEvent.EventType.CREATED) {
try {
FileMetadata newMetadata = createFileMetadata(java.nio.file.Paths.get(filePath));
currentBaseline.put(filePath, newMetadata);
baselineStorage.saveBaseline(currentBaseline);
} catch (Exception e) {
logger.warn("Could not add new file to baseline: {}", filePath, e);
}
}
return;
}
// For modifications, verify hash if available
if (event.getEventType() == FileEvent.EventType.MODIFIED &&
event.getNewHash() != null &&
config.isMonitorContentChanges()) {
if (!baselineMetadata.getHash().equals(event.getNewHash())) {
event.setSuspicious(true);
event.setSeverity(Math.max(event.getSeverity(), 7));
}
}
// For deletions, mark as suspicious if file was in baseline
if (event.getEventType() == FileEvent.EventType.DELETED) {
event.setSuspicious(true);
event.setSeverity(Math.max(event.getSeverity(), 8));
currentBaseline.remove(filePath);
baselineStorage.saveBaseline(currentBaseline);
}
}
private void analyzeEvent(FileEvent event) {
// Already implemented in FileWatcherService, but we can add additional analysis here
if (isAfterHours(event.getTimestamp())) {
event.setSuspicious(true);
event.setSeverity(Math.max(event.getSeverity(), 6));
}
}
private boolean isAfterHours(Instant timestamp) {
Calendar cal = Calendar.getInstance();
cal.setTimeInMillis(timestamp.toEpochMilli());
int hour = cal.get(Calendar.HOUR_OF_DAY);
return hour < 6 || hour > 18; // Outside 6 AM - 6 PM
}
private void cleanupOldEvents() {
try {
Instant cutoff = Instant.now().minus(java.time.Duration.ofDays(30));
eventStorage.cleanupOldEvents(cutoff);
logger.info("Cleaned up events older than 30 days");
} catch (Exception e) {
logger.error("Error cleaning up old events", e);
}
}
// Public API methods
public void addMonitoredDirectory(String directory) throws IOException {
config.getMonitoredDirectories().add(directory);
if (running) {
// Re-register directories
fileWatcher.stop();
fileWatcher.start();
}
}
public List<FileEvent> getRecentEvents(int limit) {
return eventStorage.getRecentEvents(limit);
}
public List<FileEvent> getSuspiciousEvents(Instant from, Instant to) {
return eventStorage.getEventsBySeverity(from, to, config.getAlertThreshold());
}
public boolean verifyFileIntegrity(String filePath) throws IOException {
FileMetadata baseline = currentBaseline.get(filePath);
if (baseline == null) {
throw new IOException("File not in baseline: " + filePath);
}
java.nio.file.Path path = java.nio.file.Paths.get(filePath);
if (!java.nio.file.Files.exists(path)) {
return false;
}
String currentHash = hashCalculator.calculateHash(path.toFile());
return baseline.getHash().equals(currentHash);
}
public Map<String, Object> getStatistics() {
Map<String, Object> stats = new HashMap<>();
stats.put("monitoredDirectories", config.getMonitoredDirectories().size());
stats.put("baselineFiles", currentBaseline.size());
stats.put("totalEvents", eventStorage.getTotalEventCount());
stats.put("suspiciousEvents", eventStorage.getSuspiciousEventCount());
stats.put("lastValidation", Instant.now());
return stats;
}
private boolean running = false;
public boolean isRunning() {
return running;
}
}
Storage Implementations
1. Baseline Storage
// BaselineStorage.java
package com.example.fim.storage;
import com.example.fim.model.FileMetadata;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.io.*;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;
public class BaselineStorage {
private static final Logger logger = LoggerFactory.getLogger(BaselineStorage.class);
private final String storagePath;
private final ObjectMapper objectMapper;
public BaselineStorage() {
this("~/.fim/baseline.json");
}
public BaselineStorage(String storagePath) {
this.storagePath = storagePath.replaceFirst("^~", System.getProperty("user.home"));
this.objectMapper = new ObjectMapper();
ensureStorageDirectory();
}
public void saveBaseline(Map<String, FileMetadata> baseline) {
try {
String json = objectMapper.writerWithDefaultPrettyPrinter()
.writeValueAsString(baseline);
Files.writeString(Paths.get(storagePath), json);
logger.debug("Baseline saved with {} entries", baseline.size());
} catch (IOException e) {
logger.error("Failed to save baseline", e);
}
}
public Map<String, FileMetadata> loadBaseline() {
try {
Path path = Paths.get(storagePath);
if (!Files.exists(path)) {
logger.info("No existing baseline found");
return new ConcurrentHashMap<>();
}
String json = Files.readString(path);
Map<String, FileMetadata> baseline = objectMapper.readValue(json,
objectMapper.getTypeFactory().constructMapType(ConcurrentHashMap.class,
String.class, FileMetadata.class));
logger.info("Baseline loaded with {} entries", baseline.size());
return baseline;
} catch (IOException e) {
logger.error("Failed to load baseline", e);
return new ConcurrentHashMap<>();
}
}
public void clearBaseline() {
try {
Files.deleteIfExists(Paths.get(storagePath));
logger.info("Baseline cleared");
} catch (IOException e) {
logger.error("Failed to clear baseline", e);
}
}
private void ensureStorageDirectory() {
try {
Path directory = Paths.get(storagePath).getParent();
if (directory != null) {
Files.createDirectories(directory);
}
} catch (IOException e) {
logger.error("Failed to create storage directory", e);
}
}
}
2. Event Storage
// EventStorage.java
package com.example.fim.storage;
import com.example.fim.model.FileEvent;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.io.*;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.time.Instant;
import java.util.*;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.CopyOnWriteArrayList;
import java.util.stream.Collectors;
public class EventStorage {
private static final Logger logger = LoggerFactory.getLogger(EventStorage.class);
private final String storageDirectory;
private final ObjectMapper objectMapper;
private final List<FileEvent> inMemoryEvents;
private final int maxInMemoryEvents;
public EventStorage() {
this("~/.fim/events");
}
public EventStorage(String storageDirectory) {
this.storageDirectory = storageDirectory.replaceFirst("^~", System.getProperty("user.home"));
this.objectMapper = new ObjectMapper();
this.inMemoryEvents = new CopyOnWriteArrayList<>();
this.maxInMemoryEvents = 10000;
ensureStorageDirectory();
}
public void storeEvent(FileEvent event) {
// Store in memory
synchronized (inMemoryEvents) {
inMemoryEvents.add(event);
// Persist to disk if we have too many in memory
if (inMemoryEvents.size() >= maxInMemoryEvents) {
persistEventsToDisk();
}
}
// For high-severity events, persist immediately
if (event.getSeverity() >= 7) {
persistEventToDisk(event);
}
}
public List<FileEvent> getRecentEvents(int limit) {
List<FileEvent> recentEvents = new ArrayList<>();
synchronized (inMemoryEvents) {
int startIndex = Math.max(0, inMemoryEvents.size() - limit);
for (int i = startIndex; i < inMemoryEvents.size(); i++) {
recentEvents.add(inMemoryEvents.get(i));
}
}
// Sort by timestamp descending
recentEvents.sort((e1, e2) -> e2.getTimestamp().compareTo(e1.getTimestamp()));
return recentEvents.stream()
.limit(limit)
.collect(Collectors.toList());
}
public List<FileEvent> getEventsBySeverity(Instant from, Instant to, int minSeverity) {
return inMemoryEvents.stream()
.filter(event -> event.getTimestamp().isAfter(from) &&
event.getTimestamp().isBefore(to) &&
event.getSeverity() >= minSeverity)
.sorted((e1, e2) -> e2.getTimestamp().compareTo(e1.getTimestamp()))
.collect(Collectors.toList());
}
public List<FileEvent> getEventsByFile(String filePath, Instant from, Instant to) {
return inMemoryEvents.stream()
.filter(event -> event.getFilePath().equals(filePath) &&
event.getTimestamp().isAfter(from) &&
event.getTimestamp().isBefore(to))
.sorted((e1, e2) -> e2.getTimestamp().compareTo(e1.getTimestamp()))
.collect(Collectors.toList());
}
public int getTotalEventCount() {
return inMemoryEvents.size();
}
public int getSuspiciousEventCount() {
return (int) inMemoryEvents.stream()
.filter(FileEvent::isSuspicious)
.count();
}
public void cleanupOldEvents(Instant cutoff) {
synchronized (inMemoryEvents) {
inMemoryEvents.removeIf(event -> event.getTimestamp().isBefore(cutoff));
}
// Also clean up old disk files
cleanupOldDiskEvents(cutoff);
}
private void persistEventsToDisk() {
synchronized (inMemoryEvents) {
if (inMemoryEvents.isEmpty()) return;
String timestamp = Instant.now().toString().replace(":", "-");
String filename = "events-" + timestamp + ".json";
Path filePath = Paths.get(storageDirectory, filename);
try {
String json = objectMapper.writerWithDefaultPrettyPrinter()
.writeValueAsString(inMemoryEvents);
Files.writeString(filePath, json);
logger.debug("Persisted {} events to disk", inMemoryEvents.size());
// Clear in-memory events after persisting
inMemoryEvents.clear();
} catch (IOException e) {
logger.error("Failed to persist events to disk", e);
}
}
}
private void persistEventToDisk(FileEvent event) {
String timestamp = event.getTimestamp().toString().replace(":", "-");
String filename = "event-" + timestamp + "-" + event.getEventId() + ".json";
Path filePath = Paths.get(storageDirectory, filename);
try {
String json = objectMapper.writerWithDefaultPrettyPrinter()
.writeValueAsString(event);
Files.writeString(filePath, json);
} catch (IOException e) {
logger.error("Failed to persist event to disk: {}", event.getEventId(), e);
}
}
private void cleanupOldDiskEvents(Instant cutoff) {
try {
Files.list(Paths.get(storageDirectory))
.filter(path -> path.toString().endsWith(".json"))
.filter(path -> {
try {
String filename = path.getFileName().toString();
// Extract timestamp from filename
if (filename.startsWith("events-")) {
String timestampStr = filename.substring(7, filename.length() - 5)
.replace("-", ":");
Instant fileTime = Instant.parse(timestampStr);
return fileTime.isBefore(cutoff);
}
} catch (Exception e) {
logger.debug("Could not parse timestamp from filename: {}", path);
}
return false;
})
.forEach(path -> {
try {
Files.delete(path);
logger.debug("Deleted old event file: {}", path);
} catch (IOException e) {
logger.warn("Could not delete old event file: {}", path, e);
}
});
} catch (IOException e) {
logger.error("Error cleaning up old disk events", e);
}
}
private void ensureStorageDirectory() {
try {
Files.createDirectories(Paths.get(storageDirectory));
} catch (IOException e) {
logger.error("Failed to create event storage directory", e);
}
}
}
Alerting System
1. Alert Manager
// AlertManager.java
package com.example.fim.alert;
import com.example.fim.model.FileEvent;
import com.example.fim.model.MonitorConfig;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.util.*;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.Executors;
import java.util.concurrent.ScheduledExecutorService;
import java.util.concurrent.TimeUnit;
public class AlertManager {
private static final Logger logger = LoggerFactory.getLogger(AlertManager.class);
private final MonitorConfig config;
private final List<NotificationService> notificationServices;
private final Map<String, Long> recentAlerts;
private final ScheduledExecutorService alertScheduler;
private final int alertCooldownMinutes;
public AlertManager(MonitorConfig config) {
this.config = config;
this.notificationServices = new ArrayList<>();
this.recentAlerts = new ConcurrentHashMap<>();
this.alertScheduler = Executors.newSingleThreadScheduledExecutor();
this.alertCooldownMinutes = 5;
// Initialize notification services
initializeNotificationServices();
// Schedule alert cleanup
alertScheduler.scheduleAtFixedRate(
this::cleanupOldAlerts,
1, 1, TimeUnit.HOURS
);
}
public void sendAlert(FileEvent event) {
// Check if we recently alerted for this file
String alertKey = generateAlertKey(event);
if (isInCooldown(alertKey)) {
logger.debug("Alert for {} is in cooldown, skipping", alertKey);
return;
}
// Create alert
Alert alert = createAlertFromEvent(event);
// Send through all notification services
for (NotificationService service : notificationServices) {
try {
service.sendAlert(alert);
} catch (Exception e) {
logger.error("Failed to send alert via {}: {}",
service.getClass().getSimpleName(), e.getMessage());
}
}
// Record alert time for cooldown
recentAlerts.put(alertKey, System.currentTimeMillis());
logger.warn("Alert sent: {}", alert.getSummary());
}
private Alert createAlertFromEvent(FileEvent event) {
Alert alert = new Alert();
alert.setId(event.getEventId());
alert.setTimestamp(event.getTimestamp());
alert.setSeverity(event.getSeverity());
alert.setSource("FileIntegrityMonitor");
// Set alert message based on event type
String message = String.format(
"File integrity %s detected: %s\n" +
"Change Type: %s\n" +
"Severity: %d\n" +
"User: %s\n" +
"File Size: %d bytes",
event.getEventType().toString().toLowerCase(),
event.getFilePath(),
event.getChangeType(),
event.getSeverity(),
event.getUser() != null ? event.getUser() : "Unknown",
event.getFileSize()
);
alert.setMessage(message);
alert.setSummary(String.format("File %s: %s",
event.getEventType().toString().toLowerCase(),
event.getFileName()));
// Add additional context
Map<String, Object> context = new HashMap<>();
context.put("filePath", event.getFilePath());
context.put("eventType", event.getEventType());
context.put("changeType", event.getChangeType());
context.put("suspicious", event.isSuspicious());
if (event.getOldHash() != null) {
context.put("oldHash", event.getOldHash());
}
if (event.getNewHash() != null) {
context.put("newHash", event.getNewHash());
}
alert.setContext(context);
return alert;
}
private String generateAlertKey(FileEvent event) {
// Generate a key that groups similar alerts
return event.getFilePath() + ":" + event.getEventType();
}
private boolean isInCooldown(String alertKey) {
Long lastAlertTime = recentAlerts.get(alertKey);
if (lastAlertTime == null) {
return false;
}
long cooldownMillis = alertCooldownMinutes * 60 * 1000;
return (System.currentTimeMillis() - lastAlertTime) < cooldownMillis;
}
private void cleanupOldAlerts() {
long cutoff = System.currentTimeMillis() - (alertCooldownMinutes * 60 * 1000);
recentAlerts.entrySet().removeIf(entry -> entry.getValue() < cutoff);
}
private void initializeNotificationServices() {
// Add console notification
notificationServices.add(new ConsoleNotificationService());
// Add log file notification
notificationServices.add(new LogFileNotificationService());
// In a real implementation, you might add:
// - EmailNotificationService
// - SlackNotificationService
// - SNMPNotificationService
// - WebhookNotificationService
}
public void addNotificationService(NotificationService service) {
notificationServices.add(service);
}
public void shutdown() {
alertScheduler.shutdown();
try {
if (!alertScheduler.awaitTermination(5, TimeUnit.SECONDS)) {
alertScheduler.shutdownNow();
}
} catch (InterruptedException e) {
alertScheduler.shutdownNow();
Thread.currentThread().interrupt();
}
}
public static class Alert {
private String id;
private Instant timestamp;
private int severity;
private String source;
private String summary;
private String message;
private Map<String, Object> context;
// Getters and setters
public String getId() { return id; }
public void setId(String id) { this.id = id; }
public Instant getTimestamp() { return timestamp; }
public void setTimestamp(Instant timestamp) { this.timestamp = timestamp; }
public int getSeverity() { return severity; }
public void setSeverity(int severity) { this.severity = severity; }
public String getSource() { return source; }
public void setSource(String source) { this.source = source; }
public String getSummary() { return summary; }
public void setSummary(String summary) { this.summary = summary; }
public String getMessage() { return message; }
public void setMessage(String message) { this.message = message; }
public Map<String, Object> getContext() { return context; }
public void setContext(Map<String, Object> context) { this.context = context; }
}
public interface NotificationService {
void sendAlert(Alert alert) throws Exception;
}
// Example notification services
public static class ConsoleNotificationService implements NotificationService {
@Override
public void sendAlert(Alert alert) {
System.err.printf("[ALERT] %s - %s\n", alert.getSummary(), alert.getMessage());
}
}
public static class LogFileNotificationService implements NotificationService {
private static final Logger alertLogger = LoggerFactory.getLogger("FILE_INTEGRITY_ALERTS");
@Override
public void sendAlert(Alert alert) {
alertLogger.warn("ALERT - {}: {}", alert.getSummary(), alert.getMessage());
}
}
}
Usage Examples
1. Basic FIM Setup
// FIMDemo.java
package com.example.fim.demo;
import com.example.fim.core.FileIntegrityMonitor;
import com.example.fim.model.MonitorConfig;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
public class FIMDemo {
private static final Logger logger = LoggerFactory.getLogger(FIMDemo.class);
public static void main(String[] args) {
try {
// Configure FIM
MonitorConfig config = new MonitorConfig.Builder()
.addMonitoredDirectory("/etc")
.addMonitoredDirectory("/bin")
.addMonitoredDirectory("/usr/bin")
.addExcludedDirectory("/etc/ssl/certs") // Too many changes
.addIncludedPattern(".*\\.conf$")
.addExcludedPattern(".*\\.log$")
.recursive(true)
.pollInterval(3000)
.hashAlgorithm("SHA-256")
.alertThreshold(5)
.build();
// Create and start monitor
FileIntegrityMonitor fim = new FileIntegrityMonitor(config);
fim.start();
// Add shutdown hook for graceful shutdown
Runtime.getRuntime().addShutdownHook(new Thread(() -> {
logger.info("Shutting down File Integrity Monitor...");
fim.stop();
}));
// Keep the application running
Thread.sleep(Long.MAX_VALUE);
} catch (Exception e) {
logger.error("FIM demo failed", e);
System.exit(1);
}
}
}
2. Spring Boot Integration
// FIMConfiguration.java
package com.example.fim.config;
import com.example.fim.core.FileIntegrityMonitor;
import com.example.fim.model.MonitorConfig;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import java.util.Arrays;
@Configuration
public class FIMConfiguration {
@Value("${fim.monitored.directories:/etc,/bin,/usr/bin}")
private String[] monitoredDirectories;
@Value("${fim.excluded.directories:/etc/ssl/certs,/tmp}")
private String[] excludedDirectories;
@Value("${fim.alert.threshold:5}")
private int alertThreshold;
@Value("${fim.poll.interval:5000}")
private long pollInterval;
@Bean
public MonitorConfig monitorConfig() {
MonitorConfig.Builder builder = new MonitorConfig.Builder();
// Add monitored directories
Arrays.stream(monitoredDirectories)
.forEach(builder::addMonitoredDirectory);
// Add excluded directories
Arrays.stream(excludedDirectories)
.forEach(builder::addExcludedDirectory);
// Configure other settings
builder.alertThreshold(alertThreshold)
.pollInterval(pollInterval)
.recursive(true)
.hashAlgorithm("SHA-256");
return builder.build();
}
@Bean(initMethod = "start", destroyMethod = "stop")
public FileIntegrityMonitor fileIntegrityMonitor(MonitorConfig config) {
try {
return new FileIntegrityMonitor(config);
} catch (Exception e) {
throw new RuntimeException("Failed to create File Integrity Monitor", e);
}
}
}
// FIMController.java
package com.example.fim.controller;
import com.example.fim.core.FileIntegrityMonitor;
import com.example.fim.model.FileEvent;
import org.springframework.web.bind.annotation.*;
import java.util.List;
import java.util.Map;
@RestController
@RequestMapping("/api/fim")
public class FIMController {
private final FileIntegrityMonitor fim;
public FIMController(FileIntegrityMonitor fim) {
this.fim = fim;
}
@GetMapping("/status")
public Map<String, Object> getStatus() {
return fim.getStatistics();
}
@GetMapping("/events/recent")
public List<FileEvent> getRecentEvents(@RequestParam(defaultValue = "50") int limit) {
return fim.getRecentEvents(limit);
}
@GetMapping("/events/suspicious")
public List<FileEvent> getSuspiciousEvents() {
return fim.getSuspiciousEvents(
java.time.Instant.now().minus(java.time.Duration.ofHours(24)),
java.time.Instant.now()
);
}
@PostMapping("/verify/{filePath:.*}")
public Map<String, Object> verifyFile(@PathVariable String filePath) {
try {
boolean integrityOk = fim.verifyFileIntegrity(filePath);
return Map.of(
"file", filePath,
"integrity", integrityOk ? "OK" : "COMPROMISED",
"timestamp", java.time.Instant.now()
);
} catch (Exception e) {
return Map.of(
"file", filePath,
"integrity", "ERROR",
"error", e.getMessage(),
"timestamp", java.time.Instant.now()
);
}
}
}
3. Application Properties
# application.properties
fim.monitored.directories=/etc,/bin,/usr/bin,/opt/app/config
fim.excluded.directories=/etc/ssl/certs,/tmp,/var/log
fim.alert.threshold=5
fim.poll.interval=5000
fim.baseline.validation=true
fim.baseline.interval=3600000
# Logging
logging.level.com.example.fim=INFO
logging.level.FILE_INTEGRITY_ALERTS=WARN
# Custom pattern for FIM alerts
logging.pattern.console=%d{yyyy-MM-dd HH:mm:ss} - %logger{36} - %msg%n
Best Practices
1. Performance Optimization
// OptimizedFIMService.java
package com.example.fim.optimized;
import java.util.concurrent.*;
import java.util.concurrent.atomic.AtomicLong;
public class OptimizedFIMService {
private final ExecutorService eventProcessor;
private final ScheduledExecutorService maintenanceScheduler;
private final AtomicLong eventsProcessed;
private final int maxQueueSize;
private final BlockingQueue<Runnable> eventQueue;
public OptimizedFIMService() {
this.maxQueueSize = 10000;
this.eventQueue = new LinkedBlockingQueue<>(maxQueueSize);
this.eventsProcessed = new AtomicLong(0);
// Create thread pool with custom rejection policy
this.eventProcessor = new ThreadPoolExecutor(
2, // core pool size
10, // max pool size
60L, TimeUnit.SECONDS,
eventQueue,
new ThreadPoolExecutor.CallerRunsPolicy() // Handle backpressure
);
this.maintenanceScheduler = Executors.newScheduledThreadPool(1);
}
public void submitEventProcessing(Runnable task) {
eventProcessor.submit(() -> {
try {
task.run();
eventsProcessed.incrementAndGet();
} catch (Exception e) {
// Log error but don't propagate to avoid breaking the monitor
System.err.println("Error processing file event: " + e.getMessage());
}
});
}
public void scheduleMaintenance(Runnable task, long interval, TimeUnit unit) {
maintenanceScheduler.scheduleAtFixedRate(task, interval, interval, unit);
}
public Map<String, Object> getPerformanceStats() {
ThreadPoolExecutor executor = (ThreadPoolExecutor) eventProcessor;
return Map.of(
"eventsProcessed", eventsProcessed.get(),
"activeThreads", executor.getActiveCount(),
"queueSize", eventQueue.size(),
"completedTasks", executor.getCompletedTaskCount(),
"poolSize", executor.getPoolSize()
);
}
public void shutdown() {
eventProcessor.shutdown();
maintenanceScheduler.shutdown();
try {
if (!eventProcessor.awaitTermination(30, TimeUnit.SECONDS)) {
eventProcessor.shutdownNow();
}
if (!maintenanceScheduler.awaitTermination(10, TimeUnit.SECONDS)) {
maintenanceScheduler.shutdownNow();
}
} catch (InterruptedException e) {
eventProcessor.shutdownNow();
maintenanceScheduler.shutdownNow();
Thread.currentThread().interrupt();
}
}
}
2. Security Considerations
// SecureFIMService.java
package com.example.fim.secure;
import java.security.Permission;
import java.security.Policy;
import java.security.ProtectionDomain;
public class SecureFIMService {
public static void enableSecurityManager() {
// Set a security policy for FIM operations
Policy.setPolicy(new FIMSecurityPolicy());
System.setSecurityManager(new SecurityManager());
}
private static class FIMSecurityPolicy extends Policy {
@Override
public boolean implies(ProtectionDomain domain, Permission permission) {
// Allow necessary permissions for FIM operations
if (permission instanceof java.io.FilePermission) {
String actions = permission.getActions();
String name = permission.getName();
// Allow read access to monitored directories
if (actions.equals("read") &&
(name.startsWith("/etc/") ||
name.startsWith("/bin/") ||
name.startsWith("/usr/bin/"))) {
return true;
}
}
// Allow necessary runtime permissions
if (permission instanceof RuntimePermission) {
String name = permission.getName();
if (name.startsWith("accessClassInPackage.") ||
name.equals("modifyThread") ||
name.equals("stopThread")) {
return true;
}
}
return false;
}
}
}
Conclusion
File Integrity Monitoring in Java provides:
- Real-time file system monitoring using WatchService
- Cryptographic integrity verification through hashing
- Comprehensive change detection and classification
- Flexible alerting system with multiple notification channels
- Baseline management for integrity validation
- Performance optimization for high-volume environments
By implementing the patterns shown above, you can create a robust FIM system that detects unauthorized file changes, maintains file integrity, and provides comprehensive security monitoring for critical system and application files.