Detect Security Attacks from Network Logs
Problem statement
You are given network log records in the form "timestamp sourceIp destinationIp", where timestamps are integer seconds. The records may be unsorted.
A source IP is flagged when it contacts more than ten distinct destination IPs within any inclusive 600-second window. Return every flagged source IP exactly once in lexicographic order.
Only this disclosed detection rule is in scope.
Function
detectAttacks(logs: String[]) → String[]Examples
Example 1
logs = ["0 a d0","30 a d1","60 a d2","90 a d3","120 a d4","150 a d5","180 a d6","210 a d7","240 a d8","270 a d9","600 a d10"]return = ["a"]Source a reaches eleven distinct destinations from time 0 through 600, including both endpoints.
Example 2
logs = ["0 a x","10 a x","20 a y","700 a z"]return = []Repeated requests to the same destination count once per window, and no window contains eleven destinations.
Constraints
1 <= logs.length <= 200000- Each record contains a nonnegative timestamp and two nonempty whitespace-free IP strings.
- Timestamps fit signed 32-bit integers.