Struct SyscallAnomalyDetector 

pub struct SyscallAnomalyDetector { /* private fields */ }

Stateful syscall anomaly detector.

Tracks event rates, alert budgets, and cooldown windows.

Implementations

impl SyscallAnomalyDetector

pub fn new(config: SyscallAnomalyConfig) -> Self

pub fn analyze(&mut self, command_output: &str) -> AnomalyVerdict

Analyze shell command output for syscall anomalies.

pub fn syscall_counts(&self) -> &HashMap<String, u32>

Return the accumulated syscall counts.

pub fn reset(&mut self)

Reset all state.