Struct PortScanDetector 

pub struct PortScanDetector<K>
where
    K: Hash + Eq + Clone,
{ /* private fields */ }

Per-source scanner-likelihood detector.

State is bounded: a source is normally dropped the moment its λ crosses either threshold, but a source that stays Inconclusive — one SYN from each of a million spoofed addresses, say — would otherwise persist forever. At max_sources the least-recently-touched entry is evicted. Evicting an Inconclusive source is harmless by the detector’s own semantics: it restarts at λ = 0, exactly as it would after a verdict.

Implementations

impl<K> PortScanDetector<K>

where K: Hash + Eq + Clone,

pub fn new() -> Self

Default-tuned: θ0=0.8, θ1=0.2, α=β=0.01.

pub fn with_params(theta0: f64, theta1: f64, alpha: f64, beta: f64) -> Self

Custom-tuned: caller supplies success priors + error rates. Asserts the parameters are in (0, 1) open intervals.

pub fn with_capacity(self, max_sources: usize) -> Self

Cap on concurrently tracked sources (default 10 000).

Only sources still awaiting a verdict occupy a slot — one that crosses either threshold is released immediately. Size this to the number of distinct hosts mid-evaluation you expect, not to your host count.

pub fn evicted(&self) -> u64

Sources dropped by the capacity bound rather than by a verdict. A climbing count means scan-like traffic from more distinct sources than the detector can hold — itself worth alerting on.

pub fn observe(&mut self, key: K, success: bool) -> ScanScore<K>

Record a connection outcome.

success = true for completed 3-way handshakes (or any other “connection succeeded” signal the consumer supplies); false for SYN-only / RST / timeout.

pub fn forget(&mut self, key: &K)

Drop per-key state without emitting a verdict.

pub fn tracked(&self) -> usize

Number of sources currently being tracked.

Trait Implementations

impl<K> Default for PortScanDetector<K>

where K: Hash + Eq + Clone,

fn default() -> Self

Returns the “default value” for a type.

impl<K: KeyFields + Send> Detector<K> for PortScanDetector<SrcHost>

Available on crate feature tracker only.

fn on_flow_end( &mut self, key: &K, stats: &FlowStats, history: &HistoryString, l4: Option<L4Proto>, ts: Timestamp, out: &mut Vec<OwnedAnomaly>, )

One TRW observation per finished flow, keyed by SrcHost. Success derives statelessly from the flow record (see the module-private flow_succeeded). Emits only on a Scanner verdict — TRW resets the key’s state at every terminal verdict, which is natural re-alert dedup. No-op for keys without a source IP.

fn kind(&self) -> DetectorKind

Typed identity — lands on every anomaly this detector emits and drives metric labels / ATT&CK tagging.

fn tracked(&self) -> usize

Keys currently tracked (0 for stateless detectors).

fn on_flow_start( &mut self, _key: &K, _ts: Timestamp, _out: &mut Vec<OwnedAnomaly>, )

New flow observed (FlowEvent::Started).

fn on_flow_established( &mut self, _key: &K, _ts: Timestamp, _out: &mut Vec<OwnedAnomaly>, )

TCP 3-way handshake completed (FlowEvent::Established).

fn on_flow_tick( &mut self, _key: &K, _stats: &FlowStats, _ts: Timestamp, _out: &mut Vec<OwnedAnomaly>, )

Periodic live-flow snapshot (FlowEvent::Tick — only fires when FlowTrackerConfig::flow_tick_interval is set). Note tick stats are cumulative; delta-track inside the detector if you need per-interval values.

fn on_dns_query( &mut self, _key: &K, _qname: &str, _ts: Timestamp, _out: &mut Vec<OwnedAnomaly>, )

DNS query name observed on flow key. Pre-extracted &str (e.g. from a DnsMessage::Query’s first question) — feed it via DetectorRegistry::observe_dns from your DNS slot drain, resolver log, or any other name source.

fn evict_expired(&mut self, _now: Timestamp)

Drop per-key state stale relative to now — bounds memory across key churn.