Struct RitaBeaconDetector 

pub struct RitaBeaconDetector<K>
where
    K: Hash + Eq + Clone,
{ /* private fields */ }

Per-key RITA-style robust beacon detector.

Implementations

impl<K> RitaBeaconDetector<K>

where K: Hash + Eq + Clone,

pub fn new() -> Self

Default tuning: window=20, interval ∈ [10 s, 24 h], duration bonus saturates at 30 min — RITA’s standard thresholds, matching BeaconDetector.

pub fn with_window(self, window: usize) -> Self

pub fn with_interval_range(self, min: Duration, max: Duration) -> Self

pub fn with_anomaly_threshold(self, threshold: f64) -> Self

Composite-score floor for Self::observe_gated emission (default 0.7). Issue #131.

pub fn with_cooldown(self, cooldown: Duration) -> Self

Per-key re-emission cooldown for Self::observe_gated (default 300 s). Issue #131.

pub fn observe( &mut self, key: K, ts: Timestamp, bytes: u64, ) -> Option<RitaBeaconScore<K>>

Record one observation for key. Returns Some once the window holds ≥ 10 samples and the mean interval is in range.

pub fn forget(&mut self, key: &K)

Drop per-key state (call on flow end).

pub fn observe_gated( &mut self, key: K, ts: Timestamp, bytes: u64, ) -> Option<RitaBeaconScore<K>>

Self::observe plus the emission policy: Some only at or above the anomaly threshold with the per-key cooldown elapsed. The gate the Detector registry impl uses (issue #131).

pub fn evict_stale(&mut self, now: Timestamp, ttl: Duration)

Drop keys whose newest sample is older than ttl before now — bounds memory across key churn (issue #131).

pub fn tracked(&self) -> usize

Number of keys currently tracked.

Trait Implementations

impl<K> Default for RitaBeaconDetector<K>

where K: Hash + Eq + Clone,

fn default() -> Self

Returns the “default value” for a type.

impl<K: KeyFields + Send> Detector<K> for RitaBeaconDetector<HostPair>

Available on crate feature tracker only.

fn on_flow_end( &mut self, key: &K, stats: &FlowStats, _history: &HistoryString, _l4: Option<L4Proto>, ts: Timestamp, out: &mut Vec<OwnedAnomaly>, )

Same feed as the CV impl — see BeaconDetector’s on_flow_end docs.

fn kind(&self) -> DetectorKind

Typed identity — lands on every anomaly this detector emits and drives metric labels / ATT&CK tagging.

fn tracked(&self) -> usize

Keys currently tracked (0 for stateless detectors).

fn evict_expired(&mut self, now: Timestamp)

Drop per-key state stale relative to now — bounds memory across key churn.

fn on_flow_start( &mut self, _key: &K, _ts: Timestamp, _out: &mut Vec<OwnedAnomaly>, )

New flow observed (FlowEvent::Started).

fn on_flow_established( &mut self, _key: &K, _ts: Timestamp, _out: &mut Vec<OwnedAnomaly>, )

TCP 3-way handshake completed (FlowEvent::Established).

fn on_flow_tick( &mut self, _key: &K, _stats: &FlowStats, _ts: Timestamp, _out: &mut Vec<OwnedAnomaly>, )

Periodic live-flow snapshot (FlowEvent::Tick — only fires when FlowTrackerConfig::flow_tick_interval is set). Note tick stats are cumulative; delta-track inside the detector if you need per-interval values.

fn on_dns_query( &mut self, _key: &K, _qname: &str, _ts: Timestamp, _out: &mut Vec<OwnedAnomaly>, )

DNS query name observed on flow key. Pre-extracted &str (e.g. from a DnsMessage::Query’s first question) — feed it via DetectorRegistry::observe_dns from your DNS slot drain, resolver log, or any other name source.