Struct BehaviorTracker 

pub struct BehaviorTracker { /* private fields */ }

The reference BehaviorTracker’s in-memory return-pattern windows.

The redis-free fallback: pattern_key -> client_ip -> timestamps, with the same sliding-window arithmetic (len(timestamps) > threshold).

Implementations

impl BehaviorTracker

pub fn new() -> Self

A fresh tracker, the harness BehaviorTracker(config) with clean windows.

pub fn reset(&mut self)

Forget every window (the per-case reset the harness performs).

pub fn track_endpoint_usage( &mut self, endpoint_id: &str, client_ip: &str, rule: &BehaviorRule, now: f64, ) -> bool

track_endpoint_usage: record one request observation for (endpoint_id, client_ip) inside the rule’s window, and answer whether the rule tripped (len(timestamps) > threshold, the reference’s strict comparison). now is the caller’s clock (the reference time.time() float; unix_now converts).

pub fn get_recent_event_count( &self, ip: &str, window_seconds: u64, now: f64, ) -> usize

get_recent_event_count: how many tracked events any endpoint recorded for ip inside window_seconds (the reference walks every endpoint bucket’s timestamps for the identity).

pub fn track_return_pattern( &mut self, endpoint_id: &str, client_ip: &str, status: u16, body_prefix: Option<&[u8]>, rule: &BehaviorRule, max_inspect_bytes: usize, now: SystemTime, ) -> bool

track_return_pattern: record one response observation for (endpoint_id, client_ip) when the response matches the rule’s pattern, and answer whether the rule tripped (len(timestamps) > threshold inside the rule’s window).

status and body_prefix are the response facts: body_prefix is the caller’s capture bounded by the inspect-bytes budget and only read when the pattern needs the body and the caller has behavior_scan_response_body enabled. now is the caller’s clock (the reference time.time() float); SystemTime converts via unix_now.

pub fn check_response_pattern( &mut self, status: u16, body_prefix: Option<&[u8]>, pattern: &str, max_inspect_bytes: usize, ) -> Option<bool>

_check_response_pattern: Some(true/false) when the pattern was evaluated, None when it could not be (a body pattern while no body prefix was captured).

pub fn dispatch_action( rule: &BehaviorRule, client_ip: &str, passive_mode: bool, ) -> BehaviorAction

BehaviorActionDispatchMixin.apply_action: passive mode only logs (so BehaviorAction::LoggedOnly), active mode bans with the rule duration override (else the reference 3600s default) or reduces to a note. The caller applies the ban to its IP-ban store; the reference ban reason is behavioral_violation.

Trait Implementations

impl Default for BehaviorTracker

fn default() -> Self

Returns the “default value” for a type.