Expand description
NetworkSecurityMonitor — Real-time network security monitoring with anomaly detection, threat scoring, and incident management.
§Overview
This module provides production-grade security monitoring for a peer-to-peer
network. It tracks SecurityEvents per peer, computes time-decaying
ThreatScores, and automatically opens SecurityIncidents when a
peer’s score crosses a configurable threshold.
§Scoring Model
Each ThreatLevel contributes a fixed number of points to a peer’s score:
| Level | Points |
|---|---|
| None | 0 |
| Low | 5 |
| Medium | 15 |
| High | 30 |
| Critical | 50 |
Scores decay by 10 % per elapsed hour (integer hours):
score *= 0.9 ^ hours_since_last_update.
§Event ID
Event IDs are computed with FNV-1a over the concatenation of
peer_id + threat_type_name + timestamp_string.
Structs§
- Network
Security Monitor - Real-time network security monitor.
- Security
Event - A single security-relevant observation about a peer.
- Security
Incident - A group of related security events that warrants coordinated response.
- Security
Monitor Stats - Aggregate statistics snapshot from
NetworkSecurityMonitor. - Threat
Score - Aggregated threat score for a peer, with time-based decay.
Enums§
- Incident
Status - Lifecycle status of a
SecurityIncident. - Threat
Level - Ordered severity of a detected threat.
Critical > High > Medium > Low > None. - Threat
Type - The category of a detected threat.