Struct NetworkSecurityMonitor 

pub struct NetworkSecurityMonitor { /* private fields */ }

Real-time network security monitor.

Maintains a rolling event buffer, per-peer threat scores with exponential decay, and incident tracking. All timestamps are expected as milliseconds since Unix epoch.

Implementations

impl NetworkSecurityMonitor

pub fn new(max_events: usize, threat_threshold: f64) -> Self

Create a new monitor with the given capacity and auto-incident threshold.

Arguments

• max_events – Maximum events kept in the rolling buffer.
• threat_threshold – Score level (0..100) that triggers automatic incident creation. Defaults to 50.0 if 0.0 is supplied.

pub fn default_monitor() -> Self

Convenience constructor with sensible defaults.

pub fn record_event( &mut self, peer_id: String, threat_type: ThreatType, level: ThreatLevel, description: String, evidence: Vec<String>, now: u64, ) -> u64

Record a security event, update the peer’s threat score, and auto-create an incident if the score exceeds the threshold.

Returns the ID of the newly created event.

pub fn threat_score(&mut self, peer_id: &str, now: u64) -> f64

Return the current decay-adjusted threat score for peer_id. Returns 0.0 for unknown peers.

pub fn apply_decay(score: &mut ThreatScore, now: u64)

Apply hourly 10 % decay to a ThreatScore.

score *= 0.9 ^ floor((now - last_updated) / 3_600_000)

This is a pure (no-self) helper so it can be called with an &mut ThreatScore extracted from the map while the monitor is also borrowed.

pub fn top_threats(&mut self, n: usize, now: u64) -> Vec<&ThreatScore>

Return the top n ThreatScore references, sorted by score descending, after applying decay at the given timestamp.

pub fn events_for_peer(&self, peer_id: &str) -> Vec<&SecurityEvent>

All events recorded for peer_id, in insertion order.

pub fn events_by_threat_type( &self, threat_type: &ThreatType, ) -> Vec<&SecurityEvent>

All events of the given threat type, in insertion order.

pub fn events_since(&self, timestamp: u64) -> Vec<&SecurityEvent>

All events with a timestamp ≥ timestamp.

pub fn create_incident(&mut self, events: Vec<u64>, now: u64) -> u64

Create a new incident from a list of event IDs. Returns the new incident’s ID.

pub fn update_incident_status( &mut self, incident_id: u64, status: IncidentStatus, ) -> bool

Update the status of incident incident_id. Returns true on success.

pub fn open_incidents(&self) -> Vec<&SecurityIncident>

All incidents with status Open or Investigating.

pub fn clear_peer_history(&mut self, peer_id: &str) -> usize

Remove all events and the score entry for peer_id. Returns the number of events removed.

pub fn stats(&mut self, now: u64) -> SecurityMonitorStats

Compute a statistics snapshot at the given timestamp (applying decay before computing averages).