Module session_analyzer 

Multi-turn session analysis for detecting extraction attacks (R-IS-03).

Tracks cross-request state per session to detect progressive escalation, system prompt extraction probes, credential probing, and suspicious topic shifts across conversation turns.

Architecture

Each session accumulates SessionEvents. On every new event the analyzer re-evaluates the full session history looking for:

1. Escalation – risk increasing across consecutive turns.
2. Extraction probing – regex-matched patterns known to extract system prompts, credentials, or context.
3. Topic shifting – sudden drops in inter-turn similarity that correlate with rising risk (a hallmark of social-engineering attacks).
4. Cumulative risk – the running sum of per-turn risk scores.

Structs

EscalationAlert

Details of a risk-escalation between consecutive turns.

ExtractionIndicator

An extraction-probe pattern match.

SessionAnalysisResult

Full result of analysing a session.

SessionAnalyzer

Session-aware multi-turn security analyzer.

SessionAnalyzerConfig

Tuneable thresholds for session analysis.

SessionEvent

A single request/response pair recorded in a session.

SessionState

Accumulated state for a single conversation session.

TopicShiftAlert

Detected suspicious topic shift between turns.

Enums

SessionAlert

A discrete alert raised by session analysis.