pub struct ThreatDetector { /* private fields */ }Expand description
Threat detector
ImplementationsΒ§
SourceΒ§impl ThreatDetector
impl ThreatDetector
Sourcepub fn new() -> Self
pub fn new() -> Self
Create a new threat detector with default patterns
Examples found in repository?
examples/detect_threats.rs (line 13)
9fn main() {
10 println!("=== SIEM Threat Detection System ===\n");
11
12 // Create threat detector with default patterns
13 let mut detector = ThreatDetector::new();
14
15 // Simulate various security logs
16 let logs = vec![
17 LogEntry {
18 timestamp: Utc::now(),
19 source_ip: Some("192.168.1.100".to_string()),
20 user: Some("admin".to_string()),
21 event_type: "authentication".to_string(),
22 message: "Failed login attempt for user admin from 192.168.1.100".to_string(),
23 metadata: HashMap::new(),
24 },
25 LogEntry {
26 timestamp: Utc::now(),
27 source_ip: Some("10.0.0.50".to_string()),
28 user: Some("user123".to_string()),
29 event_type: "file_access".to_string(),
30 message: "Malware detected in downloaded file: trojan.exe".to_string(),
31 metadata: HashMap::new(),
32 },
33 LogEntry {
34 timestamp: Utc::now(),
35 source_ip: Some("172.16.0.10".to_string()),
36 user: Some("dbuser".to_string()),
37 event_type: "database_query".to_string(),
38 message: "Query: SELECT * FROM users WHERE id='1' OR '1'='1'".to_string(),
39 metadata: HashMap::new(),
40 },
41 LogEntry {
42 timestamp: Utc::now(),
43 source_ip: Some("192.168.1.200".to_string()),
44 user: Some("operator".to_string()),
45 event_type: "system".to_string(),
46 message: "Privilege escalation attempt: unauthorized sudo command".to_string(),
47 metadata: HashMap::new(),
48 },
49 LogEntry {
50 timestamp: Utc::now(),
51 source_ip: Some("10.1.1.50".to_string()),
52 user: Some("ftpuser".to_string()),
53 event_type: "network".to_string(),
54 message: "Large data transfer detected: 500GB uploaded".to_string(),
55 metadata: HashMap::new(),
56 },
57 LogEntry {
58 timestamp: Utc::now(),
59 source_ip: Some("192.168.1.150".to_string()),
60 user: Some("john.doe".to_string()),
61 event_type: "application".to_string(),
62 message: "User successfully logged in to web portal".to_string(),
63 metadata: HashMap::new(),
64 },
65 ];
66
67 println!("Analyzing {} log entries for threats...\n", logs.len());
68
69 let mut all_alerts = Vec::new();
70 let mut critical_count = 0;
71 let mut high_count = 0;
72 let mut medium_count = 0;
73
74 for (i, log) in logs.iter().enumerate() {
75 println!("Log #{}: {}", i + 1, log.message);
76
77 let alerts = detector.analyze(log);
78
79 if alerts.is_empty() {
80 println!(" β No threats detected\n");
81 } else {
82 for alert in &alerts {
83 println!(" π¨ ALERT: {}", alert.alert_id);
84 println!(" Severity: {:?}", alert.severity);
85 println!(" Category: {:?}", alert.category);
86 println!(" Description: {}", alert.description);
87 println!(" Action: {}", alert.recommended_action);
88 println!();
89
90 match alert.severity {
91 ThreatSeverity::Critical => critical_count += 1,
92 ThreatSeverity::High => high_count += 1,
93 ThreatSeverity::Medium => medium_count += 1,
94 _ => {}
95 }
96 }
97 all_alerts.extend(alerts);
98 }
99 }
100
101 // Summary statistics
102 println!("=== Detection Summary ===");
103 println!("Total logs analyzed: {}", logs.len());
104 println!("Total alerts generated: {}", all_alerts.len());
105 println!(" Critical: {}", critical_count);
106 println!(" High: {}", high_count);
107 println!(" Medium: {}", medium_count);
108
109 // Filter critical alerts
110 println!("\n=== Critical Alerts (Requires Immediate Action) ===");
111 let critical_alerts = detector.filter_by_severity(&all_alerts, ThreatSeverity::Critical);
112
113 for alert in &critical_alerts {
114 println!("\n{}", alert.alert_id);
115 println!(" Category: {:?}", alert.category);
116 println!(" Description: {}", alert.description);
117 println!(" Source: {}", alert.source_log);
118 println!(" Action Required: {}", alert.recommended_action);
119 }
120
121 // Export alerts as JSON for SIEM
122 println!("\n=== SIEM Integration Example ===");
123 if let Some(first_alert) = all_alerts.first() {
124 match first_alert.to_json() {
125 Ok(json) => {
126 println!("Alert JSON format:");
127 println!("{}", json);
128 }
129 Err(e) => eprintln!("JSON export error: {}", e),
130 }
131 }
132
133 // Detector statistics
134 println!("\n=== Detector Statistics ===");
135 let stats = detector.get_stats();
136 for (key, value) in stats {
137 println!(" {}: {}", key, value);
138 }
139
140 println!("\n=== Security Features ===");
141 println!("β Memory-safe threat detection (no buffer overflows)");
142 println!("β Real-time log analysis");
143 println!("β Pre-configured threat patterns");
144 println!("β Severity-based alerting");
145 println!("β SIEM integration ready (JSON export)");
146 println!("β Custom pattern support");
147
148 println!("\n=== Compliance Use Cases ===");
149 println!("β NIST SP 800-92 - Security log management");
150 println!("β PCI-DSS Requirement 10 - Log monitoring");
151 println!("β SOX compliance - IT control monitoring");
152 println!("β GDPR - Security incident detection");
153 println!("β MITRE ATT&CK - Threat pattern matching");
154}Sourcepub fn add_pattern(&mut self, pattern: ThreatPattern)
pub fn add_pattern(&mut self, pattern: ThreatPattern)
Add a custom threat pattern
Sourcepub fn analyze(&mut self, log: &LogEntry) -> Vec<ThreatAlert>
pub fn analyze(&mut self, log: &LogEntry) -> Vec<ThreatAlert>
Analyze a log entry for threats
Examples found in repository?
examples/detect_threats.rs (line 77)
9fn main() {
10 println!("=== SIEM Threat Detection System ===\n");
11
12 // Create threat detector with default patterns
13 let mut detector = ThreatDetector::new();
14
15 // Simulate various security logs
16 let logs = vec![
17 LogEntry {
18 timestamp: Utc::now(),
19 source_ip: Some("192.168.1.100".to_string()),
20 user: Some("admin".to_string()),
21 event_type: "authentication".to_string(),
22 message: "Failed login attempt for user admin from 192.168.1.100".to_string(),
23 metadata: HashMap::new(),
24 },
25 LogEntry {
26 timestamp: Utc::now(),
27 source_ip: Some("10.0.0.50".to_string()),
28 user: Some("user123".to_string()),
29 event_type: "file_access".to_string(),
30 message: "Malware detected in downloaded file: trojan.exe".to_string(),
31 metadata: HashMap::new(),
32 },
33 LogEntry {
34 timestamp: Utc::now(),
35 source_ip: Some("172.16.0.10".to_string()),
36 user: Some("dbuser".to_string()),
37 event_type: "database_query".to_string(),
38 message: "Query: SELECT * FROM users WHERE id='1' OR '1'='1'".to_string(),
39 metadata: HashMap::new(),
40 },
41 LogEntry {
42 timestamp: Utc::now(),
43 source_ip: Some("192.168.1.200".to_string()),
44 user: Some("operator".to_string()),
45 event_type: "system".to_string(),
46 message: "Privilege escalation attempt: unauthorized sudo command".to_string(),
47 metadata: HashMap::new(),
48 },
49 LogEntry {
50 timestamp: Utc::now(),
51 source_ip: Some("10.1.1.50".to_string()),
52 user: Some("ftpuser".to_string()),
53 event_type: "network".to_string(),
54 message: "Large data transfer detected: 500GB uploaded".to_string(),
55 metadata: HashMap::new(),
56 },
57 LogEntry {
58 timestamp: Utc::now(),
59 source_ip: Some("192.168.1.150".to_string()),
60 user: Some("john.doe".to_string()),
61 event_type: "application".to_string(),
62 message: "User successfully logged in to web portal".to_string(),
63 metadata: HashMap::new(),
64 },
65 ];
66
67 println!("Analyzing {} log entries for threats...\n", logs.len());
68
69 let mut all_alerts = Vec::new();
70 let mut critical_count = 0;
71 let mut high_count = 0;
72 let mut medium_count = 0;
73
74 for (i, log) in logs.iter().enumerate() {
75 println!("Log #{}: {}", i + 1, log.message);
76
77 let alerts = detector.analyze(log);
78
79 if alerts.is_empty() {
80 println!(" β No threats detected\n");
81 } else {
82 for alert in &alerts {
83 println!(" π¨ ALERT: {}", alert.alert_id);
84 println!(" Severity: {:?}", alert.severity);
85 println!(" Category: {:?}", alert.category);
86 println!(" Description: {}", alert.description);
87 println!(" Action: {}", alert.recommended_action);
88 println!();
89
90 match alert.severity {
91 ThreatSeverity::Critical => critical_count += 1,
92 ThreatSeverity::High => high_count += 1,
93 ThreatSeverity::Medium => medium_count += 1,
94 _ => {}
95 }
96 }
97 all_alerts.extend(alerts);
98 }
99 }
100
101 // Summary statistics
102 println!("=== Detection Summary ===");
103 println!("Total logs analyzed: {}", logs.len());
104 println!("Total alerts generated: {}", all_alerts.len());
105 println!(" Critical: {}", critical_count);
106 println!(" High: {}", high_count);
107 println!(" Medium: {}", medium_count);
108
109 // Filter critical alerts
110 println!("\n=== Critical Alerts (Requires Immediate Action) ===");
111 let critical_alerts = detector.filter_by_severity(&all_alerts, ThreatSeverity::Critical);
112
113 for alert in &critical_alerts {
114 println!("\n{}", alert.alert_id);
115 println!(" Category: {:?}", alert.category);
116 println!(" Description: {}", alert.description);
117 println!(" Source: {}", alert.source_log);
118 println!(" Action Required: {}", alert.recommended_action);
119 }
120
121 // Export alerts as JSON for SIEM
122 println!("\n=== SIEM Integration Example ===");
123 if let Some(first_alert) = all_alerts.first() {
124 match first_alert.to_json() {
125 Ok(json) => {
126 println!("Alert JSON format:");
127 println!("{}", json);
128 }
129 Err(e) => eprintln!("JSON export error: {}", e),
130 }
131 }
132
133 // Detector statistics
134 println!("\n=== Detector Statistics ===");
135 let stats = detector.get_stats();
136 for (key, value) in stats {
137 println!(" {}: {}", key, value);
138 }
139
140 println!("\n=== Security Features ===");
141 println!("β Memory-safe threat detection (no buffer overflows)");
142 println!("β Real-time log analysis");
143 println!("β Pre-configured threat patterns");
144 println!("β Severity-based alerting");
145 println!("β SIEM integration ready (JSON export)");
146 println!("β Custom pattern support");
147
148 println!("\n=== Compliance Use Cases ===");
149 println!("β NIST SP 800-92 - Security log management");
150 println!("β PCI-DSS Requirement 10 - Log monitoring");
151 println!("β SOX compliance - IT control monitoring");
152 println!("β GDPR - Security incident detection");
153 println!("β MITRE ATT&CK - Threat pattern matching");
154}Sourcepub fn analyze_batch(&mut self, logs: &[LogEntry]) -> Vec<ThreatAlert>
pub fn analyze_batch(&mut self, logs: &[LogEntry]) -> Vec<ThreatAlert>
Analyze multiple log entries in batch
Sourcepub fn get_alert_history(&self, since: DateTime<Utc>) -> Vec<&ThreatAlert>
pub fn get_alert_history(&self, since: DateTime<Utc>) -> Vec<&ThreatAlert>
Get alert history for a time window
Sourcepub fn deduplicate_alerts(&mut self, window_minutes: i64) -> usize
pub fn deduplicate_alerts(&mut self, window_minutes: i64) -> usize
Deduplicate alerts by removing similar alerts within time window
Sourcepub fn clear_old_alerts(&mut self, before: DateTime<Utc>)
pub fn clear_old_alerts(&mut self, before: DateTime<Utc>)
Clear old alerts from history (memory management)
Sourcepub fn get_stats(&self) -> HashMap<String, usize>
pub fn get_stats(&self) -> HashMap<String, usize>
Get statistics
Examples found in repository?
examples/detect_threats.rs (line 135)
9fn main() {
10 println!("=== SIEM Threat Detection System ===\n");
11
12 // Create threat detector with default patterns
13 let mut detector = ThreatDetector::new();
14
15 // Simulate various security logs
16 let logs = vec![
17 LogEntry {
18 timestamp: Utc::now(),
19 source_ip: Some("192.168.1.100".to_string()),
20 user: Some("admin".to_string()),
21 event_type: "authentication".to_string(),
22 message: "Failed login attempt for user admin from 192.168.1.100".to_string(),
23 metadata: HashMap::new(),
24 },
25 LogEntry {
26 timestamp: Utc::now(),
27 source_ip: Some("10.0.0.50".to_string()),
28 user: Some("user123".to_string()),
29 event_type: "file_access".to_string(),
30 message: "Malware detected in downloaded file: trojan.exe".to_string(),
31 metadata: HashMap::new(),
32 },
33 LogEntry {
34 timestamp: Utc::now(),
35 source_ip: Some("172.16.0.10".to_string()),
36 user: Some("dbuser".to_string()),
37 event_type: "database_query".to_string(),
38 message: "Query: SELECT * FROM users WHERE id='1' OR '1'='1'".to_string(),
39 metadata: HashMap::new(),
40 },
41 LogEntry {
42 timestamp: Utc::now(),
43 source_ip: Some("192.168.1.200".to_string()),
44 user: Some("operator".to_string()),
45 event_type: "system".to_string(),
46 message: "Privilege escalation attempt: unauthorized sudo command".to_string(),
47 metadata: HashMap::new(),
48 },
49 LogEntry {
50 timestamp: Utc::now(),
51 source_ip: Some("10.1.1.50".to_string()),
52 user: Some("ftpuser".to_string()),
53 event_type: "network".to_string(),
54 message: "Large data transfer detected: 500GB uploaded".to_string(),
55 metadata: HashMap::new(),
56 },
57 LogEntry {
58 timestamp: Utc::now(),
59 source_ip: Some("192.168.1.150".to_string()),
60 user: Some("john.doe".to_string()),
61 event_type: "application".to_string(),
62 message: "User successfully logged in to web portal".to_string(),
63 metadata: HashMap::new(),
64 },
65 ];
66
67 println!("Analyzing {} log entries for threats...\n", logs.len());
68
69 let mut all_alerts = Vec::new();
70 let mut critical_count = 0;
71 let mut high_count = 0;
72 let mut medium_count = 0;
73
74 for (i, log) in logs.iter().enumerate() {
75 println!("Log #{}: {}", i + 1, log.message);
76
77 let alerts = detector.analyze(log);
78
79 if alerts.is_empty() {
80 println!(" β No threats detected\n");
81 } else {
82 for alert in &alerts {
83 println!(" π¨ ALERT: {}", alert.alert_id);
84 println!(" Severity: {:?}", alert.severity);
85 println!(" Category: {:?}", alert.category);
86 println!(" Description: {}", alert.description);
87 println!(" Action: {}", alert.recommended_action);
88 println!();
89
90 match alert.severity {
91 ThreatSeverity::Critical => critical_count += 1,
92 ThreatSeverity::High => high_count += 1,
93 ThreatSeverity::Medium => medium_count += 1,
94 _ => {}
95 }
96 }
97 all_alerts.extend(alerts);
98 }
99 }
100
101 // Summary statistics
102 println!("=== Detection Summary ===");
103 println!("Total logs analyzed: {}", logs.len());
104 println!("Total alerts generated: {}", all_alerts.len());
105 println!(" Critical: {}", critical_count);
106 println!(" High: {}", high_count);
107 println!(" Medium: {}", medium_count);
108
109 // Filter critical alerts
110 println!("\n=== Critical Alerts (Requires Immediate Action) ===");
111 let critical_alerts = detector.filter_by_severity(&all_alerts, ThreatSeverity::Critical);
112
113 for alert in &critical_alerts {
114 println!("\n{}", alert.alert_id);
115 println!(" Category: {:?}", alert.category);
116 println!(" Description: {}", alert.description);
117 println!(" Source: {}", alert.source_log);
118 println!(" Action Required: {}", alert.recommended_action);
119 }
120
121 // Export alerts as JSON for SIEM
122 println!("\n=== SIEM Integration Example ===");
123 if let Some(first_alert) = all_alerts.first() {
124 match first_alert.to_json() {
125 Ok(json) => {
126 println!("Alert JSON format:");
127 println!("{}", json);
128 }
129 Err(e) => eprintln!("JSON export error: {}", e),
130 }
131 }
132
133 // Detector statistics
134 println!("\n=== Detector Statistics ===");
135 let stats = detector.get_stats();
136 for (key, value) in stats {
137 println!(" {}: {}", key, value);
138 }
139
140 println!("\n=== Security Features ===");
141 println!("β Memory-safe threat detection (no buffer overflows)");
142 println!("β Real-time log analysis");
143 println!("β Pre-configured threat patterns");
144 println!("β Severity-based alerting");
145 println!("β SIEM integration ready (JSON export)");
146 println!("β Custom pattern support");
147
148 println!("\n=== Compliance Use Cases ===");
149 println!("β NIST SP 800-92 - Security log management");
150 println!("β PCI-DSS Requirement 10 - Log monitoring");
151 println!("β SOX compliance - IT control monitoring");
152 println!("β GDPR - Security incident detection");
153 println!("β MITRE ATT&CK - Threat pattern matching");
154}Sourcepub fn filter_by_severity(
&self,
alerts: &[ThreatAlert],
min_severity: ThreatSeverity,
) -> Vec<ThreatAlert>
pub fn filter_by_severity( &self, alerts: &[ThreatAlert], min_severity: ThreatSeverity, ) -> Vec<ThreatAlert>
Get alerts by severity
Examples found in repository?
examples/detect_threats.rs (line 111)
9fn main() {
10 println!("=== SIEM Threat Detection System ===\n");
11
12 // Create threat detector with default patterns
13 let mut detector = ThreatDetector::new();
14
15 // Simulate various security logs
16 let logs = vec![
17 LogEntry {
18 timestamp: Utc::now(),
19 source_ip: Some("192.168.1.100".to_string()),
20 user: Some("admin".to_string()),
21 event_type: "authentication".to_string(),
22 message: "Failed login attempt for user admin from 192.168.1.100".to_string(),
23 metadata: HashMap::new(),
24 },
25 LogEntry {
26 timestamp: Utc::now(),
27 source_ip: Some("10.0.0.50".to_string()),
28 user: Some("user123".to_string()),
29 event_type: "file_access".to_string(),
30 message: "Malware detected in downloaded file: trojan.exe".to_string(),
31 metadata: HashMap::new(),
32 },
33 LogEntry {
34 timestamp: Utc::now(),
35 source_ip: Some("172.16.0.10".to_string()),
36 user: Some("dbuser".to_string()),
37 event_type: "database_query".to_string(),
38 message: "Query: SELECT * FROM users WHERE id='1' OR '1'='1'".to_string(),
39 metadata: HashMap::new(),
40 },
41 LogEntry {
42 timestamp: Utc::now(),
43 source_ip: Some("192.168.1.200".to_string()),
44 user: Some("operator".to_string()),
45 event_type: "system".to_string(),
46 message: "Privilege escalation attempt: unauthorized sudo command".to_string(),
47 metadata: HashMap::new(),
48 },
49 LogEntry {
50 timestamp: Utc::now(),
51 source_ip: Some("10.1.1.50".to_string()),
52 user: Some("ftpuser".to_string()),
53 event_type: "network".to_string(),
54 message: "Large data transfer detected: 500GB uploaded".to_string(),
55 metadata: HashMap::new(),
56 },
57 LogEntry {
58 timestamp: Utc::now(),
59 source_ip: Some("192.168.1.150".to_string()),
60 user: Some("john.doe".to_string()),
61 event_type: "application".to_string(),
62 message: "User successfully logged in to web portal".to_string(),
63 metadata: HashMap::new(),
64 },
65 ];
66
67 println!("Analyzing {} log entries for threats...\n", logs.len());
68
69 let mut all_alerts = Vec::new();
70 let mut critical_count = 0;
71 let mut high_count = 0;
72 let mut medium_count = 0;
73
74 for (i, log) in logs.iter().enumerate() {
75 println!("Log #{}: {}", i + 1, log.message);
76
77 let alerts = detector.analyze(log);
78
79 if alerts.is_empty() {
80 println!(" β No threats detected\n");
81 } else {
82 for alert in &alerts {
83 println!(" π¨ ALERT: {}", alert.alert_id);
84 println!(" Severity: {:?}", alert.severity);
85 println!(" Category: {:?}", alert.category);
86 println!(" Description: {}", alert.description);
87 println!(" Action: {}", alert.recommended_action);
88 println!();
89
90 match alert.severity {
91 ThreatSeverity::Critical => critical_count += 1,
92 ThreatSeverity::High => high_count += 1,
93 ThreatSeverity::Medium => medium_count += 1,
94 _ => {}
95 }
96 }
97 all_alerts.extend(alerts);
98 }
99 }
100
101 // Summary statistics
102 println!("=== Detection Summary ===");
103 println!("Total logs analyzed: {}", logs.len());
104 println!("Total alerts generated: {}", all_alerts.len());
105 println!(" Critical: {}", critical_count);
106 println!(" High: {}", high_count);
107 println!(" Medium: {}", medium_count);
108
109 // Filter critical alerts
110 println!("\n=== Critical Alerts (Requires Immediate Action) ===");
111 let critical_alerts = detector.filter_by_severity(&all_alerts, ThreatSeverity::Critical);
112
113 for alert in &critical_alerts {
114 println!("\n{}", alert.alert_id);
115 println!(" Category: {:?}", alert.category);
116 println!(" Description: {}", alert.description);
117 println!(" Source: {}", alert.source_log);
118 println!(" Action Required: {}", alert.recommended_action);
119 }
120
121 // Export alerts as JSON for SIEM
122 println!("\n=== SIEM Integration Example ===");
123 if let Some(first_alert) = all_alerts.first() {
124 match first_alert.to_json() {
125 Ok(json) => {
126 println!("Alert JSON format:");
127 println!("{}", json);
128 }
129 Err(e) => eprintln!("JSON export error: {}", e),
130 }
131 }
132
133 // Detector statistics
134 println!("\n=== Detector Statistics ===");
135 let stats = detector.get_stats();
136 for (key, value) in stats {
137 println!(" {}: {}", key, value);
138 }
139
140 println!("\n=== Security Features ===");
141 println!("β Memory-safe threat detection (no buffer overflows)");
142 println!("β Real-time log analysis");
143 println!("β Pre-configured threat patterns");
144 println!("β Severity-based alerting");
145 println!("β SIEM integration ready (JSON export)");
146 println!("β Custom pattern support");
147
148 println!("\n=== Compliance Use Cases ===");
149 println!("β NIST SP 800-92 - Security log management");
150 println!("β PCI-DSS Requirement 10 - Log monitoring");
151 println!("β SOX compliance - IT control monitoring");
152 println!("β GDPR - Security incident detection");
153 println!("β MITRE ATT&CK - Threat pattern matching");
154}Sourcepub fn filter_by_category(
&self,
alerts: &[ThreatAlert],
category: &ThreatCategory,
) -> Vec<ThreatAlert>
pub fn filter_by_category( &self, alerts: &[ThreatAlert], category: &ThreatCategory, ) -> Vec<ThreatAlert>
Get alerts by category
Trait ImplementationsΒ§
Auto Trait ImplementationsΒ§
impl Freeze for ThreatDetector
impl RefUnwindSafe for ThreatDetector
impl Send for ThreatDetector
impl Sync for ThreatDetector
impl Unpin for ThreatDetector
impl UnwindSafe for ThreatDetector
Blanket ImplementationsΒ§
SourceΒ§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
SourceΒ§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
Mutably borrows from an owned value. Read more