shadow_network_sim/

adversary.rs

//! Adversary models — define attacker capabilities and threat models.

use serde::{Serialize, Deserialize};
use std::collections::HashSet;

/// What kind of adversary we're modelling.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
pub enum AdversaryType {
    /// Passively observes traffic (ISP-level).
    PassiveObserver,
    /// Actively modifies or injects traffic (MITM).
    ActiveAttacker,
    /// Can observe all network links simultaneously.
    GlobalObserver,
    /// Controls a fraction of network relays.
    CompromisedRelays,
    /// Combination of capabilities.
    AdvancedPersistent,
}

/// Capabilities an adversary may have.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct AdversaryCapabilities {
    /// Can observe metadata (timing, sizes, flow direction).
    pub can_observe_metadata: bool,
    /// Can read packet contents (no encryption).
    pub can_read_content: bool,
    /// Can inject packets into the network.
    pub can_inject: bool,
    /// Can drop packets selectively.
    pub can_drop: bool,
    /// Can delay packets selectively.
    pub can_delay: bool,
    /// Can perform traffic analysis.
    pub can_correlate: bool,
    /// Fraction of the network controlled (0.0–1.0).
    pub network_fraction: f64,
    /// Number of vantage points for observation.
    pub vantage_points: usize,
}

impl AdversaryCapabilities {
    /// Construct capabilities for a given adversary type.
    pub fn for_type(adversary_type: AdversaryType) -> Self {
        match adversary_type {
            AdversaryType::PassiveObserver => Self {
                can_observe_metadata: true,
                can_read_content: false,
                can_inject: false,
                can_drop: false,
                can_delay: false,
                can_correlate: true,
                network_fraction: 0.0,
                vantage_points: 1,
            },
            AdversaryType::ActiveAttacker => Self {
                can_observe_metadata: true,
                can_read_content: false,
                can_inject: true,
                can_drop: true,
                can_delay: true,
                can_correlate: true,
                network_fraction: 0.0,
                vantage_points: 1,
            },
            AdversaryType::GlobalObserver => Self {
                can_observe_metadata: true,
                can_read_content: false,
                can_inject: false,
                can_drop: false,
                can_delay: false,
                can_correlate: true,
                network_fraction: 0.0,
                vantage_points: 100,
            },
            AdversaryType::CompromisedRelays => Self {
                can_observe_metadata: true,
                can_read_content: true,
                can_inject: true,
                can_drop: true,
                can_delay: true,
                can_correlate: true,
                network_fraction: 0.1,
                vantage_points: 5,
            },
            AdversaryType::AdvancedPersistent => Self {
                can_observe_metadata: true,
                can_read_content: false,
                can_inject: true,
                can_drop: true,
                can_delay: true,
                can_correlate: true,
                network_fraction: 0.2,
                vantage_points: 20,
            },
        }
    }

    /// Threat level (0.0–1.0) based on combined capabilities.
    pub fn threat_level(&self) -> f64 {
        let mut level = 0.0;
        if self.can_observe_metadata { level += 0.1; }
        if self.can_read_content { level += 0.2; }
        if self.can_inject { level += 0.15; }
        if self.can_drop { level += 0.1; }
        if self.can_delay { level += 0.05; }
        if self.can_correlate { level += 0.15; }
        level += self.network_fraction * 0.25;
        level.min(1.0)
    }
}

/// Simulated adversary acting on network traffic.
pub struct AdversaryModel {
    pub adversary_type: AdversaryType,
    pub capabilities: AdversaryCapabilities,
    /// Set of compromised node IDs.
    pub compromised_nodes: HashSet<[u8; 32]>,
    /// Observed traffic flows.
    pub observed_flows: Vec<ObservedFlow>,
}

/// A traffic flow observed by the adversary.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ObservedFlow {
    pub source_id: [u8; 32],
    pub dest_id: [u8; 32],
    pub packet_sizes: Vec<usize>,
    pub timestamps_us: Vec<u64>,
    pub encrypted: bool,
}

impl AdversaryModel {
    pub fn new(adversary_type: AdversaryType) -> Self {
        Self {
            capabilities: AdversaryCapabilities::for_type(adversary_type),
            adversary_type,
            compromised_nodes: HashSet::new(),
            observed_flows: Vec::new(),
        }
    }

    /// Compromise a specific relay node.
    pub fn compromise_node(&mut self, node_id: [u8; 32]) {
        self.compromised_nodes.insert(node_id);
    }

    /// Check if a node is compromised.
    pub fn is_compromised(&self, node_id: &[u8; 32]) -> bool {
        self.compromised_nodes.contains(node_id)
    }

    /// Observe a traffic flow.
    pub fn observe_flow(&mut self, flow: ObservedFlow) {
        self.observed_flows.push(flow);
    }

    /// Attempt to correlate two flows (by timing patterns).
    pub fn correlate_flows(&self, a: &ObservedFlow, b: &ObservedFlow) -> f64 {
        if !self.capabilities.can_correlate {
            return 0.0;
        }

        // Simple timing correlation: compare inter-packet delays
        let delays_a = inter_packet_delays(&a.timestamps_us);
        let delays_b = inter_packet_delays(&b.timestamps_us);

        if delays_a.is_empty() || delays_b.is_empty() {
            return 0.0;
        }

        // Pearson correlation coefficient
        pearson_correlation(&delays_a, &delays_b).abs()
    }

    /// Evaluate circuit anonymity: probability of deanonymization.
    pub fn circuit_compromise_probability(&self, path_length: usize) -> f64 {
        // Probability that both entry and exit are compromised
        let f = self.capabilities.network_fraction;
        // P(first AND last compromised) = f * f
        // For path_length = 3: P = f^2
        // For longer paths, middle nodes don't help if first+last are bad
        f * f
    }

    /// Total observed flow count.
    pub fn observed_count(&self) -> usize {
        self.observed_flows.len()
    }
}

/// Compute inter-packet delays from timestamps.
fn inter_packet_delays(timestamps: &[u64]) -> Vec<f64> {
    timestamps
        .windows(2)
        .map(|w| (w[1] as f64) - (w[0] as f64))
        .collect()
}

/// Pearson correlation coefficient between two series.
fn pearson_correlation(a: &[f64], b: &[f64]) -> f64 {
    let n = a.len().min(b.len());
    if n < 2 {
        return 0.0;
    }

    let mean_a = a[..n].iter().sum::<f64>() / n as f64;
    let mean_b = b[..n].iter().sum::<f64>() / n as f64;

    let mut cov = 0.0;
    let mut var_a = 0.0;
    let mut var_b = 0.0;

    for i in 0..n {
        let da = a[i] - mean_a;
        let db = b[i] - mean_b;
        cov += da * db;
        var_a += da * da;
        var_b += db * db;
    }

    let denom = (var_a * var_b).sqrt();
    if denom < 1e-12 {
        0.0
    } else {
        cov / denom
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_adversary_capabilities() {
        let caps = AdversaryCapabilities::for_type(AdversaryType::PassiveObserver);
        assert!(caps.can_observe_metadata);
        assert!(!caps.can_inject);
        assert!(!caps.can_read_content);
    }

    #[test]
    fn test_threat_levels() {
        let passive = AdversaryCapabilities::for_type(AdversaryType::PassiveObserver);
        let active = AdversaryCapabilities::for_type(AdversaryType::ActiveAttacker);
        let apt = AdversaryCapabilities::for_type(AdversaryType::AdvancedPersistent);

        assert!(passive.threat_level() < active.threat_level());
        assert!(active.threat_level() < apt.threat_level());
    }

    #[test]
    fn test_flow_correlation() {
        let model = AdversaryModel::new(AdversaryType::GlobalObserver);
        // Same timing pattern = high correlation
        let flow_a = ObservedFlow {
            source_id: [1; 32],
            dest_id: [2; 32],
            packet_sizes: vec![100, 200, 150],
            timestamps_us: vec![0, 1000, 2500],
            encrypted: true,
        };
        let flow_b = ObservedFlow {
            source_id: [3; 32],
            dest_id: [4; 32],
            packet_sizes: vec![100, 200, 150],
            timestamps_us: vec![50, 1050, 2550], // offset but same pattern
            encrypted: true,
        };

        let corr = model.correlate_flows(&flow_a, &flow_b);
        assert!(corr > 0.99, "Same-pattern flows should be highly correlated: {}", corr);
    }

    #[test]
    fn test_circuit_compromise_probability() {
        let mut model = AdversaryModel::new(AdversaryType::CompromisedRelays);
        model.capabilities.network_fraction = 0.1;
        let prob = model.circuit_compromise_probability(3);
        assert!((prob - 0.01).abs() < 0.001); // 0.1 * 0.1 = 0.01
    }
}