Documentation
¶
Index ¶
- func DefaultConfig() config.MLAnalysisConfig
- type AdaptiveResult
- type AdaptiveThresholdManager
- func (atm *AdaptiveThresholdManager) AdaptThresholds(ctx context.Context) error
- func (atm *AdaptiveThresholdManager) AnalyzeWithAdaptiveThresholds(ctx context.Context, pkg *types.Package, originalScore float64, ...) (*AdaptiveResult, error)
- func (atm *AdaptiveThresholdManager) GetAdaptiveThreshold(ecosystem, threatType string) float64
- func (atm *AdaptiveThresholdManager) Initialize(ctx context.Context) error
- func (atm *AdaptiveThresholdManager) UpdatePerformanceStats(ecosystem string, prediction, actual bool, score float64)
- type AdvancedAnomalyDetector
- type AdvancedFeatureExtractor
- func (e *AdvancedFeatureExtractor) ExtractFeatures(pkg *types.Package) (*PackageFeatures, error)
- func (e *AdvancedFeatureExtractor) GetFeatureNames() []string
- func (e *AdvancedFeatureExtractor) Initialize(config *config.Config) error
- func (e *AdvancedFeatureExtractor) NormalizeFeatures(features *PackageFeatures) []float64
- type AdvancedScorer
- type AggregatedFeatureStoreStats
- type AlertSeverity
- type AnalysisMetadata
- type AnalysisOptions
- type AnalysisResult
- type AnomalyDetection
- type AnomalyDetector
- type AnomalyModel
- type AuthorFeatures
- type BasicFeatureExtractor
- type BasicMLScorer
- func (bms *BasicMLScorer) ExtractFeatures(dep types.Dependency, metadata map[string]interface{}) BasicPackageFeatures
- func (bms *BasicMLScorer) GetModelInfo() *ModelInfo
- func (bms *BasicMLScorer) GetThresholds() ScoringThresholds
- func (bms *BasicMLScorer) Score(ctx context.Context, pkg *types.Package, features map[string]interface{}) (*ScoringResult, error)
- func (bms *BasicMLScorer) ScorePackage(features BasicPackageFeatures) MLScore
- func (bms *BasicMLScorer) UpdateFeatureStats(features []BasicPackageFeatures)
- func (bms *BasicMLScorer) UpdateModel(modelData []byte) error
- type BasicPackageFeatures
- type BasicScorerConfig
- type BatchAnalysisRequest
- type BatchAnalysisResponse
- type BehavioralAnalysis
- type BehavioralAnalysisResult
- type BehavioralAnalyzer
- func (ba *BehavioralAnalyzer) AnalyzeBehavior(pkg *types.Package) BehavioralAnalysis
- func (ba *BehavioralAnalyzer) AnalyzeBehaviorEnhanced(ctx context.Context, features *EnhancedPackageFeatures) (*BehavioralAnalysisResult, error)
- func (ba *BehavioralAnalyzer) GetMetrics(ctx context.Context) (map[string]interface{}, error)
- func (ba *BehavioralAnalyzer) Update(ctx context.Context) error
- type BehavioralConfig
- type BehavioralMetrics
- type CachedFeatures
- type CachedPrediction
- type Client
- func (c *Client) BatchAnalyzePackages(ctx context.Context, packages []PackageToAnalyze, options AnalysisOptions) (*BatchAnalysisResponse, error)
- func (c *Client) CheckMaliciousPackage(ctx context.Context, packageName, registry, version string) (*MaliciousResponse, error)
- func (c *Client) ConvertToThreats(analysisResult *PackageAnalysisResult) []types.Threat
- func (c *Client) FindSimilarPackages(ctx context.Context, packageName, registry string, topK int, threshold float64) (*SimilarityResponse, error)
- func (c *Client) GetModelInfo(ctx context.Context, modelName string) (*ModelInfo, error)
- func (c *Client) GetModels(ctx context.Context) ([]ModelInfo, error)
- type CodeMetrics
- type Config
- type DecisionNode
- type Dependency
- type DetectionMetrics
- type EcosystemModel
- type EnhancedAnomalyDetection
- type EnhancedFileSystemBehavior
- type EnhancedInstallBehavior
- type EnhancedMLConfig
- type EnhancedMLDetector
- func (emd *EnhancedMLDetector) AnalyzePackage(ctx context.Context, features *EnhancedPackageFeatures) (*MLDetectionResult, error)
- func (emd *EnhancedMLDetector) BatchAnalyze(ctx context.Context, packages []*EnhancedPackageFeatures) ([]*MLDetectionResult, error)
- func (emd *EnhancedMLDetector) DetectThreatSimple(packageName, content string) (bool, float64, error)
- func (emd *EnhancedMLDetector) GetMetrics() *DetectionMetrics
- func (emd *EnhancedMLDetector) GetModelMetrics(ctx context.Context) (map[string]interface{}, error)
- func (emd *EnhancedMLDetector) UpdateMetrics(correct bool, confidence float64)
- func (emd *EnhancedMLDetector) UpdateModels(ctx context.Context) error
- func (emd *EnhancedMLDetector) UpdateParameters(params map[string]interface{}) error
- type EnhancedMLEngine
- type EnhancedNetworkBehavior
- type EnhancedPackageFeatures
- type EnhancedProcessBehavior
- type EnhancedReputationAnalysis
- type EnhancedRuntimeBehavior
- type EnhancedSimilarityResult
- type EnsembleManager
- type EnsembleModel
- type EnsembleResults
- type FeatureContribution
- type FeatureDefinition
- type FeatureDriftDetector
- type FeatureExtractor
- type FeatureImportance
- type FeatureStats
- type FeatureStore
- func (fs *FeatureStore) CleanupExpired() int
- func (fs *FeatureStore) Close()
- func (fs *FeatureStore) ExportFeatures() ([]byte, error)
- func (fs *FeatureStore) GetFeatures(packageName, registry string) *PackageFeatures
- func (fs *FeatureStore) GetStats() *FeatureStoreStats
- func (fs *FeatureStore) GetTopPackages(limit int) []PackageAccessInfo
- func (fs *FeatureStore) ImportFeatures(data []byte) error
- func (fs *FeatureStore) InvalidateAll()
- func (fs *FeatureStore) InvalidateFeatures(packageName, registry string)
- func (fs *FeatureStore) StoreFeatures(features *PackageFeatures)
- type FeatureStoreManager
- type FeatureStoreStats
- type FeatureType
- type FeatureVector
- type FeedbackData
- type FeedbackEntry
- type FeedbackLoop
- func (fl *FeedbackLoop) AddFeedback(pkg *types.Package, predictedLabel, actualLabel string, ...) error
- func (fl *FeedbackLoop) DisableLearning()
- func (fl *FeedbackLoop) EnableLearning()
- func (fl *FeedbackLoop) ExportFeedbackData(exportFile string) error
- func (fl *FeedbackLoop) GetFeedbackByDate(startDate, endDate time.Time) []FeedbackEntry
- func (fl *FeedbackLoop) GetFeedbackForPackage(packageName string) []FeedbackEntry
- func (fl *FeedbackLoop) GetFeedbackStats() map[string]interface{}
- func (fl *FeedbackLoop) GetRecentFeedback(limit int) []FeedbackEntry
- func (fl *FeedbackLoop) ImportFeedbackData(importFile string) error
- type FileStructure
- type FileSystemBehavior
- type Finding
- type InstallBehavior
- type MLAnalysisResult
- type MLAnalyzer
- func (a *MLAnalyzer) Analyze(ctx context.Context, pkg *types.Package) (*AnalysisResult, error)
- func (a *MLAnalyzer) DisableLearning()
- func (a *MLAnalyzer) EnableLearning()
- func (a *MLAnalyzer) GetFeedbackStats() map[string]interface{}
- func (a *MLAnalyzer) ProvideFeedback(pkg *types.Package, predictedLabel, actualLabel string, ...) error
- type MLConfig
- type MLDetectionResult
- type MLModel
- type MLPipeline
- func (p *MLPipeline) AnalyzePackage(ctx context.Context, pkg *types.Package) (*Prediction, error)
- func (p *MLPipeline) AnalyzePackages(ctx context.Context, packages []*types.Package) ([]*Prediction, error)
- func (p *MLPipeline) GetModelInfo() map[string]*ModelInfo
- func (p *MLPipeline) GetModels() map[string]MLModel
- func (p *MLPipeline) GetStats() map[string]interface{}
- func (p *MLPipeline) Initialize(ctx context.Context) error
- func (p *MLPipeline) IsReady() bool
- func (p *MLPipeline) UpdateModel(name string, model MLModel) error
- type MLScore
- type MaliciousIndicator
- type MaliciousRequest
- type MaliciousResponse
- type MalwareClassification
- type MalwareClassifier
- type MetadataFeatures
- type ModelExplainer
- type ModelInfo
- type ModelMetrics
- type ModelPerformanceMonitor
- func (mpm *ModelPerformanceMonitor) GetAlerts() []PerformanceAlert
- func (mpm *ModelPerformanceMonitor) GetMetrics(modelID string) *PerformanceMetrics
- func (mpm *ModelPerformanceMonitor) SetThreshold(metric string, threshold float64)
- func (mpm *ModelPerformanceMonitor) UpdateMetrics(modelID string, metrics *PerformanceMetrics)
- type ModelStatus
- type ModelType
- type NetworkBehavior
- type NormalizationParams
- type OutlierAnalysis
- type PackageAccessInfo
- type PackageAnalysisResult
- type PackageFeatures
- type PackageToAnalyze
- type PatternAnalysis
- type PerformanceAlert
- type PerformanceMetrics
- type PerformanceStats
- type PopularityFeatures
- type Prediction
- type PredictionCache
- type PredictionExplanation
- type PredictionMetrics
- type PredictionModel
- type PredictorConfig
- type RealtimeLearner
- type RepositoryFeatures
- type ReputationAnalysis
- type ReputationAnalyzer
- type ReputationFactor
- type ReputationModel
- type ReputationSource
- type RiskAssessment
- type RiskFactor
- type RuntimeBehavior
- type Scorer
- type ScorerConfig
- type ScoringResult
- type ScoringThresholds
- type SecurityFeatures
- type SecurityMetrics
- type SimilarPackage
- type SimilarityModel
- type SimilarityRequest
- type SimilarityResponse
- type SimilarityResult
- type ThreatFeatureExtractor
- type ThreatPrediction
- type ThreatPredictor
- func (tp *ThreatPredictor) AddTrainingSample(sample *TrainingSample) error
- func (tp *ThreatPredictor) GetModelMetrics() map[string]*ModelMetrics
- func (tp *ThreatPredictor) PredictThreat(ctx context.Context, packageInfo interface{}) (*ThreatPrediction, error)
- func (tp *ThreatPredictor) TrainModels(ctx context.Context) error
- type ThresholdChange
- type ThresholdSet
- type TrainingData
- type TrainingDataset
- type TrainingExample
- type TrainingMetrics
- type TrainingSample
- type TypoDetection
- type TypoDetector
- type TyposquattingModel
- func (m *TyposquattingModel) GetModelInfo() *ModelInfo
- func (m *TyposquattingModel) Initialize(ctx context.Context) error
- func (m *TyposquattingModel) IsReady() bool
- func (m *TyposquattingModel) Predict(features []float64) (*Prediction, error)
- func (m *TyposquattingModel) Train(data []TrainingData) error
- type VotingType
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DefaultConfig ¶
func DefaultConfig() config.MLAnalysisConfig
DefaultConfig provides a default configuration for the ML analyzer.
Types ¶
type AdaptiveResult ¶
type AdaptiveResult struct {
Ecosystem string `json:"ecosystem"`
OriginalScore float64 `json:"original_score"`
AdjustedScore float64 `json:"adjusted_score"`
ThresholdUsed float64 `json:"threshold_used"`
ModelVersion string `json:"model_version"`
ConfidenceLevel float64 `json:"confidence_level"`
FeatureContributions map[string]float64 `json:"feature_contributions"`
AdaptationApplied bool `json:"adaptation_applied"`
Details map[string]interface{} `json:"details"`
}
AdaptiveResult represents the result of adaptive threshold analysis
type AdaptiveThresholdManager ¶
type AdaptiveThresholdManager struct {
// contains filtered or unexported fields
}
AdaptiveThresholdManager manages ecosystem-specific ML thresholds
func NewAdaptiveThresholdManager ¶
func NewAdaptiveThresholdManager(config *config.Config, logger *logger.Logger) *AdaptiveThresholdManager
NewAdaptiveThresholdManager creates a new adaptive threshold manager
func (*AdaptiveThresholdManager) AdaptThresholds ¶
func (atm *AdaptiveThresholdManager) AdaptThresholds(ctx context.Context) error
AdaptThresholds adapts thresholds based on performance feedback
func (*AdaptiveThresholdManager) AnalyzeWithAdaptiveThresholds ¶
func (atm *AdaptiveThresholdManager) AnalyzeWithAdaptiveThresholds(ctx context.Context, pkg *types.Package, originalScore float64, threatType string) (*AdaptiveResult, error)
AnalyzeWithAdaptiveThresholds performs analysis with ecosystem-specific adaptations
func (*AdaptiveThresholdManager) GetAdaptiveThreshold ¶
func (atm *AdaptiveThresholdManager) GetAdaptiveThreshold(ecosystem, threatType string) float64
GetAdaptiveThreshold returns the adaptive threshold for a specific ecosystem and threat type
func (*AdaptiveThresholdManager) Initialize ¶
func (atm *AdaptiveThresholdManager) Initialize(ctx context.Context) error
Initialize sets up the adaptive threshold system
func (*AdaptiveThresholdManager) UpdatePerformanceStats ¶
func (atm *AdaptiveThresholdManager) UpdatePerformanceStats(ecosystem string, prediction, actual bool, score float64)
UpdatePerformanceStats updates performance statistics for threshold adaptation
type AdvancedAnomalyDetector ¶
type AdvancedAnomalyDetector struct {
// contains filtered or unexported fields
}
AdvancedAnomalyDetector provides sophisticated anomaly detection
func NewAdvancedAnomalyDetector ¶
func NewAdvancedAnomalyDetector(threshold float64, windowSize int) *AdvancedAnomalyDetector
NewAdvancedAnomalyDetector creates a new anomaly detector
func (*AdvancedAnomalyDetector) DetectAnomaly ¶
func (aad *AdvancedAnomalyDetector) DetectAnomaly(score float64) bool
DetectAnomaly detects anomalies in threat scores
type AdvancedFeatureExtractor ¶
type AdvancedFeatureExtractor struct {
// contains filtered or unexported fields
}
AdvancedFeatureExtractor implements sophisticated feature extraction for ML models
func NewAdvancedFeatureExtractor ¶
func NewAdvancedFeatureExtractor() *AdvancedFeatureExtractor
NewAdvancedFeatureExtractor creates a new advanced feature extractor
func (*AdvancedFeatureExtractor) ExtractFeatures ¶
func (e *AdvancedFeatureExtractor) ExtractFeatures(pkg *types.Package) (*PackageFeatures, error)
ExtractFeatures extracts comprehensive features from a package
func (*AdvancedFeatureExtractor) GetFeatureNames ¶
func (e *AdvancedFeatureExtractor) GetFeatureNames() []string
GetFeatureNames returns the names of all extracted features
func (*AdvancedFeatureExtractor) Initialize ¶
func (e *AdvancedFeatureExtractor) Initialize(config *config.Config) error
Initialize initializes the feature extractor with configuration and data
func (*AdvancedFeatureExtractor) NormalizeFeatures ¶
func (e *AdvancedFeatureExtractor) NormalizeFeatures(features *PackageFeatures) []float64
NormalizeFeatures normalizes features for ML model input
type AdvancedScorer ¶
type AdvancedScorer struct {
// contains filtered or unexported fields
}
AdvancedScorer implements sophisticated ML-based scoring using ensemble methods
func NewAdvancedScorer ¶
func NewAdvancedScorer(config *ScorerConfig) (*AdvancedScorer, error)
NewAdvancedScorer creates a new advanced scorer with the given configuration
func (*AdvancedScorer) GetModelInfo ¶
func (s *AdvancedScorer) GetModelInfo() *ModelInfo
GetModelInfo returns information about the model
func (*AdvancedScorer) GetThresholds ¶
func (s *AdvancedScorer) GetThresholds() ScoringThresholds
GetThresholds returns the scoring thresholds
func (*AdvancedScorer) Score ¶
func (s *AdvancedScorer) Score(ctx context.Context, pkg *types.Package, features map[string]interface{}) (*ScoringResult, error)
Score calculates a comprehensive risk score using ensemble methods
func (*AdvancedScorer) UpdateModel ¶
func (s *AdvancedScorer) UpdateModel(modelData []byte) error
UpdateModel updates the scorer with new model parameters
type AggregatedFeatureStoreStats ¶
type AggregatedFeatureStoreStats struct {
TotalEntries int `json:"total_entries"`
TotalCacheHits int64 `json:"total_cache_hits"`
TotalCacheMisses int64 `json:"total_cache_misses"`
OverallHitRatio float64 `json:"overall_hit_ratio"`
TotalMemoryUsage int64 `json:"total_memory_usage_bytes"`
RegistryStats map[string]*FeatureStoreStats `json:"registry_stats"`
}
AggregatedFeatureStoreStats represents aggregated statistics
type AlertSeverity ¶
type AlertSeverity string
AlertSeverity represents alert severity levels
const ( AlertSeverityLow AlertSeverity = "low" AlertSeverityMedium AlertSeverity = "medium" AlertSeverityHigh AlertSeverity = "high" AlertSeverityCritical AlertSeverity = "critical" )
type AnalysisMetadata ¶
type AnalysisMetadata struct {
AnalysisTime time.Time `json:"analysis_time"`
Duration string `json:"duration"`
ModelsUsed []string `json:"models_used"`
FeaturesUsed []string `json:"features_used"`
DatasetVersion string `json:"dataset_version"`
ModelVersion string `json:"model_version"`
AnalysisVersion string `json:"analysis_version"`
}
AnalysisMetadata holds metadata about the analysis.
type AnalysisOptions ¶
type AnalysisOptions struct {
CheckSimilarity bool `json:"check_similarity"`
CheckMalicious bool `json:"check_malicious"`
SimilarityThreshold float64 `json:"similarity_threshold"`
MaliciousThreshold float64 `json:"malicious_threshold"`
TopK int `json:"top_k"`
}
AnalysisOptions represents options for analysis
type AnalysisResult ¶
type AnalysisResult struct {
SimilarityScore float64 `json:"similarity_score"`
MaliciousScore float64 `json:"malicious_score"`
ReputationScore float64 `json:"reputation_score"`
TyposquattingScore float64 `json:"typosquatting_score"`
Features map[string]float64 `json:"features"`
Predictions []Prediction `json:"predictions"`
SimilarPackages []SimilarPackage `json:"similar_packages"`
AnomalyDetection AnomalyDetection `json:"anomaly_detection"`
ReputationAnalysis ReputationAnalysis `json:"reputation_analysis"`
BehavioralAnalysis BehavioralAnalysis `json:"behavioral_analysis"`
RiskAssessment RiskAssessment `json:"risk_assessment"`
Findings []Finding `json:"findings"`
Recommendations []string `json:"recommendations"`
Metadata AnalysisMetadata `json:"metadata"`
}
AnalysisResult holds the results of the ML analysis.
type AnomalyDetection ¶
type AnomalyDetection struct {
IsAnomaly bool `json:"is_anomaly"`
AnomalyScore float64 `json:"anomaly_score"`
AnomalyType string `json:"anomaly_type"`
AnomalyFeatures []string `json:"anomaly_features"`
OutlierAnalysis OutlierAnalysis `json:"outlier_analysis"`
PatternAnalysis PatternAnalysis `json:"pattern_analysis"`
}
AnomalyDetection holds anomaly detection results.
type AnomalyDetector ¶
type AnomalyDetector struct{}
func NewAnomalyDetector ¶
func NewAnomalyDetector() (*AnomalyDetector, error)
func (*AnomalyDetector) DetectAnomalies ¶
func (ad *AnomalyDetector) DetectAnomalies(ctx context.Context, features *EnhancedPackageFeatures) (*EnhancedAnomalyDetection, error)
func (*AnomalyDetector) GetMetrics ¶
func (ad *AnomalyDetector) GetMetrics(ctx context.Context) (map[string]interface{}, error)
type AnomalyModel ¶
type AnomalyModel struct {
// contains filtered or unexported fields
}
AnomalyModel implements anomaly detection for suspicious packages
func NewAnomalyModel ¶
func NewAnomalyModel(config config.MLModelConfig) *AnomalyModel
NewAnomalyModel creates a new anomaly detection model
func (*AnomalyModel) GetModelInfo ¶
func (m *AnomalyModel) GetModelInfo() *ModelInfo
GetModelInfo returns model information
func (*AnomalyModel) Initialize ¶
func (m *AnomalyModel) Initialize(ctx context.Context) error
Initialize initializes the anomaly detection model
func (*AnomalyModel) IsReady ¶
func (m *AnomalyModel) IsReady() bool
IsReady returns whether the model is ready
func (*AnomalyModel) Predict ¶
func (m *AnomalyModel) Predict(features []float64) (*Prediction, error)
Predict performs anomaly detection
func (*AnomalyModel) Train ¶
func (m *AnomalyModel) Train(data []TrainingData) error
Train trains the anomaly detection model
type AuthorFeatures ¶
type AuthorFeatures struct {
AuthorName string `json:"author_name"`
AuthorEmail string `json:"author_email"`
AccountAge int `json:"account_age_days"`
PublishedPackages int `json:"published_packages"`
TotalDownloads int64 `json:"total_downloads"`
AverageRating float64 `json:"average_rating"`
VerifiedAccount bool `json:"verified_account"`
HasGitHubProfile bool `json:"has_github_profile"`
GitHubFollowers int `json:"github_followers"`
GitHubRepos int `json:"github_repos"`
LastActivity time.Time `json:"last_activity"`
SuspiciousPatterns []string `json:"suspicious_patterns"`
}
AuthorFeatures contains author-related features
type BasicFeatureExtractor ¶
type BasicFeatureExtractor struct {
// contains filtered or unexported fields
}
BasicFeatureExtractor handles feature extraction from packages
type BasicMLScorer ¶
type BasicMLScorer struct {
// contains filtered or unexported fields
}
BasicMLScorer implements a simple machine learning scoring algorithm for detecting malicious packages based on extracted features
func NewBasicMLScorer ¶
func NewBasicMLScorer() *BasicMLScorer
NewBasicMLScorer creates a new basic ML scorer with default configuration
func (*BasicMLScorer) ExtractFeatures ¶
func (bms *BasicMLScorer) ExtractFeatures(dep types.Dependency, metadata map[string]interface{}) BasicPackageFeatures
ExtractFeatures extracts features from a package dependency
func (*BasicMLScorer) GetModelInfo ¶
func (bms *BasicMLScorer) GetModelInfo() *ModelInfo
GetModelInfo implements the Scorer interface
func (*BasicMLScorer) GetThresholds ¶
func (bms *BasicMLScorer) GetThresholds() ScoringThresholds
GetThresholds implements the Scorer interface
func (*BasicMLScorer) Score ¶
func (bms *BasicMLScorer) Score(ctx context.Context, pkg *types.Package, features map[string]interface{}) (*ScoringResult, error)
Score implements the Scorer interface
func (*BasicMLScorer) ScorePackage ¶
func (bms *BasicMLScorer) ScorePackage(features BasicPackageFeatures) MLScore
ScorePackage calculates a malicious score for a package
func (*BasicMLScorer) UpdateFeatureStats ¶
func (bms *BasicMLScorer) UpdateFeatureStats(features []BasicPackageFeatures)
UpdateFeatureStats updates feature statistics for better normalization
func (*BasicMLScorer) UpdateModel ¶
func (bms *BasicMLScorer) UpdateModel(modelData []byte) error
UpdateModel implements the Scorer interface
type BasicPackageFeatures ¶
type BasicPackageFeatures struct {
DownloadCount float64
MaintainerReputation float64
PackageAge float64
VersionCount float64
DescriptionLength float64
DependencyCount float64
TyposquattingSimilarity float64
NameEntropy float64
UpdateFrequency float64
LicensePresent float64
ReadmePresent float64
HomepagePresent float64
RepositoryPresent float64
KeywordCount float64
MaintainerCount float64
}
BasicPackageFeatures represents extracted features from a package for basic ML scoring
type BasicScorerConfig ¶
type BasicScorerConfig struct {
MaliciousThreshold float64
SuspiciousThreshold float64
MinConfidence float64
FeatureWeights map[string]float64
NormalizationEnabled bool
}
BasicScorerConfig holds configuration for the basic ML scorer
type BatchAnalysisRequest ¶
type BatchAnalysisRequest struct {
Packages []PackageToAnalyze `json:"packages"`
Options AnalysisOptions `json:"options"`
}
BatchAnalysisRequest represents a batch analysis request
type BatchAnalysisResponse ¶
type BatchAnalysisResponse struct {
Results []PackageAnalysisResult `json:"results"`
Time float64 `json:"time_ms"`
}
BatchAnalysisResponse represents a batch analysis response
type BehavioralAnalysis ¶
type BehavioralAnalysis struct {
InstallBehavior InstallBehavior `json:"install_behavior"`
RuntimeBehavior RuntimeBehavior `json:"runtime_behavior"`
NetworkBehavior NetworkBehavior `json:"network_behavior"`
FileSystemBehavior FileSystemBehavior `json:"filesystem_behavior"`
}
BehavioralAnalysis holds behavioral analysis results.
type BehavioralAnalysisResult ¶
type BehavioralAnalysisResult struct {
BehaviorScore float64 `json:"behavior_score"`
SuspiciousBehaviors []string `json:"suspicious_behaviors"`
RiskFactors []string `json:"risk_factors"`
BehaviorPatterns []string `json:"behavior_patterns"`
AnomalousActivities []string `json:"anomalous_activities"`
Confidence float64 `json:"confidence"`
}
BehavioralAnalysisResult represents behavioral analysis results
type BehavioralAnalyzer ¶
type BehavioralAnalyzer struct {
Config BehavioralConfig
}
BehavioralAnalyzer performs behavioral analysis on packages
func NewBehavioralAnalyzer ¶
func NewBehavioralAnalyzer() *BehavioralAnalyzer
NewBehavioralAnalyzer creates a new behavioral analyzer
func (*BehavioralAnalyzer) AnalyzeBehavior ¶
func (ba *BehavioralAnalyzer) AnalyzeBehavior(pkg *types.Package) BehavioralAnalysis
AnalyzeBehavior performs behavioral analysis on a package
func (*BehavioralAnalyzer) AnalyzeBehaviorEnhanced ¶
func (ba *BehavioralAnalyzer) AnalyzeBehaviorEnhanced(ctx context.Context, features *EnhancedPackageFeatures) (*BehavioralAnalysisResult, error)
AnalyzeBehaviorEnhanced is an adapter method for the enhanced detector interface
func (*BehavioralAnalyzer) GetMetrics ¶
func (ba *BehavioralAnalyzer) GetMetrics(ctx context.Context) (map[string]interface{}, error)
GetMetrics returns metrics for the behavioral analyzer
type BehavioralConfig ¶
type BehavioralConfig struct {
InstallBehaviorWeight float64
RuntimeBehaviorWeight float64
NetworkBehaviorWeight float64
FileSystemBehaviorWeight float64
SuspiciousScoreThreshold float64
}
BehavioralConfig contains configuration for behavioral analysis
func DefaultBehavioralConfig ¶
func DefaultBehavioralConfig() BehavioralConfig
DefaultBehavioralConfig returns the default configuration
type BehavioralMetrics ¶
type BehavioralMetrics struct {
InstallationBehavior EnhancedInstallBehavior `json:"installation_behavior"`
RuntimeBehavior EnhancedRuntimeBehavior `json:"runtime_behavior"`
NetworkBehavior EnhancedNetworkBehavior `json:"network_behavior"`
FileSystemBehavior EnhancedFileSystemBehavior `json:"file_system_behavior"`
ProcessBehavior EnhancedProcessBehavior `json:"process_behavior"`
AnomalyScore float64 `json:"anomaly_score"`
}
BehavioralMetrics represents behavioral analysis metrics
type CachedFeatures ¶
type CachedFeatures struct {
Features *PackageFeatures `json:"features"`
Timestamp time.Time `json:"timestamp"`
TTL time.Duration `json:"ttl"`
HitCount int `json:"hit_count"`
Version string `json:"version"`
}
CachedFeatures represents cached package features with metadata
type CachedPrediction ¶
type CachedPrediction struct {
Result *ThreatPrediction `json:"result"`
Timestamp time.Time `json:"timestamp"`
HitCount int `json:"hit_count"`
}
CachedPrediction represents a cached prediction result
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client provides an interface to the ML service
func (*Client) BatchAnalyzePackages ¶
func (c *Client) BatchAnalyzePackages(ctx context.Context, packages []PackageToAnalyze, options AnalysisOptions) (*BatchAnalysisResponse, error)
BatchAnalyzePackages performs batch analysis of multiple packages
func (*Client) CheckMaliciousPackage ¶
func (c *Client) CheckMaliciousPackage(ctx context.Context, packageName, registry, version string) (*MaliciousResponse, error)
CheckMaliciousPackage checks if a package is malicious
func (*Client) ConvertToThreats ¶
func (c *Client) ConvertToThreats(analysisResult *PackageAnalysisResult) []types.Threat
ConvertToThreats converts ML analysis results to threats
func (*Client) FindSimilarPackages ¶
func (c *Client) FindSimilarPackages(ctx context.Context, packageName, registry string, topK int, threshold float64) (*SimilarityResponse, error)
FindSimilarPackages finds packages similar to the given package
func (*Client) GetModelInfo ¶
GetModelInfo retrieves information about a specific model
type CodeMetrics ¶
type CodeMetrics struct {
LinesOfCode int `json:"lines_of_code"`
CyclomaticComplexity float64 `json:"cyclomatic_complexity"`
CodeDuplication float64 `json:"code_duplication"`
TestCoverage float64 `json:"test_coverage"`
DocumentationRatio float64 `json:"documentation_ratio"`
ObfuscationScore float64 `json:"obfuscation_score"`
MinificationScore float64 `json:"minification_score"`
CommentRatio float64 `json:"comment_ratio"`
}
CodeMetrics represents code quality and complexity metrics
type Config ¶
type Config struct {
Enabled bool `mapstructure:"enabled"`
SimilarityThreshold float64 `mapstructure:"similarity_threshold"`
MaliciousThreshold float64 `mapstructure:"malicious_threshold"`
ReputationThreshold float64 `mapstructure:"reputation_threshold"`
ModelPath string `mapstructure:"model_path"`
BatchSize int `mapstructure:"batch_size"`
MaxFeatures int `mapstructure:"max_features"`
CacheEmbeddings bool `mapstructure:"cache_embeddings"`
ParallelProcessing bool `mapstructure:"parallel_processing"`
GPUAcceleration bool `mapstructure:"gpu_acceleration"`
}
Config holds the configuration for the ML analyzer.
type DecisionNode ¶
type DecisionNode struct {
Feature string `json:"feature"`
Threshold float64 `json:"threshold"`
Direction string `json:"direction"`
Impact float64 `json:"impact"`
}
DecisionNode represents a node in the decision path
type Dependency ¶
type Dependency struct {
Name string `json:"name"`
Version string `json:"version"`
Type string `json:"type"`
Optional bool `json:"optional"`
Dev bool `json:"dev"`
Suspicious bool `json:"suspicious"`
RiskScore float64 `json:"risk_score"`
}
Dependency represents a package dependency
type DetectionMetrics ¶
type DetectionMetrics struct {
TotalDetections int64 `json:"total_detections"`
TruePositives int64 `json:"true_positives"`
FalsePositives int64 `json:"false_positives"`
TrueNegatives int64 `json:"true_negatives"`
FalseNegatives int64 `json:"false_negatives"`
AverageConfidence float64 `json:"average_confidence"`
LastUpdated time.Time `json:"last_updated"`
}
DetectionMetrics tracks model performance for fine-tuning
type EcosystemModel ¶
type EcosystemModel struct {
Ecosystem string `json:"ecosystem"`
ModelVersion string `json:"model_version"`
ModelPath string `json:"model_path"`
FeatureWeights map[string]float64 `json:"feature_weights"`
TrainingMetrics TrainingMetrics `json:"training_metrics"`
LastTrained time.Time `json:"last_trained"`
IsActive bool `json:"is_active"`
Metadata map[string]interface{} `json:"metadata"`
}
EcosystemModel represents an ML model specific to a package ecosystem
type EnhancedAnomalyDetection ¶
type EnhancedAnomalyDetection struct {
IsAnomalous bool `json:"is_anomalous"`
AnomalyScore float64 `json:"anomaly_score"`
AnomalyType string `json:"anomaly_type"`
Confidence float64 `json:"confidence"`
AnomalousFeatures []string `json:"anomalous_features"`
BaselineDeviation float64 `json:"baseline_deviation"`
}
EnhancedAnomalyDetection represents enhanced anomaly detection results
type EnhancedFileSystemBehavior ¶
type EnhancedFileSystemBehavior struct {
FilesCreated int `json:"files_created"`
FilesModified int `json:"files_modified"`
FilesDeleted int `json:"files_deleted"`
SuspiciousLocations []string `json:"suspicious_locations"`
HiddenFiles int `json:"hidden_files"`
SystemFileAccess bool `json:"system_file_access"`
TempFileUsage int `json:"temp_file_usage"`
}
FileSystemBehavior represents file system behavior
type EnhancedInstallBehavior ¶
type EnhancedInstallBehavior struct {
PostInstallScript bool `json:"post_install_script"`
PreInstallScript bool `json:"pre_install_script"`
NetworkActivity bool `json:"network_activity"`
FileModifications int `json:"file_modifications"`
PermissionChanges int `json:"permission_changes"`
SuspiciousCommands int `json:"suspicious_commands"`
InstallationTime float64 `json:"installation_time"`
}
InstallBehavior represents installation-time behavior
type EnhancedMLConfig ¶
type EnhancedMLConfig struct {
Enabled bool `yaml:"enabled"`
SimilarityThreshold float64 `yaml:"similarity_threshold"`
MalwareThreshold float64 `yaml:"malware_threshold"`
AnomalyThreshold float64 `yaml:"anomaly_threshold"`
TypoThreshold float64 `yaml:"typo_threshold"`
ReputationThreshold float64 `yaml:"reputation_threshold"`
EnsembleWeights map[string]float64 `yaml:"ensemble_weights"`
ConfidenceThreshold float64 `yaml:"confidence_threshold"`
ModelUpdateInterval time.Duration `yaml:"model_update_interval"`
BatchSize int `yaml:"batch_size"`
MaxFeatures int `yaml:"max_features"`
ParallelProcessing bool `yaml:"parallel_processing"`
Verbose bool `yaml:"verbose"`
}
MLConfig contains ML detector configuration
func DefaultEnhancedMLConfig ¶
func DefaultEnhancedMLConfig() *EnhancedMLConfig
DefaultEnhancedMLConfig returns default enhanced ML configuration
type EnhancedMLDetector ¶
type EnhancedMLDetector struct {
// contains filtered or unexported fields
}
EnhancedMLDetector provides comprehensive ML-based threat detection
func NewEnhancedMLDetector ¶
func NewEnhancedMLDetector(config *EnhancedMLConfig) (*EnhancedMLDetector, error)
NewEnhancedMLDetector creates a new enhanced ML detector
func (*EnhancedMLDetector) AnalyzePackage ¶
func (emd *EnhancedMLDetector) AnalyzePackage(ctx context.Context, features *EnhancedPackageFeatures) (*MLDetectionResult, error)
AnalyzePackage performs comprehensive ML-based analysis of a package with enhanced detection capabilities
func (*EnhancedMLDetector) BatchAnalyze ¶
func (emd *EnhancedMLDetector) BatchAnalyze(ctx context.Context, packages []*EnhancedPackageFeatures) ([]*MLDetectionResult, error)
BatchAnalyze performs batch analysis of multiple packages
func (*EnhancedMLDetector) DetectThreatSimple ¶
func (emd *EnhancedMLDetector) DetectThreatSimple(packageName, content string) (bool, float64, error)
DetectThreatSimple provides a simplified threat detection interface for fine-tuning
func (*EnhancedMLDetector) GetMetrics ¶
func (emd *EnhancedMLDetector) GetMetrics() *DetectionMetrics
GetMetrics returns current detection metrics
func (*EnhancedMLDetector) GetModelMetrics ¶
func (emd *EnhancedMLDetector) GetModelMetrics(ctx context.Context) (map[string]interface{}, error)
GetModelMetrics returns metrics for all models
func (*EnhancedMLDetector) UpdateMetrics ¶
func (emd *EnhancedMLDetector) UpdateMetrics(correct bool, confidence float64)
UpdateMetrics updates detection metrics
func (*EnhancedMLDetector) UpdateModels ¶
func (emd *EnhancedMLDetector) UpdateModels(ctx context.Context) error
UpdateModels updates all ML models
func (*EnhancedMLDetector) UpdateParameters ¶
func (emd *EnhancedMLDetector) UpdateParameters(params map[string]interface{}) error
UpdateParameters updates model parameters for fine-tuning
type EnhancedMLEngine ¶
type EnhancedMLEngine struct {
// contains filtered or unexported fields
}
EnhancedMLEngine provides advanced ML capabilities
func NewEnhancedMLEngine ¶
func NewEnhancedMLEngine(client *Client, config *MLConfig) *EnhancedMLEngine
NewEnhancedMLEngine creates a new enhanced ML engine
func (*EnhancedMLEngine) AnalyzePackage ¶
func (e *EnhancedMLEngine) AnalyzePackage(ctx context.Context, packageName, registry string) (*MLAnalysisResult, error)
AnalyzePackage performs comprehensive ML analysis of a package
type EnhancedNetworkBehavior ¶
type EnhancedNetworkBehavior struct {
OutboundConnections int `json:"outbound_connections"`
InboundConnections int `json:"inbound_connections"`
SuspiciousHosts []string `json:"suspicious_hosts"`
UnusualPorts []int `json:"unusual_ports"`
DataExfiltration bool `json:"data_exfiltration"`
C2Communication bool `json:"c2_communication"`
DNSTunneling bool `json:"dns_tunneling"`
}
NetworkBehavior represents network-related behavior
type EnhancedPackageFeatures ¶
type EnhancedPackageFeatures struct {
Name string `json:"name"`
Registry string `json:"registry"`
Version string `json:"version"`
Description string `json:"description"`
Author string `json:"author"`
Maintainers []string `json:"maintainers"`
Keywords []string `json:"keywords"`
License string `json:"license"`
Homepage string `json:"homepage"`
Repository string `json:"repository"`
Downloads int64 `json:"downloads"`
Stars int `json:"stars"`
Forks int `json:"forks"`
Issues int `json:"issues"`
CreationDate time.Time `json:"creation_date"`
LastUpdated time.Time `json:"last_updated"`
Dependencies []Dependency `json:"dependencies"`
DevDependencies []Dependency `json:"dev_dependencies"`
Scripts map[string]string `json:"scripts"`
FileStructure FileStructure `json:"file_structure"`
CodeMetrics CodeMetrics `json:"code_metrics"`
SecurityMetrics SecurityMetrics `json:"security_metrics"`
BehavioralMetrics BehavioralMetrics `json:"behavioral_metrics"`
Metadata map[string]interface{} `json:"metadata"`
}
EnhancedPackageFeatures represents enhanced package features for ML analysis
type EnhancedProcessBehavior ¶
type EnhancedProcessBehavior struct {
ChildProcesses int `json:"child_processes"`
PrivilegeEscalation bool `json:"privilege_escalation"`
CodeInjection bool `json:"code_injection"`
Hollowing bool `json:"hollowing"`
DLLInjection bool `json:"dll_injection"`
SuspiciousCommands []string `json:"suspicious_commands"`
}
ProcessBehavior represents process-related behavior
type EnhancedReputationAnalysis ¶
type EnhancedReputationAnalysis struct {
ReputationScore float64 `json:"reputation_score"`
TrustLevel string `json:"trust_level"`
AuthorReputation float64 `json:"author_reputation"`
MaintainerReputation float64 `json:"maintainer_reputation"`
CommunityTrust float64 `json:"community_trust"`
HistoricalIssues []string `json:"historical_issues"`
VerificationStatus string `json:"verification_status"`
}
EnhancedReputationAnalysis represents enhanced reputation analysis results
type EnhancedRuntimeBehavior ¶
type EnhancedRuntimeBehavior struct {
CPUUsage float64 `json:"cpu_usage"`
MemoryUsage float64 `json:"memory_usage"`
NetworkConnections int `json:"network_connections"`
FileOperations int `json:"file_operations"`
ProcessSpawning int `json:"process_spawning"`
AntiAnalysisTechniques bool `json:"anti_analysis_techniques"`
PersistenceMechanisms bool `json:"persistence_mechanisms"`
}
RuntimeBehavior represents runtime behavior
type EnhancedSimilarityResult ¶
type EnhancedSimilarityResult struct {
SimilarPackage string `json:"similar_package"`
SimilarityScore float64 `json:"similarity_score"`
SimilarityType string `json:"similarity_type"`
Confidence float64 `json:"confidence"`
Reason string `json:"reason"`
}
EnhancedSimilarityResult represents enhanced similarity analysis results
type EnsembleManager ¶
type EnsembleManager struct {
// contains filtered or unexported fields
}
EnsembleManager manages multiple models for ensemble predictions
func NewEnsembleManager ¶
func NewEnsembleManager(models []*PredictionModel, weights map[string]float64, votingType VotingType) *EnsembleManager
NewEnsembleManager creates a new ensemble manager
func (*EnsembleManager) Predict ¶
func (em *EnsembleManager) Predict(features *FeatureVector) (*ThreatPrediction, error)
Predict performs ensemble prediction
type EnsembleModel ¶
type EnsembleModel struct{}
func NewEnsembleModel ¶
func NewEnsembleModel(weights map[string]float64) (*EnsembleModel, error)
func (*EnsembleModel) CombineResults ¶
func (em *EnsembleModel) CombineResults(ctx context.Context, result *MLDetectionResult) (*EnsembleResults, error)
func (*EnsembleModel) GetMetrics ¶
func (em *EnsembleModel) GetMetrics(ctx context.Context) (map[string]interface{}, error)
type EnsembleResults ¶
type EnsembleResults struct {
FinalScore float64 `json:"final_score"`
ModelScores map[string]float64 `json:"model_scores"`
ModelWeights map[string]float64 `json:"model_weights"`
ConsensusLevel float64 `json:"consensus_level"`
DisagreementFactors []string `json:"disagreement_factors"`
Confidence float64 `json:"confidence"`
}
EnsembleResults represents ensemble model results
type FeatureContribution ¶
type FeatureContribution struct {
FeatureName string `json:"feature_name"`
Contribution float64 `json:"contribution"`
Value float64 `json:"value"`
}
FeatureContribution represents feature importance in prediction
type FeatureDefinition ¶
type FeatureDefinition struct {
Name string `json:"name"`
Type FeatureType `json:"type"`
Description string `json:"description"`
Extractor func(interface{}) float64
Weight float64 `json:"weight"`
Normalize bool `json:"normalize"`
}
FeatureDefinition defines how to extract a feature
type FeatureDriftDetector ¶
type FeatureDriftDetector struct {
// contains filtered or unexported fields
}
FeatureDriftDetector monitors feature distribution changes
func NewFeatureDriftDetector ¶
func NewFeatureDriftDetector(driftThreshold float64, windowSize int) *FeatureDriftDetector
NewFeatureDriftDetector creates a new feature drift detector
func (*FeatureDriftDetector) DetectDrift ¶
func (fdd *FeatureDriftDetector) DetectDrift(features map[string]float64) map[string]bool
DetectDrift detects feature drift
func (*FeatureDriftDetector) UpdateBaseline ¶
func (fdd *FeatureDriftDetector) UpdateBaseline(features map[string]float64)
UpdateBaseline updates the baseline statistics
type FeatureExtractor ¶
type FeatureExtractor interface {
ExtractFeatures(pkg *types.Package) (*PackageFeatures, error)
GetFeatureNames() []string
NormalizeFeatures(features *PackageFeatures) []float64
}
FeatureExtractor extracts features from packages for ML analysis
type FeatureImportance ¶
type FeatureImportance struct {
Feature string `json:"feature"`
Importance float64 `json:"importance"`
Value float64 `json:"value"`
Impact string `json:"impact"` // positive, negative, neutral
}
FeatureImportance represents feature importance in prediction
type FeatureStats ¶
FeatureStats holds statistics for feature normalization
type FeatureStore ¶
type FeatureStore struct {
// contains filtered or unexported fields
}
FeatureStore manages cached package features for ML analysis
func NewFeatureStore ¶
func NewFeatureStore(config *MLConfig) *FeatureStore
NewFeatureStore creates a new feature store
func (*FeatureStore) CleanupExpired ¶
func (fs *FeatureStore) CleanupExpired() int
CleanupExpired removes expired entries from the cache
func (*FeatureStore) Close ¶
func (fs *FeatureStore) Close()
Close stops the feature store and cleanup routines
func (*FeatureStore) ExportFeatures ¶
func (fs *FeatureStore) ExportFeatures() ([]byte, error)
ExportFeatures exports cached features to JSON
func (*FeatureStore) GetFeatures ¶
func (fs *FeatureStore) GetFeatures(packageName, registry string) *PackageFeatures
GetFeatures retrieves cached features for a package
func (*FeatureStore) GetStats ¶
func (fs *FeatureStore) GetStats() *FeatureStoreStats
GetStats returns feature store statistics
func (*FeatureStore) GetTopPackages ¶
func (fs *FeatureStore) GetTopPackages(limit int) []PackageAccessInfo
GetTopPackages returns most frequently accessed packages
func (*FeatureStore) ImportFeatures ¶
func (fs *FeatureStore) ImportFeatures(data []byte) error
ImportFeatures imports cached features from JSON
func (*FeatureStore) InvalidateAll ¶
func (fs *FeatureStore) InvalidateAll()
InvalidateAll clears all cached features
func (*FeatureStore) InvalidateFeatures ¶
func (fs *FeatureStore) InvalidateFeatures(packageName, registry string)
InvalidateFeatures removes cached features for a package
func (*FeatureStore) StoreFeatures ¶
func (fs *FeatureStore) StoreFeatures(features *PackageFeatures)
StoreFeatures stores package features in the cache
type FeatureStoreManager ¶
type FeatureStoreManager struct {
// contains filtered or unexported fields
}
FeatureStoreManager manages multiple feature stores
func NewFeatureStoreManager ¶
func NewFeatureStoreManager() *FeatureStoreManager
NewFeatureStoreManager creates a new feature store manager
func (*FeatureStoreManager) CloseAll ¶
func (fsm *FeatureStoreManager) CloseAll()
CloseAll closes all feature stores
func (*FeatureStoreManager) GetAggregatedStats ¶
func (fsm *FeatureStoreManager) GetAggregatedStats() *AggregatedFeatureStoreStats
GetAggregatedStats returns aggregated statistics across all stores
func (*FeatureStoreManager) GetAllStores ¶
func (fsm *FeatureStoreManager) GetAllStores() map[string]*FeatureStore
GetAllStores returns all feature stores
func (*FeatureStoreManager) GetStore ¶
func (fsm *FeatureStoreManager) GetStore(registry string, config *MLConfig) *FeatureStore
GetStore returns a feature store for a specific registry
type FeatureStoreStats ¶
type FeatureStoreStats struct {
TotalEntries int `json:"total_entries"`
CacheHits int64 `json:"cache_hits"`
CacheMisses int64 `json:"cache_misses"`
HitRatio float64 `json:"hit_ratio"`
AverageAge time.Duration `json:"average_age"`
OldestEntry time.Time `json:"oldest_entry"`
NewestEntry time.Time `json:"newest_entry"`
MemoryUsage int64 `json:"memory_usage_bytes"`
CleanupCount int64 `json:"cleanup_count"`
LastCleanup time.Time `json:"last_cleanup"`
}
FeatureStoreStats represents feature store statistics
type FeatureType ¶
type FeatureType string
FeatureType represents the type of feature
const ( FeatureTypeNumerical FeatureType = "numerical" FeatureTypeCategorical FeatureType = "categorical" FeatureTypeBoolean FeatureType = "boolean" FeatureTypeText FeatureType = "text" FeatureTypeTemporal FeatureType = "temporal" )
type FeatureVector ¶
type FeatureVector struct {
PackageID string `json:"package_id"`
Features map[string]float64 `json:"features"`
ExtractedAt time.Time `json:"extracted_at"`
Version string `json:"version"`
}
FeatureVector represents extracted features
type FeedbackData ¶
type FeedbackData struct {
FeedbackEntries []FeedbackEntry `json:"feedback_entries"`
LastUpdated time.Time `json:"last_updated"`
TotalEntries int `json:"total_entries"`
FalsePositives int `json:"false_positives"`
FalseNegatives int `json:"false_negatives"`
TruePositives int `json:"true_positives"`
TrueNegatives int `json:"true_negatives"`
}
FeedbackData stores feedback information for continuous learning
type FeedbackEntry ¶
type FeedbackEntry struct {
PackageName string `json:"package_name"`
Version string `json:"version"`
PredictedLabel string `json:"predicted_label"`
ActualLabel string `json:"actual_label"`
ConfidenceScore float64 `json:"confidence_score"`
FeedbackSource string `json:"feedback_source"`
Timestamp time.Time `json:"timestamp"`
Features map[string]float64 `json:"features,omitempty"`
}
FeedbackEntry represents a single feedback entry
type FeedbackLoop ¶
type FeedbackLoop struct {
FeedbackDir string
FeedbackFile string
FeedbackData FeedbackData
LearningEnabled bool
// contains filtered or unexported fields
}
FeedbackLoop implements a continuous learning system through user feedback
func NewFeedbackLoop ¶
func NewFeedbackLoop(feedbackDir string) (*FeedbackLoop, error)
NewFeedbackLoop creates a new feedback loop
func (*FeedbackLoop) AddFeedback ¶
func (fl *FeedbackLoop) AddFeedback(pkg *types.Package, predictedLabel, actualLabel string, confidenceScore float64, feedbackSource string, features map[string]float64) error
AddFeedback adds a new feedback entry
func (*FeedbackLoop) DisableLearning ¶
func (fl *FeedbackLoop) DisableLearning()
DisableLearning disables continuous learning
func (*FeedbackLoop) EnableLearning ¶
func (fl *FeedbackLoop) EnableLearning()
EnableLearning enables continuous learning
func (*FeedbackLoop) ExportFeedbackData ¶
func (fl *FeedbackLoop) ExportFeedbackData(exportFile string) error
ExportFeedbackData exports feedback data to a JSON file
func (*FeedbackLoop) GetFeedbackByDate ¶
func (fl *FeedbackLoop) GetFeedbackByDate(startDate, endDate time.Time) []FeedbackEntry
GetFeedbackByDate gets feedback entries within a date range
func (*FeedbackLoop) GetFeedbackForPackage ¶
func (fl *FeedbackLoop) GetFeedbackForPackage(packageName string) []FeedbackEntry
GetFeedbackForPackage gets all feedback entries for a specific package
func (*FeedbackLoop) GetFeedbackStats ¶
func (fl *FeedbackLoop) GetFeedbackStats() map[string]interface{}
GetFeedbackStats returns statistics about the feedback data
func (*FeedbackLoop) GetRecentFeedback ¶
func (fl *FeedbackLoop) GetRecentFeedback(limit int) []FeedbackEntry
GetRecentFeedback returns the most recent feedback entries
func (*FeedbackLoop) ImportFeedbackData ¶
func (fl *FeedbackLoop) ImportFeedbackData(importFile string) error
ImportFeedbackData imports feedback data from a JSON file
type FileStructure ¶
type FileStructure struct {
TotalFiles int `json:"total_files"`
JavaScriptFiles int `json:"javascript_files"`
TypeScriptFiles int `json:"typescript_files"`
ConfigFiles int `json:"config_files"`
TestFiles int `json:"test_files"`
DocumentationFiles int `json:"documentation_files"`
BinaryFiles int `json:"binary_files"`
HiddenFiles int `json:"hidden_files"`
SuspiciousFiles []string `json:"suspicious_files"`
LargeFiles []string `json:"large_files"`
UnusualExtensions []string `json:"unusual_extensions"`
}
FileStructure represents package file structure metrics
type FileSystemBehavior ¶
type FileSystemBehavior struct {
FileCreation []string `json:"file_creation"`
FileDeletion []string `json:"file_deletion"`
FileModification []string `json:"file_modification"`
DirectoryAccess []string `json:"directory_access"`
}
FileSystemBehavior holds file system behavior analysis.
type Finding ¶
type Finding struct {
Type string `json:"type"`
Severity string `json:"severity"`
Confidence float64 `json:"confidence"`
Description string `json:"description"`
Evidence string `json:"evidence"`
Model string `json:"model"`
}
Finding represents a specific ML finding.
type InstallBehavior ¶
type InstallBehavior struct {
SuspiciousCommands []string `json:"suspicious_commands"`
NetworkRequests []string `json:"network_requests"`
FileModifications []string `json:"file_modifications"`
PermissionChanges []string `json:"permission_changes"`
}
InstallBehavior holds install-time behavior analysis.
type MLAnalysisResult ¶
type MLAnalysisResult struct {
PackageName string `json:"package_name"`
Registry string `json:"registry"`
AnalysisTimestamp time.Time `json:"analysis_timestamp"`
// Feature analysis
Features PackageFeatures `json:"features"`
// Similarity analysis
SimilarPackages []SimilarPackage `json:"similar_packages"`
TyposquattingRisk float64 `json:"typosquatting_risk"`
// Malicious detection
MaliciousScore float64 `json:"malicious_score"`
MaliciousIndicators []MaliciousIndicator `json:"malicious_indicators"`
// Reputation scoring
ReputationScore float64 `json:"reputation_score"`
ReputationFactors []ReputationFactor `json:"reputation_factors"`
// Overall assessment
RiskLevel string `json:"risk_level"`
Confidence float64 `json:"confidence"`
Recommendation string `json:"recommendation"`
Warnings []string `json:"warnings"`
// Model information
ModelVersions map[string]string `json:"model_versions"`
ProcessingTime time.Duration `json:"processing_time"`
}
MLAnalysisResult represents comprehensive ML analysis results
type MLAnalyzer ¶
type MLAnalyzer struct {
Config config.MLAnalysisConfig
Client *Client
BehavioralAnalyzer *BehavioralAnalyzer
FeedbackLoop *FeedbackLoop
}
MLAnalyzer performs machine learning-based analysis for typosquatting detection.
func NewMLAnalyzer ¶
func NewMLAnalyzer(cfg config.MLAnalysisConfig) *MLAnalyzer
NewMLAnalyzer creates a new instance of the MLAnalyzer.
func NewMLAnalyzerWithClient ¶
func NewMLAnalyzerWithClient(cfg config.MLAnalysisConfig, client *Client) *MLAnalyzer
NewMLAnalyzerWithClient creates a new ML analyzer with a specific client
func (*MLAnalyzer) Analyze ¶
func (a *MLAnalyzer) Analyze(ctx context.Context, pkg *types.Package) (*AnalysisResult, error)
Analyze performs ML-based analysis on a package.
func (*MLAnalyzer) DisableLearning ¶
func (a *MLAnalyzer) DisableLearning()
DisableLearning disables continuous learning
func (*MLAnalyzer) EnableLearning ¶
func (a *MLAnalyzer) EnableLearning()
EnableLearning enables continuous learning
func (*MLAnalyzer) GetFeedbackStats ¶
func (a *MLAnalyzer) GetFeedbackStats() map[string]interface{}
GetFeedbackStats returns statistics about the feedback system
func (*MLAnalyzer) ProvideFeedback ¶
func (a *MLAnalyzer) ProvideFeedback(pkg *types.Package, predictedLabel, actualLabel string, confidenceScore float64, feedbackSource string) error
ProvideFeedback allows users to provide feedback on analysis results for continuous learning
type MLConfig ¶
type MLConfig struct {
EmbeddingModel string `yaml:"embedding_model"`
MaliciousModel string `yaml:"malicious_model"`
ReputationModel string `yaml:"reputation_model"`
SimilarityThreshold float64 `yaml:"similarity_threshold"`
MaliciousThreshold float64 `yaml:"malicious_threshold"`
ReputationThreshold float64 `yaml:"reputation_threshold"`
FeatureStoreEnabled bool `yaml:"feature_store_enabled"`
FeatureStoreTTL string `yaml:"feature_store_ttl"`
BatchSize int `yaml:"batch_size"`
MaxRetries int `yaml:"max_retries"`
Timeout string `yaml:"timeout"`
}
MLConfig contains ML engine configuration
func DefaultMLConfig ¶
func DefaultMLConfig() *MLConfig
DefaultMLConfig returns default ML configuration
type MLDetectionResult ¶
type MLDetectionResult struct {
PackageName string `json:"package_name"`
Registry string `json:"registry"`
AnalysisTimestamp time.Time `json:"analysis_timestamp"`
OverallRiskScore float64 `json:"overall_risk_score"`
ConfidenceScore float64 `json:"confidence_score"`
ThreatLevel string `json:"threat_level"`
IsMalicious bool `json:"is_malicious"`
IsTyposquatting bool `json:"is_typosquatting"`
IsAnomalous bool `json:"is_anomalous"`
SimilarityResults []EnhancedSimilarityResult `json:"similarity_results"`
MalwareClassification MalwareClassification `json:"malware_classification"`
AnomalyDetection EnhancedAnomalyDetection `json:"anomaly_detection"`
TypoDetection TypoDetection `json:"typo_detection"`
ReputationAnalysis EnhancedReputationAnalysis `json:"reputation_analysis"`
BehavioralAnalysis BehavioralAnalysisResult `json:"behavioral_analysis"`
EnsembleResults EnsembleResults `json:"ensemble_results"`
Recommendations []string `json:"recommendations"`
Metadata map[string]interface{} `json:"metadata"`
}
MLDetectionResult represents the result of ML-based detection
type MLModel ¶
type MLModel interface {
Predict(features []float64) (*Prediction, error)
Train(data []TrainingData) error
GetModelInfo() *ModelInfo
IsReady() bool
}
MLModel represents a machine learning model interface
type MLPipeline ¶
type MLPipeline struct {
// contains filtered or unexported fields
}
MLPipeline represents the machine learning pipeline for threat detection
func NewMLPipeline ¶
func NewMLPipeline(config *config.Config) *MLPipeline
NewMLPipeline creates a new ML pipeline instance
func (*MLPipeline) AnalyzePackage ¶
func (p *MLPipeline) AnalyzePackage(ctx context.Context, pkg *types.Package) (*Prediction, error)
AnalyzePackage performs comprehensive ML analysis on a package
func (*MLPipeline) AnalyzePackages ¶
func (p *MLPipeline) AnalyzePackages(ctx context.Context, packages []*types.Package) ([]*Prediction, error)
AnalyzePackages performs batch analysis on multiple packages
func (*MLPipeline) GetModelInfo ¶
func (p *MLPipeline) GetModelInfo() map[string]*ModelInfo
GetModelInfo returns information about loaded models
func (*MLPipeline) GetModels ¶
func (p *MLPipeline) GetModels() map[string]MLModel
GetModels returns the models for training purposes
func (*MLPipeline) GetStats ¶
func (p *MLPipeline) GetStats() map[string]interface{}
GetStats returns pipeline statistics
func (*MLPipeline) Initialize ¶
func (p *MLPipeline) Initialize(ctx context.Context) error
Initialize initializes the ML pipeline with models and configurations
func (*MLPipeline) IsReady ¶
func (p *MLPipeline) IsReady() bool
IsReady returns whether the ML pipeline is ready for analysis
func (*MLPipeline) UpdateModel ¶
func (p *MLPipeline) UpdateModel(name string, model MLModel) error
UpdateModel updates or adds a new model to the pipeline
type MLScore ¶
type MLScore struct {
MaliciousScore float64
Confidence float64
RiskLevel string
Features BasicPackageFeatures
ContributingFactors []string
Recommendation string
Timestamp time.Time
}
MLScore represents the output of the ML scoring algorithm
type MaliciousIndicator ¶
type MaliciousIndicator struct {
Type string `json:"type"`
Description string `json:"description"`
Severity string `json:"severity"`
Confidence float64 `json:"confidence"`
Evidence string `json:"evidence"`
}
MaliciousIndicator represents indicators of malicious behavior
type MaliciousRequest ¶
type MaliciousRequest struct {
PackageName string `json:"package_name"`
Registry string `json:"registry"`
Version string `json:"version,omitempty"`
Features map[string]interface{} `json:"features,omitempty"`
}
MaliciousRequest represents a request to check if a package is malicious
type MaliciousResponse ¶
type MaliciousResponse struct {
IsMalicious bool `json:"is_malicious"`
Score float64 `json:"score"`
Confidence float64 `json:"confidence"`
Reasons []string `json:"reasons"`
Features map[string]interface{} `json:"features"`
Model string `json:"model"`
Time float64 `json:"time_ms"`
}
MaliciousResponse represents a response from the malicious detection service
type MalwareClassification ¶
type MalwareClassification struct {
IsMalware bool `json:"is_malware"`
MalwareType string `json:"malware_type"`
MalwareFamily string `json:"malware_family"`
Confidence float64 `json:"confidence"`
FeatureImportance map[string]float64 `json:"feature_importance"`
ClassificationReason string `json:"classification_reason"`
}
MalwareClassification represents malware classification results
type MalwareClassifier ¶
type MalwareClassifier struct{}
func NewMalwareClassifier ¶
func NewMalwareClassifier() (*MalwareClassifier, error)
func (*MalwareClassifier) ClassifyMalware ¶
func (mc *MalwareClassifier) ClassifyMalware(ctx context.Context, features *EnhancedPackageFeatures) (*MalwareClassification, error)
func (*MalwareClassifier) GetMetrics ¶
func (mc *MalwareClassifier) GetMetrics(ctx context.Context) (map[string]interface{}, error)
type MetadataFeatures ¶
type MetadataFeatures struct {
HasDescription bool `json:"has_description"`
DescriptionLength int `json:"description_length"`
DescriptionQuality float64 `json:"description_quality"`
HasHomepage bool `json:"has_homepage"`
HasRepository bool `json:"has_repository"`
HasLicense bool `json:"has_license"`
LicenseType string `json:"license_type"`
HasKeywords bool `json:"has_keywords"`
KeywordCount int `json:"keyword_count"`
VersionCount int `json:"version_count"`
LatestVersion string `json:"latest_version"`
VersionPattern string `json:"version_pattern"`
UnusualVersionJump bool `json:"unusual_version_jump"`
PublicationRecency int `json:"publication_recency_days"`
}
MetadataFeatures contains package metadata features
type ModelExplainer ¶
type ModelExplainer struct {
// contains filtered or unexported fields
}
ModelExplainer provides model interpretability
func NewModelExplainer ¶
func NewModelExplainer() *ModelExplainer
NewModelExplainer creates a new model explainer
func (*ModelExplainer) ExplainPrediction ¶
func (me *ModelExplainer) ExplainPrediction(features *FeatureVector, prediction *ThreatPrediction) *PredictionExplanation
ExplainPrediction generates explanation for a prediction
func (*ModelExplainer) UpdateFeatureImportance ¶
func (me *ModelExplainer) UpdateFeatureImportance(importance map[string]float64)
UpdateFeatureImportance updates feature importance scores
type ModelInfo ¶
type ModelInfo struct {
Name string `json:"name"`
Version string `json:"version"`
Description string `json:"description"`
Type string `json:"type"`
TrainedAt time.Time `json:"trained_at"`
Accuracy float64 `json:"accuracy"`
Precision float64 `json:"precision"`
Recall float64 `json:"recall"`
F1Score float64 `json:"f1_score"`
FeatureCount int `json:"feature_count"`
Metadata map[string]interface{} `json:"metadata"`
}
ModelInfo contains information about an ML model
type ModelMetrics ¶
type ModelMetrics struct {
Accuracy float64 `json:"accuracy"`
Precision float64 `json:"precision"`
Recall float64 `json:"recall"`
F1Score float64 `json:"f1_score"`
Status ModelStatus `json:"status"`
TrainedAt time.Time `json:"trained_at"`
}
ModelMetrics represents model performance metrics
type ModelPerformanceMonitor ¶
type ModelPerformanceMonitor struct {
// contains filtered or unexported fields
}
ModelPerformanceMonitor tracks model performance metrics
func NewModelPerformanceMonitor ¶
func NewModelPerformanceMonitor(monitoringInterval time.Duration) *ModelPerformanceMonitor
NewModelPerformanceMonitor creates a new performance monitor
func (*ModelPerformanceMonitor) GetAlerts ¶
func (mpm *ModelPerformanceMonitor) GetAlerts() []PerformanceAlert
GetAlerts returns current alerts
func (*ModelPerformanceMonitor) GetMetrics ¶
func (mpm *ModelPerformanceMonitor) GetMetrics(modelID string) *PerformanceMetrics
GetMetrics returns performance metrics for a model
func (*ModelPerformanceMonitor) SetThreshold ¶
func (mpm *ModelPerformanceMonitor) SetThreshold(metric string, threshold float64)
SetThreshold sets a performance threshold
func (*ModelPerformanceMonitor) UpdateMetrics ¶
func (mpm *ModelPerformanceMonitor) UpdateMetrics(modelID string, metrics *PerformanceMetrics)
UpdateMetrics updates performance metrics for a model
type ModelStatus ¶
type ModelStatus string
ModelStatus represents the status of a model
const ( ModelStatusTraining ModelStatus = "training" ModelStatusReady ModelStatus = "ready" ModelStatusDeprecated ModelStatus = "deprecated" ModelStatusFailed ModelStatus = "failed" )
type NetworkBehavior ¶
type NetworkBehavior struct {
OutboundConnections []string `json:"outbound_connections"`
DNSQueries []string `json:"dns_queries"`
DataExfiltration []string `json:"data_exfiltration"`
C2Communication []string `json:"c2_communication"`
}
NetworkBehavior holds network behavior analysis.
type NormalizationParams ¶
type NormalizationParams struct {
Means []float64 `json:"means"`
StdDevs []float64 `json:"std_devs"`
Mins []float64 `json:"mins"`
Maxs []float64 `json:"maxs"`
}
NormalizationParams contains parameters for feature normalization
type OutlierAnalysis ¶
type OutlierAnalysis struct {
IsOutlier bool `json:"is_outlier"`
OutlierScore float64 `json:"outlier_score"`
IsolationForest float64 `json:"isolation_forest"`
LocalOutlier float64 `json:"local_outlier"`
OneClassSVM float64 `json:"one_class_svm"`
}
OutlierAnalysis holds outlier detection results.
type PackageAccessInfo ¶
type PackageAccessInfo struct {
PackageName string `json:"package_name"`
Registry string `json:"registry"`
HitCount int `json:"hit_count"`
LastAccess time.Time `json:"last_access"`
CacheAge time.Duration `json:"cache_age"`
}
PackageAccessInfo represents package access information
type PackageAnalysisResult ¶
type PackageAnalysisResult struct {
Package PackageToAnalyze `json:"package"`
Similarities []SimilarityResult `json:"similarities,omitempty"`
MaliciousCheck *MaliciousResponse `json:"malicious_check,omitempty"`
Threats []types.Threat `json:"threats,omitempty"`
Errors []string `json:"errors,omitempty"`
}
PackageAnalysisResult represents the analysis result for a single package
type PackageFeatures ¶
type PackageFeatures struct {
PackageName string `json:"package_name"`
Registry string `json:"registry"`
Version string `json:"version,omitempty"`
PackageType string `json:"package_type,omitempty"`
// Name-based features
NameEmbedding []float64 `json:"name_embedding"`
NameLength int `json:"name_length"`
NameComplexity float64 `json:"name_complexity"`
NameEntropy float64 `json:"name_entropy"`
// Direct access fields for compatibility
VersionComplexity float64 `json:"version_complexity"`
DescriptionLength int `json:"description_length"`
DependencyCount int `json:"dependency_count"`
DownloadCount int64 `json:"download_count"`
StarCount int `json:"star_count"`
ForkCount int `json:"fork_count"`
ContributorCount int `json:"contributor_count"`
AgeInDays int `json:"age_in_days"`
TyposquattingScore float64 `json:"typosquatting_score"`
SuspiciousKeywords int `json:"suspicious_keywords"`
VersionSpoofing float64 `json:"version_spoofing"`
DomainReputation float64 `json:"domain_reputation"`
UpdateFrequency float64 `json:"update_frequency"`
MaintainerCount int `json:"maintainer_count"`
IssueCount int `json:"issue_count"`
LicenseScore float64 `json:"license_score"`
// Author features
AuthorFeatures AuthorFeatures `json:"author_features"`
// Package metadata features
MetadataFeatures MetadataFeatures `json:"metadata_features"`
// Repository features
RepositoryFeatures RepositoryFeatures `json:"repository_features"`
// Download and popularity features
PopularityFeatures PopularityFeatures `json:"popularity_features"`
// Security features
SecurityFeatures SecurityFeatures `json:"security_features"`
// Computed scores
MaliciousScore float64 `json:"malicious_score"`
ReputationScore float64 `json:"reputation_score"`
OverallRisk float64 `json:"overall_risk"`
// Metadata
Timestamp time.Time `json:"timestamp"`
ModelVersions map[string]string `json:"model_versions"`
FeatureVersion string `json:"feature_version"`
}
PackageFeatures represents comprehensive package features
type PackageToAnalyze ¶
type PackageToAnalyze struct {
Name string `json:"name"`
Registry string `json:"registry"`
Version string `json:"version,omitempty"`
}
PackageToAnalyze represents a package to analyze
type PatternAnalysis ¶
type PatternAnalysis struct {
UnusualPatterns []string `json:"unusual_patterns"`
PatternScore float64 `json:"pattern_score"`
FrequencyScore float64 `json:"frequency_score"`
SequenceScore float64 `json:"sequence_score"`
}
PatternAnalysis holds pattern analysis results.
type PerformanceAlert ¶
type PerformanceAlert struct {
ModelID string `json:"model_id"`
Metric string `json:"metric"`
Value float64 `json:"value"`
Threshold float64 `json:"threshold"`
Timestamp time.Time `json:"timestamp"`
Severity AlertSeverity `json:"severity"`
}
PerformanceAlert represents a performance degradation alert
type PerformanceMetrics ¶
type PerformanceMetrics struct {
Accuracy float64 `json:"accuracy"`
Precision float64 `json:"precision"`
Recall float64 `json:"recall"`
F1Score float64 `json:"f1_score"`
Latency time.Duration `json:"latency"`
Throughput float64 `json:"throughput"`
Timestamp time.Time `json:"timestamp"`
}
PerformanceMetrics contains model performance data
type PerformanceStats ¶
type PerformanceStats struct {
Ecosystem string `json:"ecosystem"`
TruePositives int `json:"true_positives"`
FalsePositives int `json:"false_positives"`
TrueNegatives int `json:"true_negatives"`
FalseNegatives int `json:"false_negatives"`
Precision float64 `json:"precision"`
Recall float64 `json:"recall"`
F1Score float64 `json:"f1_score"`
Accuracy float64 `json:"accuracy"`
LastCalculated time.Time `json:"last_calculated"`
}
PerformanceStats tracks model performance metrics
type PopularityFeatures ¶
type PopularityFeatures struct {
TotalDownloads int64 `json:"total_downloads"`
WeeklyDownloads int64 `json:"weekly_downloads"`
MonthlyDownloads int64 `json:"monthly_downloads"`
DownloadTrend string `json:"download_trend"`
DownloadVelocity float64 `json:"download_velocity"`
PopularityRank int `json:"popularity_rank"`
DependentPackages int `json:"dependent_packages"`
DependencyRank int `json:"dependency_rank"`
CommunityScore float64 `json:"community_score"`
MaintenanceScore float64 `json:"maintenance_score"`
}
PopularityFeatures contains popularity and download features
type Prediction ¶
type Prediction struct {
Model string `json:"model"`
Probability float64 `json:"probability"`
Label string `json:"label"`
Confidence float64 `json:"confidence"`
}
Prediction represents a model prediction.
type PredictionCache ¶
type PredictionCache struct {
// contains filtered or unexported fields
}
PredictionCache caches prediction results for performance
func NewPredictionCache ¶
func NewPredictionCache(ttl time.Duration, maxSize int) *PredictionCache
NewPredictionCache creates a new prediction cache
func (*PredictionCache) Get ¶
func (pc *PredictionCache) Get(key string) (*ThreatPrediction, bool)
Get retrieves a cached prediction
func (*PredictionCache) GetStats ¶
func (pc *PredictionCache) GetStats() (hitRate float64, size int)
GetStats returns cache statistics
func (*PredictionCache) Set ¶
func (pc *PredictionCache) Set(key string, prediction *ThreatPrediction)
Set stores a prediction in cache
type PredictionExplanation ¶
type PredictionExplanation struct {
TopFeatures []FeatureContribution `json:"top_features"`
ShapValues map[string]float64 `json:"shap_values"`
DecisionPath []DecisionNode `json:"decision_path"`
ConfidenceFactors []string `json:"confidence_factors"`
}
PredictionExplanation provides interpretability for predictions
type PredictionMetrics ¶
type PredictionMetrics struct {
// contains filtered or unexported fields
}
PredictionMetrics tracks prediction performance
func NewPredictionMetrics ¶
func NewPredictionMetrics() *PredictionMetrics
type PredictionModel ¶
type PredictionModel struct {
ID string `json:"id"`
Name string `json:"name"`
Type ModelType `json:"type"`
Version string `json:"version"`
Accuracy float64 `json:"accuracy"`
Precision float64 `json:"precision"`
Recall float64 `json:"recall"`
F1Score float64 `json:"f1_score"`
TrainedAt time.Time `json:"trained_at"`
Features []string `json:"features"`
Weights map[string]float64 `json:"weights"`
Thresholds map[string]float64 `json:"thresholds"`
Hyperparameters map[string]interface{} `json:"hyperparameters"`
Status ModelStatus `json:"status"`
}
PredictionModel represents a trained ML model for threat prediction
type PredictorConfig ¶
type PredictorConfig struct {
ModelsEnabled []ModelType `json:"models_enabled"`
RetrainingInterval time.Duration `json:"retraining_interval"`
MinTrainingSamples int `json:"min_training_samples"`
ValidationSplit float64 `json:"validation_split"`
FeatureSelection bool `json:"feature_selection"`
EnsembleWeights map[string]float64 `json:"ensemble_weights"`
Thresholds map[string]float64 `json:"thresholds"`
CacheEnabled bool `json:"cache_enabled"`
CacheTTL time.Duration `json:"cache_ttl"`
MetricsEnabled bool `json:"metrics_enabled"`
}
PredictorConfig configures the threat predictor
type RealtimeLearner ¶
type RealtimeLearner struct {
// contains filtered or unexported fields
}
RealtimeLearner enables continuous learning from new data
func NewRealtimeLearner ¶
func NewRealtimeLearner(bufferSize int, updateInterval time.Duration) *RealtimeLearner
NewRealtimeLearner creates a new realtime learner
func (*RealtimeLearner) AddExample ¶
func (rl *RealtimeLearner) AddExample(example TrainingExample)
AddExample adds a training example to the buffer
func (*RealtimeLearner) GetTrainingData ¶
func (rl *RealtimeLearner) GetTrainingData() []TrainingExample
GetTrainingData returns current training data
func (*RealtimeLearner) ShouldUpdate ¶
func (rl *RealtimeLearner) ShouldUpdate() bool
ShouldUpdate checks if model should be updated
func (*RealtimeLearner) UpdateComplete ¶
func (rl *RealtimeLearner) UpdateComplete()
UpdateComplete marks update as complete
type RepositoryFeatures ¶
type RepositoryFeatures struct {
HasRepository bool `json:"has_repository"`
RepositoryURL string `json:"repository_url"`
RepositoryType string `json:"repository_type"`
StarCount int `json:"star_count"`
ForkCount int `json:"fork_count"`
IssueCount int `json:"issue_count"`
CommitCount int `json:"commit_count"`
ContributorCount int `json:"contributor_count"`
LastCommit time.Time `json:"last_commit"`
HasReadme bool `json:"has_readme"`
ReadmeLength int `json:"readme_length"`
HasTests bool `json:"has_tests"`
TestCoverage float64 `json:"test_coverage"`
HasCI bool `json:"has_ci"`
LanguageDistribution map[string]float64 `json:"language_distribution"`
SuspiciousFiles []string `json:"suspicious_files"`
}
RepositoryFeatures contains repository-related features
type ReputationAnalysis ¶
type ReputationAnalysis struct {
OverallScore float64 `json:"overall_score"`
MaintainerScore float64 `json:"maintainer_score"`
DownloadScore float64 `json:"download_score"`
AgeScore float64 `json:"age_score"`
CommunityScore float64 `json:"community_score"`
SecurityScore float64 `json:"security_score"`
ReputationSources []ReputationSource `json:"reputation_sources"`
}
ReputationAnalysis holds reputation analysis results.
type ReputationAnalyzer ¶
type ReputationAnalyzer struct{}
func NewReputationAnalyzer ¶
func NewReputationAnalyzer() (*ReputationAnalyzer, error)
func (*ReputationAnalyzer) AnalyzeReputation ¶
func (ra *ReputationAnalyzer) AnalyzeReputation(ctx context.Context, features *EnhancedPackageFeatures) (*EnhancedReputationAnalysis, error)
func (*ReputationAnalyzer) GetMetrics ¶
func (ra *ReputationAnalyzer) GetMetrics(ctx context.Context) (map[string]interface{}, error)
type ReputationFactor ¶
type ReputationFactor struct {
Factor string `json:"factor"`
Score float64 `json:"score"`
Weight float64 `json:"weight"`
Description string `json:"description"`
}
ReputationFactor represents factors affecting reputation score
type ReputationModel ¶
type ReputationModel struct {
// contains filtered or unexported fields
}
ReputationModel implements package reputation scoring
func NewReputationModel ¶
func NewReputationModel(config config.MLModelConfig) *ReputationModel
NewReputationModel creates a new reputation scoring model
func (*ReputationModel) GetModelInfo ¶
func (m *ReputationModel) GetModelInfo() *ModelInfo
GetModelInfo returns model information
func (*ReputationModel) Initialize ¶
func (m *ReputationModel) Initialize(ctx context.Context) error
Initialize initializes the reputation model
func (*ReputationModel) IsReady ¶
func (m *ReputationModel) IsReady() bool
IsReady returns whether the model is ready
func (*ReputationModel) Predict ¶
func (m *ReputationModel) Predict(features []float64) (*Prediction, error)
Predict performs reputation prediction
func (*ReputationModel) Train ¶
func (m *ReputationModel) Train(data []TrainingData) error
Train trains the reputation model
type ReputationSource ¶
type ReputationSource struct {
Source string `json:"source"`
Score float64 `json:"score"`
Weight float64 `json:"weight"`
}
ReputationSource represents a source of reputation information.
type RiskAssessment ¶
type RiskAssessment struct {
OverallRisk string `json:"overall_risk"`
RiskScore float64 `json:"risk_score"`
RiskFactors []RiskFactor `json:"risk_factors"`
Mitigations []string `json:"mitigations"`
ConfidenceLevel float64 `json:"confidence_level"`
}
RiskAssessment holds overall risk assessment.
type RiskFactor ¶
type RiskFactor struct {
Factor string `json:"factor"`
Severity string `json:"severity"`
Score float64 `json:"score"`
Description string `json:"description"`
}
RiskFactor represents a specific risk factor.
type RuntimeBehavior ¶
type RuntimeBehavior struct {
ProcessSpawning []string `json:"process_spawning"`
SystemCalls []string `json:"system_calls"`
ResourceUsage []string `json:"resource_usage"`
EnvironmentAccess []string `json:"environment_access"`
}
RuntimeBehavior holds runtime behavior analysis.
type Scorer ¶
type Scorer interface {
// Score calculates a risk score for a package based on extracted features
Score(ctx context.Context, pkg *types.Package, features map[string]interface{}) (*ScoringResult, error)
// GetModelInfo returns information about the underlying model
GetModelInfo() *ModelInfo
// UpdateModel updates the scorer with new model parameters
UpdateModel(modelData []byte) error
// GetThresholds returns the scoring thresholds used by this scorer
GetThresholds() ScoringThresholds
}
Scorer defines the interface for ML-based package scoring
type ScorerConfig ¶
type ScorerConfig struct {
Thresholds ScoringThresholds `json:"thresholds"`
FeatureWeights map[string]float64 `json:"feature_weights"`
Normalization bool `json:"normalization"`
ModelPath string `json:"model_path"`
UpdateInterval string `json:"update_interval"`
Metadata map[string]interface{} `json:"metadata,omitempty"`
}
ScorerConfig provides configuration for scorers
type ScoringResult ¶
type ScoringResult struct {
Score float64 `json:"score"`
Confidence float64 `json:"confidence"`
RiskLevel string `json:"risk_level"`
FeatureScores map[string]float64 `json:"feature_scores"`
Explanation string `json:"explanation"`
ModelVersion string `json:"model_version"`
ProcessingTime float64 `json:"processing_time_ms"`
Metadata map[string]interface{} `json:"metadata,omitempty"`
}
ScoringResult represents the output of a scoring operation
type ScoringThresholds ¶
type ScoringThresholds struct {
Malicious float64 `json:"malicious"`
Suspicious float64 `json:"suspicious"`
MinConfidence float64 `json:"min_confidence"`
}
ScoringThresholds defines the thresholds for different risk levels
func DefaultScoringThresholds ¶
func DefaultScoringThresholds() ScoringThresholds
DefaultScoringThresholds returns sensible default thresholds
func (ScoringThresholds) GetRiskLevel ¶
func (t ScoringThresholds) GetRiskLevel(score float64) string
GetRiskLevel determines the risk level based on score and thresholds
type SecurityFeatures ¶
type SecurityFeatures struct {
KnownVulnerabilities int `json:"known_vulnerabilities"`
SecurityScore float64 `json:"security_score"`
HasSecurityPolicy bool `json:"has_security_policy"`
SignedReleases bool `json:"signed_releases"`
SigstoreVerified bool `json:"sigstore_verified"`
SLSALevel int `json:"slsa_level"`
HasSBOM bool `json:"has_sbom"`
SupplyChainRisk float64 `json:"supply_chain_risk"`
MalwareIndicators []string `json:"malware_indicators"`
SuspiciousScripts []string `json:"suspicious_scripts"`
}
SecurityFeatures contains security-related features
type SecurityMetrics ¶
type SecurityMetrics struct {
VulnerabilityCount int `json:"vulnerability_count"`
HighSeverityVulns int `json:"high_severity_vulns"`
CriticalSeverityVulns int `json:"critical_severity_vulns"`
SuspiciousPatterns int `json:"suspicious_patterns"`
ObfuscatedCode bool `json:"obfuscated_code"`
NetworkCalls int `json:"network_calls"`
FileSystemAccess int `json:"file_system_access"`
ProcessExecution int `json:"process_execution"`
CryptographicUsage int `json:"cryptographic_usage"`
DangerousFunctions int `json:"dangerous_functions"`
SecurityScore float64 `json:"security_score"`
}
SecurityMetrics represents security-related metrics
type SimilarPackage ¶
type SimilarPackage struct {
Name string `json:"name"`
Similarity float64 `json:"similarity"`
Distance int `json:"distance"`
Algorithm string `json:"algorithm"`
Registry string `json:"registry"`
Downloads int64 `json:"downloads"`
LastUpdated string `json:"last_updated"`
Maintainer string `json:"maintainer"`
SuspiciousFlag bool `json:"suspicious_flag"`
}
SimilarPackage represents a package similar to the analyzed one.
type SimilarityModel ¶
type SimilarityModel struct{}
Placeholder model interfaces - these would be implemented separately
func NewSimilarityModel ¶
func NewSimilarityModel() (*SimilarityModel, error)
Placeholder implementations
func (*SimilarityModel) AnalyzeSimilarity ¶
func (sm *SimilarityModel) AnalyzeSimilarity(ctx context.Context, features *EnhancedPackageFeatures) ([]EnhancedSimilarityResult, error)
func (*SimilarityModel) GetMetrics ¶
func (sm *SimilarityModel) GetMetrics(ctx context.Context) (map[string]interface{}, error)
Metrics methods
type SimilarityRequest ¶
type SimilarityRequest struct {
PackageName string `json:"package_name"`
Registry string `json:"registry"`
TopK int `json:"top_k"`
Threshold float64 `json:"threshold"`
Exclude []string `json:"exclude,omitempty"`
}
SimilarityRequest represents a request to find similar packages
type SimilarityResponse ¶
type SimilarityResponse struct {
Results []SimilarityResult `json:"results"`
Model string `json:"model"`
Time float64 `json:"time_ms"`
}
SimilarityResponse represents a response from the similarity service
type SimilarityResult ¶
type SimilarityResult struct {
PackageName string `json:"package_name"`
Registry string `json:"registry"`
Score float64 `json:"score"`
Distance float64 `json:"distance"`
Rank int `json:"rank"`
}
SimilarityResult represents a single similarity result
type ThreatFeatureExtractor ¶
type ThreatFeatureExtractor struct {
// contains filtered or unexported fields
}
ThreatFeatureExtractor extracts features for ML prediction
func NewThreatFeatureExtractor ¶
func NewThreatFeatureExtractor() *ThreatFeatureExtractor
func (*ThreatFeatureExtractor) ExtractFeatures ¶
func (fe *ThreatFeatureExtractor) ExtractFeatures(packageInfo interface{}) (*FeatureVector, error)
type ThreatPrediction ¶
type ThreatPrediction struct {
PackageID string `json:"package_id"`
ThreatScore float64 `json:"threat_score"`
Confidence float64 `json:"confidence"`
ThreatTypes []string `json:"threat_types"`
Explanation *PredictionExplanation `json:"explanation"`
ModelVersions map[string]string `json:"model_versions"`
PredictionTime time.Time `json:"prediction_time"`
FeatureVector *FeatureVector `json:"feature_vector"`
}
ThreatPrediction represents a threat prediction result
type ThreatPredictor ¶
type ThreatPredictor struct {
// contains filtered or unexported fields
}
ThreatPredictor provides ML-based threat prediction capabilities with advanced analytics
func NewThreatPredictor ¶
func NewThreatPredictor(config *PredictorConfig) *ThreatPredictor
NewThreatPredictor creates a new threat predictor
func (*ThreatPredictor) AddTrainingSample ¶
func (tp *ThreatPredictor) AddTrainingSample(sample *TrainingSample) error
AddTrainingSample adds a new training sample
func (*ThreatPredictor) GetModelMetrics ¶
func (tp *ThreatPredictor) GetModelMetrics() map[string]*ModelMetrics
GetModelMetrics returns metrics for all models
func (*ThreatPredictor) PredictThreat ¶
func (tp *ThreatPredictor) PredictThreat(ctx context.Context, packageInfo interface{}) (*ThreatPrediction, error)
PredictThreat predicts threats for a package
func (*ThreatPredictor) TrainModels ¶
func (tp *ThreatPredictor) TrainModels(ctx context.Context) error
TrainModels trains or retrains ML models
type ThresholdChange ¶
type ThresholdChange struct {
ThreatType string `json:"threat_type"`
OldThreshold float64 `json:"old_threshold"`
NewThreshold float64 `json:"new_threshold"`
Reason string `json:"reason"`
Timestamp time.Time `json:"timestamp"`
PerformanceGain float64 `json:"performance_gain"`
}
ThresholdChange represents a threshold adaptation event
type ThresholdSet ¶
type ThresholdSet struct {
Ecosystem string `json:"ecosystem"`
TyposquattingThreshold float64 `json:"typosquatting_threshold"`
ConfusionThreshold float64 `json:"confusion_threshold"`
SupplyChainThreshold float64 `json:"supply_chain_threshold"`
MalwareThreshold float64 `json:"malware_threshold"`
ConfidenceLevel float64 `json:"confidence_level"`
LastUpdated time.Time `json:"last_updated"`
AdaptationHistory []ThresholdChange `json:"adaptation_history"`
}
ThresholdSet represents adaptive thresholds for different threat types
type TrainingData ¶
type TrainingData struct {
Features []float64 `json:"features"`
Label float64 `json:"label"`
Metadata map[string]interface{} `json:"metadata"`
}
TrainingData represents training data for ML models
type TrainingDataset ¶
type TrainingDataset struct {
// contains filtered or unexported fields
}
TrainingDataset manages training data for ML models
func NewTrainingDataset ¶
func NewTrainingDataset() *TrainingDataset
type TrainingExample ¶
type TrainingExample struct {
Features *FeatureVector `json:"features"`
Label float64 `json:"label"`
Weight float64 `json:"weight"`
Timestamp time.Time `json:"timestamp"`
}
TrainingExample represents a single training example
type TrainingMetrics ¶
type TrainingMetrics struct {
Accuracy float64 `json:"accuracy"`
Precision float64 `json:"precision"`
Recall float64 `json:"recall"`
F1Score float64 `json:"f1_score"`
TrainingLoss float64 `json:"training_loss"`
ValidationLoss float64 `json:"validation_loss"`
TrainingTime time.Duration `json:"training_time"`
DatasetSize int `json:"dataset_size"`
}
TrainingMetrics represents model training performance
type TrainingSample ¶
type TrainingSample struct {
ID string `json:"id"`
Features map[string]float64 `json:"features"`
Label string `json:"label"`
ThreatType types.ThreatType `json:"threat_type"`
Severity types.Severity `json:"severity"`
Confidence float64 `json:"confidence"`
Timestamp time.Time `json:"timestamp"`
Metadata map[string]interface{} `json:"metadata"`
Validated bool `json:"validated"`
}
TrainingSample represents a training sample
type TypoDetection ¶
type TypoDetection struct {
IsTyposquatting bool `json:"is_typosquatting"`
TargetPackage string `json:"target_package"`
TypoType string `json:"typo_type"`
EditDistance int `json:"edit_distance"`
SimilarityScore float64 `json:"similarity_score"`
Confidence float64 `json:"confidence"`
SuspiciousPatterns []string `json:"suspicious_patterns"`
}
TypoDetection represents typosquatting detection results
type TypoDetector ¶
type TypoDetector struct{}
func NewTypoDetector ¶
func NewTypoDetector() (*TypoDetector, error)
func (*TypoDetector) DetectTyposquatting ¶
func (td *TypoDetector) DetectTyposquatting(ctx context.Context, features *EnhancedPackageFeatures) (*TypoDetection, error)
func (*TypoDetector) GetMetrics ¶
func (td *TypoDetector) GetMetrics(ctx context.Context) (map[string]interface{}, error)
type TyposquattingModel ¶
type TyposquattingModel struct {
// contains filtered or unexported fields
}
TyposquattingModel implements typosquatting detection using ML
func NewTyposquattingModel ¶
func NewTyposquattingModel(config config.MLModelConfig) *TyposquattingModel
NewTyposquattingModel creates a new typosquatting detection model
func (*TyposquattingModel) GetModelInfo ¶
func (m *TyposquattingModel) GetModelInfo() *ModelInfo
GetModelInfo returns model information
func (*TyposquattingModel) Initialize ¶
func (m *TyposquattingModel) Initialize(ctx context.Context) error
Initialize initializes the typosquatting model
func (*TyposquattingModel) IsReady ¶
func (m *TyposquattingModel) IsReady() bool
IsReady returns whether the model is ready for predictions
func (*TyposquattingModel) Predict ¶
func (m *TyposquattingModel) Predict(features []float64) (*Prediction, error)
Predict performs typosquatting prediction
func (*TyposquattingModel) Train ¶
func (m *TyposquattingModel) Train(data []TrainingData) error
Train trains the typosquatting model using heuristic-based learning
type VotingType ¶
type VotingType string
VotingType represents ensemble voting strategy
const ( VotingTypeMajority VotingType = "majority" VotingTypeWeighted VotingType = "weighted" VotingTypeStacking VotingType = "stacking" )