ml

type AnalysisResult struct {
	IsViolation     bool
	Score           float64
	ViolationTypes  []string
	RedactedContent string
	Severity        int
}

type Anomaly struct {
	// Type categorizes the anomaly (traffic_spike, entropy_anomaly, etc.)
	Type AnomalyType

	// Severity indicates the importance level (1-5)
	Severity Severity

	// Score is the statistical z-score indicating how many
	// standard deviations from the mean this value is
	Score float64

	// Timestamp when the anomaly was detected
	Timestamp time.Time

	// Evidence contains additional context about the anomaly
	Evidence map[string]interface{}

	// Description provides a human-readable explanation
	Description string
}

type AnomalyType string

type Baseline struct {
	// contains filtered or unexported fields
}

type BehavioralAnalyzer struct {
	// contains filtered or unexported fields
}

type BehavioralResult struct {
	IsAnomaly   bool
	AnomalyType string
	Score       float64
	Description string
}

type BehavioralStats struct {
	TotalClients     int64
	AnomalousClients int64
	TotalAnomalies   int64
	ByType           map[string]int64
	// contains filtered or unexported fields
}

type ClientBehavior struct {
	RequestTimestamps []time.Time
	PathFrequencies   map[string]int
	MethodCounts      map[string]int
	TotalRequests     int
	BytesSent         int64
	FirstSeen         time.Time
	LastSeen          time.Time
	AnomalyScore      float64
}

type CombinedDetector struct {
	PromptInjection     *PromptInjectionDetector
	TokenSmuggling      *TokenSmugglingDetector
	UnicodeAttack       *UnicodeAttackDetector
	ContextManipulation *ContextManipulationDetector
}

type CombinedResult struct {
	IsThreat             bool
	TotalScore           float64
	PromptInjectionScore float64
	TokenSmugglingScore  float64
	UnicodeAttackScore   float64
	ContextScore         float64
	AllMatchedPatterns   []string
	HighestSeverity      int
}

type Config struct {
	// Sensitivity determines the z-score threshold for anomaly detection
	Sensitivity Sensitivity

	// WindowSize is the number of samples to consider for baseline
	WindowSize int

	// ZThreshold can override the default threshold based on sensitivity
	ZThreshold float64

	// MinSamples is the minimum samples needed before detecting anomalies
	MinSamples int

	// EntropyThreshold for content analysis (0-1, higher = more random)
	EntropyThreshold float64
}

type ContentAnalysisStats struct {
	TotalAnalyzed   int64
	ViolationsFound int64
	ByType          map[string]int64
	LastViolation   time.Time
	// contains filtered or unexported fields
}

type ContentAnalyzer struct {
	// contains filtered or unexported fields
}

type ContentRule struct {
	Name     string
	Pattern  *regexp.Regexp
	Severity int
	Action   string // "block", "alert", "redact"
}

type ContextDetectionResult struct {
	IsManipulation bool
	Score          float64
	MatchedTypes   []string
	Severity       int
	Description    string
}

type ContextManipulationDetector struct {
	// contains filtered or unexported fields
}

type ContextManipulationStats struct {
	TotalScanned    int64
	ThreatsDetected int64
	BlockedCount    int64
	ByPattern       map[string]int64
	LastDetection   time.Time
	// contains filtered or unexported fields
}

type ContextPattern struct {
	Name        string
	Regex       *regexp.Regexp
	Severity    int
	Weight      float64
	Description string
}

type DetectionResult struct {
	IsInjection     bool
	Score           float64 // 0-100
	MatchedPatterns []string
	Severity        int
	Explanation     string
}

type Detector struct {
	// contains filtered or unexported fields
}

type InjectionPattern struct {
	Name     string
	Regex    *regexp.Regexp
	Severity int // 1-5
	Weight   float64
}

type MetricsExporter struct {
	// contains filtered or unexported fields
}

type PromptInjectionDetector struct {
	// contains filtered or unexported fields
}

type PromptInjectionStats struct {
	TotalScanned    int64
	ThreatsDetected int64
	BlockedCount    int64
	ByPattern       map[string]int64
	LastDetection   time.Time
	// contains filtered or unexported fields
}

type Sensitivity string

type Severity int

type TokenDetectionResult struct {
	IsSmuggling   bool
	Score         float64
	MatchedTokens []string
	Severity      int
	Description   string
}

type TokenPattern struct {
	Name        string
	Regex       *regexp.Regexp
	Severity    int
	Weight      float64
	Description string
}

type TokenSmugglingDetector struct {
	// contains filtered or unexported fields
}

type TokenSmugglingStats struct {
	TotalScanned    int64
	ThreatsDetected int64
	BlockedCount    int64
	ByPattern       map[string]int64
	LastDetection   time.Time
	// contains filtered or unexported fields
}

type TrafficSample struct {
	// Timestamp when the sample was recorded
	Timestamp time.Time
	// Volume is the number of requests in the sample period
	Volume int
	// Size is the total bytes transferred
	Size int64
	// Violations count of security rule violations
	Violations int
}

type UnicodeAttackDetector struct {
	// contains filtered or unexported fields
}

type UnicodeAttackStats struct {
	TotalScanned    int64
	ThreatsDetected int64
	BlockedCount    int64
	ByPattern       map[string]int64
	LastDetection   time.Time
	// contains filtered or unexported fields
}

type UnicodeDetectionResult struct {
	IsAttack     bool
	Score        float64
	MatchedTypes []string
	Severity     int
	Description  string
}

type UnicodePattern struct {
	Name        string
	Regex       *regexp.Regexp
	Severity    int
	Weight      float64
	Description string
}