Spaces:
Paused
Paused
File size: 2,695 Bytes
5a3b9db | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 | import json
import logging
from datetime import datetime
from typing import Dict, Any
logger = logging.getLogger(__name__)
class RecommendationEngine:
"""Module 7: Recommended Response"""
def __init__(self, config: dict):
self.mapping = config.get("recommendations", {
"Low": "Monitor",
"Moderate": "Review activity",
"Elevated": "Step-up Authentication",
"High": "Require MFA, Notify SOC",
"Critical": "Lock account, Block authentication, Escalate incident"
})
def recommend(self, risk_level: str) -> str:
return self.mapping.get(risk_level, "Monitor")
class AuditTrail:
"""Module 8: Audit Trail"""
def __init__(self, config: dict):
self.version_info = {
"Feature_Schema_Version": config.get("feature_schema_version", "1.0"),
"SHAP_Version": "1.0",
"Audit_Engine_Version": "1.0"
}
def generate_audit_metadata(self, event_id, detection_v, risk_v, class_v) -> dict:
metadata = {
"Event_ID": event_id,
"Detection_Engine_Version": detection_v,
"Risk_Engine_Version": risk_v,
"Classification_Model_Version": class_v,
"Processing_Timestamp": datetime.now().isoformat(),
"Explanation_Timestamp": datetime.now().isoformat()
}
metadata.update(self.version_info)
return metadata
class EvidencePackageGenerator:
"""Module 6: Evidence Package"""
def __init__(self, config: dict):
self.recommender = RecommendationEngine(config)
self.audit = AuditTrail(config)
def build_package(self, event_id: int, nl_explanation: str, shap_features: list,
rule_exp: list, behavior_exp: list, risk_exp: dict,
attack_category: str, risk_level: str,
detection_v: str, risk_v: str, class_v: str) -> dict:
recommended_action = self.recommender.recommend(risk_level)
audit_metadata = self.audit.generate_audit_metadata(event_id, detection_v, risk_v, class_v)
# Structure the payload per requirements
package = {
"Event Metadata": {"Event ID": event_id},
"Triggered Rules": rule_exp,
"Behavior Deviations": behavior_exp,
"Feature Contributions": shap_features,
"Risk Breakdown": risk_exp,
"Attack Classification": attack_category,
"Recommended Action": recommended_action,
"Explanation": nl_explanation,
"Audit Metadata": audit_metadata
}
return package
|