Version_1/layers/layer_5_context.py

import asyncio
import difflib
from urllib.parse import urlparse

# A sample of high-value targets frequently spoofed
PROTECTED_BRANDS = ["paypal", "microsoft", "google", "apple", "amazon", "netflix", "chase"]

def check_brand_spoofing(hostname: str) -> float:
    score = 0.0
    tokens = hostname.split('.')
    
    for token in tokens:
        for brand in PROTECTED_BRANDS:
            # If the token is an exact match, it might be a subdomain spoof (e.g., paypal.secure-login.com)
            if token == brand:
                score += 0.3
            else:
                # Calculate string similarity ratio
                ratio = difflib.SequenceMatcher(None, token, brand).ratio()
                # If it's highly similar but NOT exact (e.g., 'micros0ft' or 'appIe')
                if 0.8 < ratio < 1.0:
                    score += 0.6
    return score

async def analyze_global_context(url: str) -> float:
    score = 0.0
    hostname = urlparse(url).hostname or ""
    
    # 1. Brand Spoofing Check (Edit Distance)
    score += check_brand_spoofing(hostname)
    
    # 2. Threat Intelligence API Integration (Simulated)
    # In production, this would be an aiohttp call to Google Safe Browsing or VirusTotal
    await asyncio.sleep(0.08) # Simulate network latency for API call
    
    # Mocking an API hit: if the domain has "update-billing", let's say the API knows it's bad
    if 'update-billing' in url.lower():
        score += 0.7
        
    return min(score, 1.0)