Update behavioral_analyzer.py

behavioral_analyzer.py

@@ -1,197 +1,47 @@
-
-from typing import Dict, List, Tuple
-
-
-# =========================
-# BEHAVIORAL PATTERN SETS
-# =========================
-
-BEHAVIOR_PATTERNS = {
-    "sextortion": {
-        "device_compromise": [
-            "i have full access",
-            "total access to your devices",
-            "installed a trojan",
-            "infected your device",
-            "remote access",
-            "spyware",
-        ],
-        "surveillance": [
-            "i am watching you",
-            "i monitor",
-            "recorded you",
-            "captured video",
-            "webcam",
-            "microphone",
-        ],
-        "sexual_blackmail": [
-            "porn",
-            "masturbation",
-            "adult content",
-            "sexual video",
-            "explicit video",
-            "nasty videos",
-        ],
-        "payment_demand": [
-            "bitcoin",
-            "btc",
-            "crypto",
-            "wallet",
-            "send money",
-            "payment",
-        ],
-        "time_pressure": [
-            "48 hours",
-            "24 hours",
-            "countdown",
-            "time is running out",
-            "last chance",
-        ],
-    },
-
-    "phishing": {
-        "credential_theft": [
-            "verify your account",
-            "login immediately",
-            "confirm your password",
-            "update your account",
-        ],
-        "impersonation": [
-            "security team",
-            "support team",
-            "admin",
-            "it department",
-        ],
-        "urgency": [
-            "urgent",
-            "immediately",
-            "action required",
-            "account suspended",
-        ],
-    },
-
-    "bec": {
-        "financial_request": [
-            "wire transfer",
-            "bank details",
-            "invoice attached",
-            "payment request",
-        ],
-        "authority_pressure": [
-            "ceo",
-            "director",
-            "urgent request",
-            "confidential",
-        ],
-    }
-}
-
-
-# =========================
-# SCORING WEIGHTS
-# =========================
-
-BEHAVIOR_WEIGHTS = {
-    "sextortion": {
-        "device_compromise": 25,
-        "surveillance": 20,
-        "sexual_blackmail": 30,
-        "payment_demand": 20,
-        "time_pressure": 15,
-    },
-    "phishing": {
-        "credential_theft": 30,
-        "impersonation": 20,
-        "urgency": 20,
-    },
-    "bec": {
-        "financial_request": 35,
-        "authority_pressure": 25,
-    }
-}
-
-
-# =========================
-# MAIN ANALYZER
-# =========================
-
-def analyze_behavior(body: str) -> Dict:
-    """
-    Analyze email body for behavioral attack patterns.
-    Returns detailed signals, scores, and verdict.
-    """
-
-    body_l = body.lower()
-
-    findings = {}
-    scores = {}
-    matched_indicators = {}
-
-    for attack_type, categories in BEHAVIOR_PATTERNS.items():
-        findings[attack_type] = {}
-        matched_indicators[attack_type] = []
-
-        for category, patterns in categories.items():
-            matched = any(p in body_l for p in patterns)
-            findings[attack_type][category] = matched
-
-            if matched:
-                matched_indicators[attack_type].append(category)
-
-        # Score calculation
-        score = 0
-        for category, matched in findings[attack_type].items():
-            if matched:
-                score += BEHAVIOR_WEIGHTS.get(attack_type, {}).get(category, 0)
-
-        scores[attack_type] = min(score, 100)
-
-    # Determine dominant attack
-    dominant_attack = max(scores, key=scores.get)
-    dominant_score = scores[dominant_attack]
-
-    verdict = "Safe"
-    if dominant_score >= 60:
-        verdict = "Malicious"
+# behavioral_analyzer.py
+
+import re
+
+SEXTORTION_PATTERNS = [
+    "i have access to all your devices",
+    "i recorded you",
+    "i installed a trojan",
+    "i have your webcam",
+    "masturbation",
+    "adult websites",
+    "send bitcoin",
+    "btc",
+    "wallet address",
+    "48 hours",
+    "countdown",
+    "i will share the video",
+    "i will expose",
+]
+
+def analyze_behavior(body: str):
+    body_l = (body or "").lower()
+
+    matched = [p for p in SEXTORTION_PATTERNS if p in body_l]
+
+    if len(matched) >= 3:
+        return {
+            "dominant_attack": "sextortion",
+            "confidence_score": 90,   # 🔥 authoritative
+            "verdict": "🚨 Malicious",
+            "findings": matched,
+        }
 
     return {
-        "verdict": verdict,
-        "dominant_attack": dominant_attack if dominant_score >= 40 else "None",
-        "confidence_score": dominant_score,
-        "scores": scores,
-        "signals": findings,
-        "matched_indicators": matched_indicators,
+        "dominant_attack": "None",
+        "confidence_score": 0,
+        "verdict": "Unknown",
+        "findings": [],
     }
 
-
-# =========================
-# HUMAN-READABLE SUMMARY
-# =========================
-
-def behavioral_summary(result: Dict) -> str:
-    if result["verdict"] == "Safe":
-        return "No strong malicious behavioral patterns detected."
-
-    attack = result["dominant_attack"]
-    indicators = result["matched_indicators"].get(attack, [])
-
-    return (
-        f"Behavioral analysis strongly indicates **{attack.upper()}**.\n"
-        f"Detected indicators: {', '.join(indicators)}.\n"
-        f"Confidence Score: {result['confidence_score']}/100"
-    )
-
-
-# =========================
-# STANDALONE TEST (OPTIONAL)
-# =========================
-
-if __name__ == "__main__":
-    sample_text = """
-    I have full access to your devices and recorded you via webcam.
-    You must send bitcoin within 48 hours or the videos will be shared.
-    """
-
-    result = analyze_behavior(sample_text)
-    print(result)
-    print(behavioral_summary(result))
+def behavioral_summary(result: dict) -> str:
+    if result["dominant_attack"] == "sextortion":
+        return (
+            "Email exhibits sextortion behavior: claims of device compromise, "
+            "recorded explicit content, cryptocurrency extortion, and urgency."
+        )
+    return "No strong behavioral threat detected."