ai_root_shield 0.1.0

data/lib/ai_root_shield/detector.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require "json"
+
+module AiRootShield
+  # Main detector class that orchestrates all security checks
+  class Detector
+    DEFAULT_CONFIG = {
+      enable_root_detection: true,
+      enable_emulator_detection: true,
+      enable_hooking_detection: true,
+      enable_integrity_checks: true,
+      enable_network_analysis: true,
+      risk_threshold: 50
+    }.freeze
+
+    def initialize(config = {})
+      @config = DEFAULT_CONFIG.merge(config)
+      @analyzers = initialize_analyzers
+    end
+
+    # Perform comprehensive device security scan
+    # @param device_logs_path [String] Path to device logs JSON file
+    # @return [Hash] Scan results with risk score and detected factors
+    def scan(device_logs_path)
+      device_data = DeviceLogParser.parse(device_logs_path)
+      
+      detected_factors = []
+      risk_scores = []
+
+      @analyzers.each do |analyzer|
+        next unless analyzer_enabled?(analyzer)
+        
+        result = analyzer.analyze(device_data)
+        detected_factors.concat(result[:factors])
+        risk_scores << result[:risk_score]
+      end
+
+      overall_risk = RiskCalculator.calculate_overall_risk(risk_scores, detected_factors)
+
+      {
+        risk_score: overall_risk,
+        factors: detected_factors.uniq,
+        timestamp: Time.now.to_i,
+        version: AiRootShield::VERSION
+      }
+    end
+
+    private
+
+    def initialize_analyzers
+      [
+        Analyzers::RootDetector.new,
+        Analyzers::EmulatorDetector.new,
+        Analyzers::HookingDetector.new,
+        Analyzers::IntegrityChecker.new,
+        Analyzers::NetworkAnalyzer.new
+      ]
+    end
+
+    def analyzer_enabled?(analyzer)
+      case analyzer.class.name.split("::").last
+      when "RootDetector"
+        @config[:enable_root_detection]
+      when "EmulatorDetector"
+        @config[:enable_emulator_detection]
+      when "HookingDetector"
+        @config[:enable_hooking_detection]
+      when "IntegrityChecker"
+        @config[:enable_integrity_checks]
+      when "NetworkAnalyzer"
+        @config[:enable_network_analysis]
+      else
+        true
+      end
+    end
+  end
+end

data/lib/ai_root_shield/device_log_parser.rb

@@ -0,0 +1,118 @@
+# frozen_string_literal: true
+
+require "json"
+
+module AiRootShield
+  # Parses device logs and extracts relevant security information
+  class DeviceLogParser
+    class << self
+      # Parse device logs from JSON file
+      # @param file_path [String] Path to the device logs JSON file
+      # @return [Hash] Parsed device data
+      def parse(file_path)
+        raise Error, "Device logs file not found: #{file_path}" unless File.exist?(file_path)
+
+        raw_data = JSON.parse(File.read(file_path))
+        normalize_device_data(raw_data)
+      rescue JSON::ParserError => e
+        raise Error, "Invalid JSON format in device logs: #{e.message}"
+      end
+
+      private
+
+      # Normalize device data into a consistent format
+      # @param raw_data [Hash] Raw device data from JSON
+      # @return [Hash] Normalized device data
+      def normalize_device_data(raw_data)
+        {
+          platform: detect_platform(raw_data),
+          system_info: extract_system_info(raw_data),
+          installed_packages: extract_packages(raw_data),
+          file_system: extract_file_system_info(raw_data),
+          processes: extract_processes(raw_data),
+          network_config: extract_network_config(raw_data),
+          security_settings: extract_security_settings(raw_data),
+          hardware_info: extract_hardware_info(raw_data),
+          certificates: extract_certificates(raw_data),
+          logs: extract_system_logs(raw_data)
+        }
+      end
+
+      def detect_platform(data)
+        return "android" if data.key?("android") || data.key?("selinux_status")
+        return "ios" if data.key?("ios") || data.key?("dyld_info")
+        
+        "unknown"
+      end
+
+      def extract_system_info(data)
+        system_info = data["system_info"] || {}
+        {
+          os_version: system_info["os_version"],
+          kernel_version: system_info["kernel_version"],
+          build_fingerprint: system_info["build_fingerprint"],
+          bootloader_status: system_info["bootloader_status"],
+          selinux_status: system_info["selinux_status"],
+          developer_options: system_info["developer_options"]
+        }
+      end
+
+      def extract_packages(data)
+        data["installed_packages"] || data["apps"] || []
+      end
+
+      def extract_file_system_info(data)
+        fs_info = data["file_system"] || {}
+        {
+          mounted_partitions: fs_info["mounted_partitions"] || [],
+          suspicious_files: fs_info["suspicious_files"] || [],
+          system_binaries: fs_info["system_binaries"] || [],
+          writable_system_dirs: fs_info["writable_system_dirs"] || []
+        }
+      end
+
+      def extract_processes(data)
+        data["running_processes"] || data["processes"] || []
+      end
+
+      def extract_network_config(data)
+        network = data["network"] || {}
+        {
+          proxy_settings: network["proxy_settings"],
+          vpn_active: network["vpn_active"],
+          certificates: network["certificates"] || [],
+          tls_config: network["tls_config"]
+        }
+      end
+
+      def extract_security_settings(data)
+        security = data["security"] || {}
+        {
+          screen_lock_enabled: security["screen_lock_enabled"],
+          encryption_enabled: security["encryption_enabled"],
+          unknown_sources: security["unknown_sources"],
+          usb_debugging: security["usb_debugging"]
+        }
+      end
+
+      def extract_hardware_info(data)
+        hardware = data["hardware"] || {}
+        {
+          device_model: hardware["device_model"],
+          manufacturer: hardware["manufacturer"],
+          sensors: hardware["sensors"] || [],
+          baseband_version: hardware["baseband_version"],
+          serial_number: hardware["serial_number"]
+        }
+      end
+
+      def extract_certificates(data)
+        data["certificates"] || []
+      end
+
+      def extract_system_logs(data)
+        data["system_logs"] || data["logs"] || []
+      end
+    end
+  end
+end

data/lib/ai_root_shield/risk_calculator.rb

@@ -0,0 +1,161 @@
+# frozen_string_literal: true
+
+module AiRootShield
+  # Calculates overall risk scores based on detected security factors
+  class RiskCalculator
+    # Risk factor weights for different types of threats
+    RISK_WEIGHTS = {
+      # Root/Jailbreak factors (high risk)
+      "ROOT_SU_FOUND" => 25,
+      "ROOT_SUPERUSER_APK" => 20,
+      "JAILBREAK_CYDIA" => 25,
+      "BOOTLOADER_UNLOCKED" => 15,
+      "SELINUX_PERMISSIVE" => 20,
+      
+      # Emulator factors (medium-high risk)
+      "EMULATOR_QEMU" => 20,
+      "EMULATOR_GENYMOTION" => 18,
+      "SIMULATOR_IOS" => 15,
+      "MISSING_BASEBAND" => 12,
+      "VIRTUAL_SENSORS" => 10,
+      
+      # Hooking/Instrumentation factors (high risk)
+      "FRIDA_GADGET" => 25,
+      "XPOSED_FRAMEWORK" => 22,
+      "MAGISK_MODULES" => 20,
+      "SUBSTRATE_INJECTION" => 18,
+      "DEBUGGER_ATTACHED" => 15,
+      
+      # Integrity factors (medium risk)
+      "REPACKAGED_APP" => 18,
+      "SIGNATURE_MISMATCH" => 15,
+      "DEX_TAMPERED" => 12,
+      "BUNDLE_MODIFIED" => 10,
+      
+      # Network security factors (medium risk)
+      "TLS_UNPINNED" => 12,
+      "CUSTOM_CA_INSTALLED" => 15,
+      "MITM_PROXY_DETECTED" => 18,
+      "VPN_SUSPICIOUS" => 8
+    }.freeze
+
+    class << self
+      # Calculate overall risk score from individual analyzer results
+      # @param risk_scores [Array<Integer>] Individual risk scores from analyzers
+      # @param factors [Array<String>] Detected risk factors
+      # @return [Integer] Overall risk score (0-100)
+      def calculate_overall_risk(risk_scores, factors)
+        return 0 if factors.empty?
+
+        # Calculate weighted score based on detected factors
+        weighted_score = calculate_weighted_factor_score(factors)
+        
+        # Calculate average analyzer score
+        avg_analyzer_score = risk_scores.empty? ? 0 : (risk_scores.sum.to_f / risk_scores.length)
+        
+        # Combine weighted factor score (70%) and analyzer average (30%)
+        combined_score = (weighted_score * 0.7) + (avg_analyzer_score * 0.3)
+        
+        # Apply risk amplification for multiple high-risk factors
+        amplified_score = apply_risk_amplification(combined_score, factors)
+        
+        # Ensure score is within bounds
+        [amplified_score.round, 100].min
+      end
+
+      # Get risk level description based on score
+      # @param score [Integer] Risk score (0-100)
+      # @return [String] Risk level description
+      def risk_level_description(score)
+        case score
+        when 0..20
+          "LOW"
+        when 21..40
+          "MEDIUM"
+        when 41..70
+          "HIGH"
+        when 71..100
+          "CRITICAL"
+        else
+          "UNKNOWN"
+        end
+      end
+
+      # Get recommended actions based on risk factors
+      # @param factors [Array<String>] Detected risk factors
+      # @return [Array<String>] Recommended security actions
+      def recommended_actions(factors)
+        actions = []
+        
+        if has_root_factors?(factors)
+          actions << "Block app execution on rooted/jailbroken devices"
+        end
+        
+        if has_emulator_factors?(factors)
+          actions << "Implement additional emulator detection measures"
+        end
+        
+        if has_hooking_factors?(factors)
+          actions << "Enable anti-tampering and runtime protection"
+        end
+        
+        if has_network_factors?(factors)
+          actions << "Enforce certificate pinning and secure communications"
+        end
+        
+        actions << "Monitor device for ongoing security threats" if actions.any?
+        actions
+      end
+
+      private
+
+      def calculate_weighted_factor_score(factors)
+        total_weight = factors.sum { |factor| RISK_WEIGHTS[factor] || 5 }
+        
+        # Normalize to 0-100 scale (assuming max possible weight around 150)
+        normalized_score = (total_weight.to_f / 150) * 100
+        [normalized_score, 100].min
+      end
+
+      def apply_risk_amplification(base_score, factors)
+        high_risk_factors = count_high_risk_factors(factors)
+        
+        # Amplify risk if multiple high-risk factors are present
+        amplification_factor = case high_risk_factors
+                              when 0..1
+                                1.0
+                              when 2..3
+                                1.15
+                              when 4..5
+                                1.3
+                              else
+                                1.5
+                              end
+        
+        base_score * amplification_factor
+      end
+
+      def count_high_risk_factors(factors)
+        high_risk_patterns = %w[ROOT JAILBREAK FRIDA XPOSED MAGISK DEBUGGER]
+        factors.count { |factor| high_risk_patterns.any? { |pattern| factor.include?(pattern) } }
+      end
+
+      def has_root_factors?(factors)
+        factors.any? { |f| f.start_with?("ROOT_", "JAILBREAK_") }
+      end
+
+      def has_emulator_factors?(factors)
+        factors.any? { |f| f.start_with?("EMULATOR_", "SIMULATOR_") }
+      end
+
+      def has_hooking_factors?(factors)
+        hooking_patterns = %w[FRIDA XPOSED MAGISK SUBSTRATE DEBUGGER]
+        factors.any? { |f| hooking_patterns.any? { |pattern| f.include?(pattern) } }
+      end
+
+      def has_network_factors?(factors)
+        factors.any? { |f| f.include?("TLS_") || f.include?("MITM_") || f.include?("CA_") }
+      end
+    end
+  end
+end

data/lib/ai_root_shield/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module AiRootShield
+  VERSION = "0.1.0"
+end

data/lib/ai_root_shield.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require_relative "ai_root_shield/version"
+require_relative "ai_root_shield/detector"
+require_relative "ai_root_shield/analyzers/root_detector"
+require_relative "ai_root_shield/analyzers/emulator_detector"
+require_relative "ai_root_shield/analyzers/hooking_detector"
+require_relative "ai_root_shield/analyzers/integrity_checker"
+require_relative "ai_root_shield/analyzers/network_analyzer"
+require_relative "ai_root_shield/risk_calculator"
+require_relative "ai_root_shield/device_log_parser"
+
+module AiRootShield
+  class Error < StandardError; end
+
+  # Main entry point for device scanning
+  # @param device_logs_path [String] Path to device logs JSON file
+  # @return [Hash] Risk assessment result with score and factors
+  def self.scan_device(device_logs_path)
+    Detector.new.scan(device_logs_path)
+  end
+
+  # Scan device with custom configuration
+  # @param device_logs_path [String] Path to device logs JSON file
+  # @param config [Hash] Configuration options
+  # @return [Hash] Risk assessment result with score and factors
+  def self.scan_device_with_config(device_logs_path, config = {})
+    Detector.new(config).scan(device_logs_path)
+  end
+
+  # Get version information
+  # @return [String] Current version
+  def self.version
+    VERSION
+  end
+end

metadata

@@ -0,0 +1,179 @@
+--- !ruby/object:Gem::Specification
+name: ai_root_shield
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Ahmet KAHRAMAN
+bindir: exe
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: json
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.6'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.6'
+- !ruby/object:Gem::Dependency
+  name: digest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.1'
+- !ruby/object:Gem::Dependency
+  name: openssl
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+- !ruby/object:Gem::Dependency
+  name: rubocop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.21'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.21'
+- !ruby/object:Gem::Dependency
+  name: yard
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+description: An AI-powered Ruby library that performs on-device compromise detection
+  for mobile applications without requiring a backend. Detects root/jailbreak, emulators,
+  hooking frameworks, and provides behavioral risk analysis.
+email:
+- ahmetxhero@gmail.com
+executables:
+- ai_root_shield
+extensions: []
+extra_rdoc_files: []
+files:
+- ".rspec"
+- CHANGELOG.md
+- Gemfile
+- Gemfile.lock
+- LICENSE
+- README.md
+- Rakefile
+- examples/device_logs/clean_device.json
+- examples/device_logs/rooted_android.json
+- exe/ai_root_shield
+- lib/ai_root_shield.rb
+- lib/ai_root_shield/analyzers/emulator_detector.rb
+- lib/ai_root_shield/analyzers/hooking_detector.rb
+- lib/ai_root_shield/analyzers/integrity_checker.rb
+- lib/ai_root_shield/analyzers/network_analyzer.rb
+- lib/ai_root_shield/analyzers/root_detector.rb
+- lib/ai_root_shield/detector.rb
+- lib/ai_root_shield/device_log_parser.rb
+- lib/ai_root_shield/risk_calculator.rb
+- lib/ai_root_shield/version.rb
+homepage: https://github.com/ahmetxhero/ai-root-shield
+licenses:
+- MIT
+metadata:
+  allowed_push_host: https://rubygems.org
+  homepage_uri: https://github.com/ahmetxhero/ai-root-shield
+  source_code_uri: https://github.com/ahmetxhero/ai-root-shield
+  changelog_uri: https://github.com/ahmetxhero/ai-root-shield/blob/main/CHANGELOG.md
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 2.7.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.9
+specification_version: 4
+summary: AI-powered mobile device compromise detection library
+test_files: []