ai_root_shield 0.2.0 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +52 -3
- data/Gemfile.lock +1 -1
- data/README.md +109 -3
- data/examples/policies/banking_policy.json +79 -0
- data/examples/policies/development_policy.json +64 -0
- data/examples/policies/enterprise_policy.json +89 -0
- data/exe/ai_root_shield +157 -14
- data/lib/ai_root_shield/advanced_proxy_detector.rb +406 -0
- data/lib/ai_root_shield/certificate_pinning_helper.rb +258 -0
- data/lib/ai_root_shield/enterprise_policy_manager.rb +431 -0
- data/lib/ai_root_shield/rasp_protection.rb +359 -0
- data/lib/ai_root_shield/version.rb +1 -1
- data/lib/ai_root_shield.rb +171 -4
- metadata +16 -5
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 7aa3147f758f9775ee0b5739aa6edf8c6a905052b72760bbbe5991c80a2c4925
|
|
4
|
+
data.tar.gz: bc5d646ce2e6c86bceef124763ed0ff3168a70bb90c6946f24e8e37fe5310df4
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 8a1160dbbbc26d2956ec0262ec5fbeeacce25335229cafdce11d88311bffe1fa040d060b47db07aff39344f3bd7f468433ea5ca2d4d768fc5d39d7e8b898de05
|
|
7
|
+
data.tar.gz: 0cfb012442a47483f041651fc47089348e115c1837583d54de71584f5678e5ccc34458f98adf40084f49d7149459e7c0d7f01fa9d8dd4af77b77ae76b06aeb44
|
data/CHANGELOG.md
CHANGED
|
@@ -12,12 +12,61 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
12
12
|
- Real-time threat monitoring capabilities
|
|
13
13
|
- Custom rule engine for security policies
|
|
14
14
|
|
|
15
|
+
## [0.4.0] - 2024-12-XX
|
|
16
|
+
|
|
17
|
+
### Added
|
|
18
|
+
- **Advanced Network Security** capabilities
|
|
19
|
+
- Certificate pinning helper with TLS public key pinning integration
|
|
20
|
+
- Advanced proxy detection (VPN, Tor, custom DNS, MITM appliance detection)
|
|
21
|
+
- Enterprise policy management with JSON-based customizable security rules
|
|
22
|
+
- Policy compliance validation and violation reporting
|
|
23
|
+
- Network security analysis integration
|
|
24
|
+
- Support for banking, enterprise, and development policy templates
|
|
25
|
+
- CLI support for network security features (`--enable-cert-pinning`, `--enable-proxy-detection`, `--policy`)
|
|
26
|
+
|
|
27
|
+
### Enhanced
|
|
28
|
+
- Comprehensive security status reporting across all components
|
|
29
|
+
- Enhanced CLI with network analysis options (`--target-ip`, `--target-url`)
|
|
30
|
+
- Policy-driven risk assessment and compliance checking
|
|
31
|
+
- Real-time network threat detection and reporting
|
|
32
|
+
|
|
33
|
+
### Technical
|
|
34
|
+
- Certificate chain validation and pin extraction
|
|
35
|
+
- Multi-layered proxy detection (Tor exit nodes, VPN services, MITM appliances)
|
|
36
|
+
- JSON policy definition with inheritance and merging
|
|
37
|
+
- Audit logging and compliance reporting
|
|
38
|
+
- Network analysis integration with existing risk calculation
|
|
39
|
+
|
|
40
|
+
## [0.3.0] - 2024-01-03
|
|
41
|
+
|
|
42
|
+
### Added
|
|
43
|
+
- 🛡️ **RASP Protection**: Runtime Application Self-Protection with real-time threat blocking
|
|
44
|
+
- 🛡️ **Anti-Debug Mechanisms**: Ptrace, GDB, LLDB detection and blocking
|
|
45
|
+
- 🛡️ **Anti-Tamper Protection**: Code integrity and memory patch detection
|
|
46
|
+
- 🛡️ **Dynamic Memory Protection**: Frida injection hook mitigation
|
|
47
|
+
- 🛡️ **Runtime Integrity Monitor**: Critical function hash validation
|
|
48
|
+
- 🛡️ **Real-Time Event Reporting**: Instant alerts for security violations
|
|
49
|
+
- CLI RASP support with `--enable-rasp` and `--rasp-time` options
|
|
50
|
+
- Comprehensive RASP test suite with 69 passing tests
|
|
51
|
+
- Process monitoring for debugger detection
|
|
52
|
+
- Memory map analysis for injection detection
|
|
53
|
+
- Code integrity hash validation
|
|
54
|
+
- Event callback system for real-time alerts
|
|
55
|
+
|
|
56
|
+
### Changed
|
|
57
|
+
- Enhanced CLI with RASP protection options
|
|
58
|
+
- Updated main library interface with RASP methods
|
|
59
|
+
- Improved error handling and protection status reporting
|
|
60
|
+
|
|
61
|
+
### Dependencies
|
|
62
|
+
- Added `fiddle` for low-level system interactions (Ruby standard library)
|
|
63
|
+
|
|
15
64
|
## [0.2.0] - 2024-01-02
|
|
16
65
|
|
|
17
66
|
### Added
|
|
18
|
-
- **AI Behavioral Analysis**: ONNX-powered behavioral pattern analysis with anomaly detection
|
|
19
|
-
- **ML-Based Emulator Detection**: Advanced machine learning techniques for emulator identification
|
|
20
|
-
- **AI Confidence Scoring**: Confidence metrics integrated into risk assessment
|
|
67
|
+
- 🤖 **AI Behavioral Analysis**: ONNX-powered behavioral pattern analysis with anomaly detection
|
|
68
|
+
- 🤖 **ML-Based Emulator Detection**: Advanced machine learning techniques for emulator identification
|
|
69
|
+
- 🤖 **AI Confidence Scoring**: Confidence metrics integrated into risk assessment
|
|
21
70
|
- File access pattern analysis with entropy calculation
|
|
22
71
|
- Sensor data consistency validation
|
|
23
72
|
- Hardware fingerprinting with advanced characteristics
|
data/Gemfile.lock
CHANGED
data/README.md
CHANGED
|
@@ -4,6 +4,7 @@
|
|
|
4
4
|
[](https://opensource.org/licenses/MIT)
|
|
5
5
|
[](https://www.ruby-lang.org/)
|
|
6
6
|
[](https://github.com/ahmetxhero/ai-root-shield)
|
|
7
|
+
[](https://buymeacoffee.com/ahmetxhero)
|
|
7
8
|
|
|
8
9
|
> **Created by [Ahmet KAHRAMAN](https://ahmetxhero.web.app)** - Mobile Developer & Cyber Security Expert
|
|
9
10
|
> *"Security first, innovation always"* 🛡️
|
|
@@ -17,6 +18,15 @@ An AI-powered Ruby library that performs comprehensive on-device compromise dete
|
|
|
17
18
|
- **Hooking Framework Detection**: Detects Frida, Xposed, Substrate, and other instrumentation tools
|
|
18
19
|
- **Application Integrity Checks**: Validates app signatures and detects repackaging/tampering
|
|
19
20
|
- **Network Security Analysis**: Identifies TLS issues, custom CAs, and MITM tools
|
|
21
|
+
- **🆕 Advanced Network Security**: Certificate pinning helper and comprehensive proxy detection
|
|
22
|
+
- **🆕 Enterprise Policy Management**: JSON-based customizable security rules and compliance validation
|
|
23
|
+
- **🆕 Certificate Pinning Helper**: TLS public key pinning with easy integration
|
|
24
|
+
- **🆕 Advanced Proxy Detection**: VPN, Tor, custom DNS, and MITM appliance detection
|
|
25
|
+
- **RASP Protection**: Runtime Application Self-Protection with real-time threat blocking
|
|
26
|
+
- **Anti-Debug Mechanisms**: Ptrace, GDB, LLDB detection and blocking
|
|
27
|
+
- **Anti-Tamper Protection**: Code integrity and memory patch detection
|
|
28
|
+
- **Dynamic Memory Protection**: Frida injection hook mitigation
|
|
29
|
+
- **Runtime Integrity Monitor**: Critical function hash validation
|
|
20
30
|
- **AI Behavioral Analysis**: ONNX-powered behavioral pattern analysis with anomaly detection
|
|
21
31
|
- **ML-Based Emulator Detection**: Advanced machine learning techniques for emulator identification
|
|
22
32
|
- **AI Confidence Scoring**: Confidence metrics integrated into risk assessment
|
|
@@ -68,9 +78,9 @@ config = {
|
|
|
68
78
|
enable_hooking_detection: true,
|
|
69
79
|
enable_integrity_checks: true,
|
|
70
80
|
enable_network_analysis: true,
|
|
71
|
-
enable_ai_behavioral_analysis: true, #
|
|
81
|
+
enable_ai_behavioral_analysis: true, # v0.2.0
|
|
72
82
|
risk_threshold: 70,
|
|
73
|
-
ai_confidence_threshold: 0.7 #
|
|
83
|
+
ai_confidence_threshold: 0.7 # v0.2.0
|
|
74
84
|
}
|
|
75
85
|
|
|
76
86
|
result = AiRootShield.scan_device_with_config("device_logs/sample.json", config)
|
|
@@ -127,6 +137,102 @@ puts "AI Confidence: #{result[:ai_confidence]}"
|
|
|
127
137
|
puts "ML Emulator Score: #{result[:ml_emulator_score]}"
|
|
128
138
|
```
|
|
129
139
|
|
|
140
|
+
## Advanced Network Security & Policy Management (New in v0.4.0)
|
|
141
|
+
|
|
142
|
+
Enterprise-grade network security and policy management capabilities:
|
|
143
|
+
|
|
144
|
+
### Features
|
|
145
|
+
- **Certificate Pinning Helper**: Easy TLS public key pinning integration with common CA support
|
|
146
|
+
- **Advanced Proxy Detection**: Comprehensive detection of VPN, Tor, custom DNS, and MITM appliances
|
|
147
|
+
- **Enterprise Policy Management**: JSON-based customizable security rules and compliance validation
|
|
148
|
+
- **Policy Templates**: Pre-built policies for banking, enterprise, and development environments
|
|
149
|
+
- **Compliance Reporting**: Detailed violation tracking and audit logging
|
|
150
|
+
- **Network Analysis Integration**: Real-time network threat detection and assessment
|
|
151
|
+
|
|
152
|
+
### Usage
|
|
153
|
+
|
|
154
|
+
```ruby
|
|
155
|
+
# Configure enterprise policy
|
|
156
|
+
AiRootShield.configure_policy('examples/policies/banking_policy.json')
|
|
157
|
+
|
|
158
|
+
# Set up certificate pinning
|
|
159
|
+
pinning = AiRootShield.configure_certificate_pinning
|
|
160
|
+
pinning.add_pin('api.mybank.com', ['sha256/YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg='])
|
|
161
|
+
|
|
162
|
+
# Configure proxy detection
|
|
163
|
+
AiRootShield.configure_proxy_detection
|
|
164
|
+
|
|
165
|
+
# Scan with network analysis
|
|
166
|
+
result = AiRootShield.scan_device_with_config('device_logs.json', {
|
|
167
|
+
enable_network_analysis: true,
|
|
168
|
+
target_ip: '192.168.1.100',
|
|
169
|
+
target_url: 'https://api.mybank.com'
|
|
170
|
+
})
|
|
171
|
+
|
|
172
|
+
puts "Compliance Status: #{result[:compliance][:compliant] ? 'COMPLIANT' : 'NON-COMPLIANT'}"
|
|
173
|
+
puts "Network Analysis: #{result[:network_analysis]}"
|
|
174
|
+
```
|
|
175
|
+
|
|
176
|
+
### CLI Usage
|
|
177
|
+
|
|
178
|
+
```bash
|
|
179
|
+
# Scan with enterprise policy and network security
|
|
180
|
+
$ ai_root_shield --policy examples/policies/banking_policy.json \
|
|
181
|
+
--enable-cert-pinning \
|
|
182
|
+
--enable-proxy-detection \
|
|
183
|
+
--target-url https://api.mybank.com \
|
|
184
|
+
--verbose device_logs.json
|
|
185
|
+
```
|
|
186
|
+
|
|
187
|
+
## RASP Protection (v0.3.0)
|
|
188
|
+
|
|
189
|
+
Runtime Application Self-Protection provides real-time threat detection and blocking:
|
|
190
|
+
|
|
191
|
+
### Features
|
|
192
|
+
- **Anti-Debug Protection**: Detects and blocks ptrace, GDB, LLDB, and other debuggers
|
|
193
|
+
- **Anti-Tamper Protection**: Monitors code integrity and detects memory patches
|
|
194
|
+
- **Dynamic Memory Protection**: Prevents Frida injection and hook attempts
|
|
195
|
+
- **Runtime Integrity Monitor**: Validates critical function hashes in real-time
|
|
196
|
+
- **Real-Time Event Reporting**: Instant alerts for security violations
|
|
197
|
+
|
|
198
|
+
### Usage
|
|
199
|
+
|
|
200
|
+
```ruby
|
|
201
|
+
# Start RASP protection
|
|
202
|
+
rasp = AiRootShield.start_rasp_protection(
|
|
203
|
+
enable_anti_debug: true,
|
|
204
|
+
enable_anti_tamper: true,
|
|
205
|
+
enable_memory_protection: true,
|
|
206
|
+
enable_integrity_monitor: true,
|
|
207
|
+
enable_real_time_alerts: true,
|
|
208
|
+
protection_interval: 1.0
|
|
209
|
+
)
|
|
210
|
+
|
|
211
|
+
# Register event callback
|
|
212
|
+
rasp.on_rasp_event do |event|
|
|
213
|
+
puts "[RASP] #{event[:type]}: #{event[:message]}"
|
|
214
|
+
# Take action based on threat type
|
|
215
|
+
end
|
|
216
|
+
|
|
217
|
+
# Check protection status
|
|
218
|
+
status = rasp.protection_status
|
|
219
|
+
puts "RASP Active: #{status[:active]}"
|
|
220
|
+
puts "Events Detected: #{status[:events_detected]}"
|
|
221
|
+
|
|
222
|
+
# Stop protection when done
|
|
223
|
+
AiRootShield.stop_rasp_protection
|
|
224
|
+
```
|
|
225
|
+
|
|
226
|
+
### CLI RASP Support
|
|
227
|
+
|
|
228
|
+
```bash
|
|
229
|
+
# Enable RASP protection during scan
|
|
230
|
+
$ ai_root_shield --enable-rasp --rasp-time 10 --verbose device_logs.json
|
|
231
|
+
|
|
232
|
+
# Monitor for 30 seconds with RASP
|
|
233
|
+
$ ai_root_shield --enable-rasp --rasp-time 30 device_logs.json
|
|
234
|
+
```
|
|
235
|
+
|
|
130
236
|
## Risk Scoring
|
|
131
237
|
|
|
132
238
|
The library provides a comprehensive risk score (0-100) based on detected security factors:
|
|
@@ -170,7 +276,7 @@ The library expects device logs in JSON format with the following structure:
|
|
|
170
276
|
"ABNORMAL_TIMING_PATTERNS"
|
|
171
277
|
],
|
|
172
278
|
"timestamp": 1640995200,
|
|
173
|
-
"version": "0.
|
|
279
|
+
"version": "0.3.0"
|
|
174
280
|
}
|
|
175
281
|
```
|
|
176
282
|
|
|
@@ -0,0 +1,79 @@
|
|
|
1
|
+
{
|
|
2
|
+
"version": "1.0",
|
|
3
|
+
"name": "Banking Security Policy",
|
|
4
|
+
"description": "High-security policy for banking and financial applications",
|
|
5
|
+
"minimum_security_level": 95,
|
|
6
|
+
"compliance_rules": {
|
|
7
|
+
"device_requirements": {
|
|
8
|
+
"allow_rooted_devices": false,
|
|
9
|
+
"allow_jailbroken_devices": false,
|
|
10
|
+
"allow_emulators": false,
|
|
11
|
+
"require_screen_lock": true,
|
|
12
|
+
"minimum_os_version": {
|
|
13
|
+
"android": "10.0",
|
|
14
|
+
"ios": "14.0"
|
|
15
|
+
},
|
|
16
|
+
"require_biometric_authentication": true,
|
|
17
|
+
"require_device_encryption": true
|
|
18
|
+
},
|
|
19
|
+
"network_security": {
|
|
20
|
+
"allow_vpn": false,
|
|
21
|
+
"allow_proxy": false,
|
|
22
|
+
"allow_tor": false,
|
|
23
|
+
"require_certificate_pinning": true,
|
|
24
|
+
"allowed_dns_servers": [
|
|
25
|
+
"8.8.8.8",
|
|
26
|
+
"1.1.1.1"
|
|
27
|
+
],
|
|
28
|
+
"blocked_dns_servers": [],
|
|
29
|
+
"require_tls_1_3_minimum": true,
|
|
30
|
+
"block_self_signed_certificates": true,
|
|
31
|
+
"require_hsts": true
|
|
32
|
+
},
|
|
33
|
+
"application_integrity": {
|
|
34
|
+
"allow_debug_builds": false,
|
|
35
|
+
"allow_repackaged_apps": false,
|
|
36
|
+
"require_code_signing": true,
|
|
37
|
+
"allowed_certificate_issuers": [
|
|
38
|
+
"Bank Certificate Authority"
|
|
39
|
+
],
|
|
40
|
+
"require_app_store_installation": true,
|
|
41
|
+
"block_sideloaded_apps": true,
|
|
42
|
+
"require_integrity_verification": true
|
|
43
|
+
},
|
|
44
|
+
"runtime_protection": {
|
|
45
|
+
"enable_rasp": true,
|
|
46
|
+
"allow_debugging": false,
|
|
47
|
+
"allow_hooking_frameworks": false,
|
|
48
|
+
"enable_tamper_detection": true,
|
|
49
|
+
"enable_anti_debug": true,
|
|
50
|
+
"enable_memory_protection": true,
|
|
51
|
+
"protection_interval": 500,
|
|
52
|
+
"enable_screenshot_protection": true
|
|
53
|
+
}
|
|
54
|
+
},
|
|
55
|
+
"risk_thresholds": {
|
|
56
|
+
"low": 5,
|
|
57
|
+
"medium": 15,
|
|
58
|
+
"high": 30,
|
|
59
|
+
"critical": 50
|
|
60
|
+
},
|
|
61
|
+
"actions": {
|
|
62
|
+
"on_policy_violation": "immediate_block",
|
|
63
|
+
"on_high_risk": "immediate_block",
|
|
64
|
+
"on_critical_risk": "immediate_block",
|
|
65
|
+
"custom_actions": {
|
|
66
|
+
"any_security_threat": "immediate_block_and_alert"
|
|
67
|
+
}
|
|
68
|
+
},
|
|
69
|
+
"reporting": {
|
|
70
|
+
"enable_audit_logs": true,
|
|
71
|
+
"log_level": "info",
|
|
72
|
+
"retention_days": 365,
|
|
73
|
+
"enable_real_time_alerts": true,
|
|
74
|
+
"alert_endpoints": [
|
|
75
|
+
"https://security.bank.com/critical-alerts",
|
|
76
|
+
"https://soc.bank.com/mobile-threats"
|
|
77
|
+
]
|
|
78
|
+
}
|
|
79
|
+
}
|
|
@@ -0,0 +1,64 @@
|
|
|
1
|
+
{
|
|
2
|
+
"version": "1.0",
|
|
3
|
+
"name": "Development Environment Policy",
|
|
4
|
+
"description": "Relaxed policy for development and testing environments",
|
|
5
|
+
"minimum_security_level": 40,
|
|
6
|
+
"compliance_rules": {
|
|
7
|
+
"device_requirements": {
|
|
8
|
+
"allow_rooted_devices": true,
|
|
9
|
+
"allow_jailbroken_devices": true,
|
|
10
|
+
"allow_emulators": true,
|
|
11
|
+
"require_screen_lock": false,
|
|
12
|
+
"minimum_os_version": {
|
|
13
|
+
"android": "7.0",
|
|
14
|
+
"ios": "11.0"
|
|
15
|
+
}
|
|
16
|
+
},
|
|
17
|
+
"network_security": {
|
|
18
|
+
"allow_vpn": true,
|
|
19
|
+
"allow_proxy": true,
|
|
20
|
+
"allow_tor": false,
|
|
21
|
+
"require_certificate_pinning": false,
|
|
22
|
+
"allowed_dns_servers": [],
|
|
23
|
+
"blocked_dns_servers": [],
|
|
24
|
+
"require_tls_1_2_minimum": false,
|
|
25
|
+
"block_self_signed_certificates": false
|
|
26
|
+
},
|
|
27
|
+
"application_integrity": {
|
|
28
|
+
"allow_debug_builds": true,
|
|
29
|
+
"allow_repackaged_apps": true,
|
|
30
|
+
"require_code_signing": false,
|
|
31
|
+
"allowed_certificate_issuers": [],
|
|
32
|
+
"require_app_store_installation": false,
|
|
33
|
+
"block_sideloaded_apps": false
|
|
34
|
+
},
|
|
35
|
+
"runtime_protection": {
|
|
36
|
+
"enable_rasp": false,
|
|
37
|
+
"allow_debugging": true,
|
|
38
|
+
"allow_hooking_frameworks": true,
|
|
39
|
+
"enable_tamper_detection": false,
|
|
40
|
+
"enable_anti_debug": false,
|
|
41
|
+
"enable_memory_protection": false,
|
|
42
|
+
"protection_interval": 5000
|
|
43
|
+
}
|
|
44
|
+
},
|
|
45
|
+
"risk_thresholds": {
|
|
46
|
+
"low": 30,
|
|
47
|
+
"medium": 60,
|
|
48
|
+
"high": 80,
|
|
49
|
+
"critical": 95
|
|
50
|
+
},
|
|
51
|
+
"actions": {
|
|
52
|
+
"on_policy_violation": "log_only",
|
|
53
|
+
"on_high_risk": "log_only",
|
|
54
|
+
"on_critical_risk": "alert",
|
|
55
|
+
"custom_actions": {}
|
|
56
|
+
},
|
|
57
|
+
"reporting": {
|
|
58
|
+
"enable_audit_logs": true,
|
|
59
|
+
"log_level": "debug",
|
|
60
|
+
"retention_days": 30,
|
|
61
|
+
"enable_real_time_alerts": false,
|
|
62
|
+
"alert_endpoints": []
|
|
63
|
+
}
|
|
64
|
+
}
|
|
@@ -0,0 +1,89 @@
|
|
|
1
|
+
{
|
|
2
|
+
"version": "1.0",
|
|
3
|
+
"name": "Enterprise Security Policy",
|
|
4
|
+
"description": "Comprehensive enterprise security policy for mobile applications",
|
|
5
|
+
"minimum_security_level": 80,
|
|
6
|
+
"compliance_rules": {
|
|
7
|
+
"device_requirements": {
|
|
8
|
+
"allow_rooted_devices": false,
|
|
9
|
+
"allow_jailbroken_devices": false,
|
|
10
|
+
"allow_emulators": false,
|
|
11
|
+
"require_screen_lock": true,
|
|
12
|
+
"minimum_os_version": {
|
|
13
|
+
"android": "9.0",
|
|
14
|
+
"ios": "13.0"
|
|
15
|
+
},
|
|
16
|
+
"allowed_device_models": [],
|
|
17
|
+
"blocked_device_models": []
|
|
18
|
+
},
|
|
19
|
+
"network_security": {
|
|
20
|
+
"allow_vpn": false,
|
|
21
|
+
"allow_proxy": false,
|
|
22
|
+
"allow_tor": false,
|
|
23
|
+
"require_certificate_pinning": true,
|
|
24
|
+
"allowed_dns_servers": [
|
|
25
|
+
"8.8.8.8",
|
|
26
|
+
"8.8.4.4",
|
|
27
|
+
"1.1.1.1",
|
|
28
|
+
"1.0.0.1"
|
|
29
|
+
],
|
|
30
|
+
"blocked_dns_servers": [
|
|
31
|
+
"94.140.14.14",
|
|
32
|
+
"76.76.19.19"
|
|
33
|
+
],
|
|
34
|
+
"require_tls_1_2_minimum": true,
|
|
35
|
+
"block_self_signed_certificates": true
|
|
36
|
+
},
|
|
37
|
+
"application_integrity": {
|
|
38
|
+
"allow_debug_builds": false,
|
|
39
|
+
"allow_repackaged_apps": false,
|
|
40
|
+
"require_code_signing": true,
|
|
41
|
+
"allowed_certificate_issuers": [
|
|
42
|
+
"Apple Inc.",
|
|
43
|
+
"Google Inc.",
|
|
44
|
+
"Enterprise CA"
|
|
45
|
+
],
|
|
46
|
+
"require_app_store_installation": true,
|
|
47
|
+
"block_sideloaded_apps": true
|
|
48
|
+
},
|
|
49
|
+
"runtime_protection": {
|
|
50
|
+
"enable_rasp": true,
|
|
51
|
+
"allow_debugging": false,
|
|
52
|
+
"allow_hooking_frameworks": false,
|
|
53
|
+
"enable_tamper_detection": true,
|
|
54
|
+
"enable_anti_debug": true,
|
|
55
|
+
"enable_memory_protection": true,
|
|
56
|
+
"protection_interval": 1000
|
|
57
|
+
}
|
|
58
|
+
},
|
|
59
|
+
"risk_thresholds": {
|
|
60
|
+
"low": 15,
|
|
61
|
+
"medium": 35,
|
|
62
|
+
"high": 60,
|
|
63
|
+
"critical": 80
|
|
64
|
+
},
|
|
65
|
+
"actions": {
|
|
66
|
+
"on_policy_violation": "block",
|
|
67
|
+
"on_high_risk": "alert_and_log",
|
|
68
|
+
"on_critical_risk": "block_and_alert",
|
|
69
|
+
"custom_actions": {
|
|
70
|
+
"device_rooted": "immediate_block",
|
|
71
|
+
"tor_detected": "immediate_block",
|
|
72
|
+
"debugging_detected": "immediate_block"
|
|
73
|
+
}
|
|
74
|
+
},
|
|
75
|
+
"reporting": {
|
|
76
|
+
"enable_audit_logs": true,
|
|
77
|
+
"log_level": "warning",
|
|
78
|
+
"retention_days": 180,
|
|
79
|
+
"enable_real_time_alerts": true,
|
|
80
|
+
"alert_endpoints": [
|
|
81
|
+
"https://security.company.com/alerts"
|
|
82
|
+
]
|
|
83
|
+
},
|
|
84
|
+
"exemptions": {
|
|
85
|
+
"test_devices": [],
|
|
86
|
+
"development_environments": [],
|
|
87
|
+
"emergency_override_codes": []
|
|
88
|
+
}
|
|
89
|
+
}
|