@panguard-ai/panguard-trap 0.1.0

package/dist/profiler/attacker-profiler.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Attacker Profiling Engine
+ * 攻擊者分析引擎
+ *
+ * Analyzes trap sessions to build attacker profiles:
+ * - Skill level estimation
+ * - Intent classification
+ * - Tool detection
+ * - Credential pattern analysis
+ * - MITRE ATT&CK technique mapping
+ *
+ * 分析蜜罐連線以建立攻擊者 profile：
+ * - 技術水準估計
+ * - 意圖分類
+ * - 工具偵測
+ * - 認證模式分析
+ * - MITRE ATT&CK 技術映射
+ *
+ * @module @panguard-ai/panguard-trap/profiler/attacker-profiler
+ */
+import type { TrapSession, AttackerProfile, AttackerSkillLevel, AttackerIntent } from '../types.js';
+/**
+ * Estimate attacker skill level based on behavior
+ * 根據行為估計攻擊者技術水準
+ */
+export declare function estimateSkillLevel(commands: string[], mitreTechniques: string[], toolsDetected: string[]): {
+    level: AttackerSkillLevel;
+    score: number;
+};
+/**
+ * Classify attacker intent based on behavior
+ * 根據行為分類攻擊者意圖
+ */
+export declare function classifyIntent(commands: string[], mitreTechniques: string[]): AttackerIntent;
+/**
+ * Detect tools used by attacker
+ * 偵測攻擊者使用的工具
+ */
+export declare function detectTools(commands: string[], userAgents?: string[]): string[];
+/**
+ * AttackerProfiler - builds and maintains attacker profiles
+ * AttackerProfiler - 建立和維護攻擊者 profile
+ */
+export declare class AttackerProfiler {
+    private profiles;
+    private ipToProfile;
+    private profileCounter;
+    /**
+     * Process a completed trap session and update/create attacker profile
+     * 處理已完成的蜜罐連線並更新/建立攻擊者 profile
+     */
+    processSession(session: TrapSession): AttackerProfile;
+    /** Get a profile by ID / 依 ID 取得 profile */
+    getProfile(profileId: string): AttackerProfile | undefined;
+    /** Get profile by IP / 依 IP 取得 profile */
+    getProfileByIP(ip: string): AttackerProfile | undefined;
+    /** Get all profiles / 取得所有 profiles */
+    getAllProfiles(): AttackerProfile[];
+    /** Get top attackers by risk score / 依風險分數取得前幾名攻擊者 */
+    getTopAttackers(limit?: number): AttackerProfile[];
+    /** Get profile count / 取得 profile 數量 */
+    getProfileCount(): number;
+    /** Clear all profiles / 清除所有 profiles */
+    clear(): void;
+    private createProfile;
+    private updateProfile;
+}
+//# sourceMappingURL=attacker-profiler.d.ts.map

package/dist/profiler/attacker-profiler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attacker-profiler.d.ts","sourceRoot":"","sources":["../../src/profiler/attacker-profiler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AA2CpG;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAAE,EAClB,eAAe,EAAE,MAAM,EAAE,EACzB,aAAa,EAAE,MAAM,EAAE,GACtB;IAAE,KAAK,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAoC9C;AAkCD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,cAAc,CA2C5F;AAOD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAc/E;AAOD;;;GAGG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAA2C;IAC3D,OAAO,CAAC,WAAW,CAAkC;IACrD,OAAO,CAAC,cAAc,CAAK;IAE3B;;;OAGG;IACH,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,eAAe;IAsBrD,4CAA4C;IAC5C,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAI1D,0CAA0C;IAC1C,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAKvD,uCAAuC;IACvC,cAAc,IAAI,eAAe,EAAE;IAInC,sDAAsD;IACtD,eAAe,CAAC,KAAK,SAAK,GAAG,eAAe,EAAE;IAM9C,wCAAwC;IACxC,eAAe,IAAI,MAAM;IAIzB,yCAAyC;IACzC,KAAK,IAAI,IAAI;IASb,OAAO,CAAC,aAAa;IA4BrB,OAAO,CAAC,aAAa;CA6CtB"}

package/dist/profiler/attacker-profiler.js

@@ -0,0 +1,316 @@
+/**
+ * Attacker Profiling Engine
+ * 攻擊者分析引擎
+ *
+ * Analyzes trap sessions to build attacker profiles:
+ * - Skill level estimation
+ * - Intent classification
+ * - Tool detection
+ * - Credential pattern analysis
+ * - MITRE ATT&CK technique mapping
+ *
+ * 分析蜜罐連線以建立攻擊者 profile：
+ * - 技術水準估計
+ * - 意圖分類
+ * - 工具偵測
+ * - 認證模式分析
+ * - MITRE ATT&CK 技術映射
+ *
+ * @module @panguard-ai/panguard-trap/profiler/attacker-profiler
+ */
+import { createLogger } from '@panguard-ai/core';
+const logger = createLogger('panguard-trap:profiler');
+// ---------------------------------------------------------------------------
+// Skill Level Estimation
+// 技術水準估計
+// ---------------------------------------------------------------------------
+/** Known tool signatures / 已知工具特徵 */
+const TOOL_SIGNATURES = [
+    { pattern: /nmap/i, tool: 'nmap', skillBoost: 10 },
+    { pattern: /metasploit|msfconsole|meterpreter/i, tool: 'Metasploit', skillBoost: 20 },
+    { pattern: /hydra/i, tool: 'Hydra', skillBoost: 15 },
+    { pattern: /sqlmap/i, tool: 'sqlmap', skillBoost: 15 },
+    { pattern: /nikto/i, tool: 'Nikto', skillBoost: 10 },
+    { pattern: /gobuster|dirbuster|dirb/i, tool: 'Directory Buster', skillBoost: 10 },
+    { pattern: /burp/i, tool: 'Burp Suite', skillBoost: 20 },
+    { pattern: /cobalt\s*strike|beacon/i, tool: 'Cobalt Strike', skillBoost: 40 },
+    { pattern: /mimikatz/i, tool: 'Mimikatz', skillBoost: 30 },
+    { pattern: /bloodhound/i, tool: 'BloodHound', skillBoost: 30 },
+    { pattern: /empire|stager/i, tool: 'Empire', skillBoost: 25 },
+    { pattern: /xmrig|minergate|cryptonight/i, tool: 'Cryptominer', skillBoost: 5 },
+    { pattern: /masscan/i, tool: 'Masscan', skillBoost: 10 },
+    { pattern: /wpscan/i, tool: 'WPScan', skillBoost: 10 },
+];
+/** Advanced command patterns that indicate higher skill / 表示較高技術的進階指令模式 */
+const ADVANCED_PATTERNS = [
+    /base64\s+-d/i,
+    /python\s+-c/i,
+    /perl\s+-e/i,
+    /awk\s+'{/i,
+    /sed\s+-[ie]/i,
+    /\/proc\/self/i,
+    /ld_preload/i,
+    /ptrace/i,
+    /ebpf|bpf/i,
+    /\.\.\/\.\.\/\.\.\/etc/i,
+    /reverse.*shell/i,
+    /bind.*shell/i,
+];
+/**
+ * Estimate attacker skill level based on behavior
+ * 根據行為估計攻擊者技術水準
+ */
+export function estimateSkillLevel(commands, mitreTechniques, toolsDetected) {
+    let score = 0;
+    // Base score from technique count
+    score += mitreTechniques.length * 5;
+    // Tool-based scoring
+    score += toolsDetected.length * 8;
+    // Advanced command patterns
+    for (const cmd of commands) {
+        for (const pattern of ADVANCED_PATTERNS) {
+            if (pattern.test(cmd)) {
+                score += 10;
+                break;
+            }
+        }
+    }
+    // Command diversity
+    const uniqueCommands = new Set(commands.map((c) => c.split(' ')[0]?.toLowerCase()));
+    if (uniqueCommands.size > 10)
+        score += 15;
+    else if (uniqueCommands.size > 5)
+        score += 8;
+    // MITRE technique diversity
+    if (mitreTechniques.length > 5)
+        score += 20;
+    else if (mitreTechniques.length > 3)
+        score += 10;
+    // Classify
+    let level;
+    if (score >= 60)
+        level = 'apt';
+    else if (score >= 35)
+        level = 'advanced';
+    else if (score >= 15)
+        level = 'intermediate';
+    else
+        level = 'script_kiddie';
+    return { level, score: Math.min(score, 100) };
+}
+// ---------------------------------------------------------------------------
+// Intent Classification
+// 意圖分類
+// ---------------------------------------------------------------------------
+/** Intent indicators / 意圖指標 */
+const INTENT_INDICATORS = [
+    {
+        pattern: /whoami|id\s|uname|hostname|ifconfig|ip\s+addr|cat\s+\/etc\/passwd/i,
+        intent: 'reconnaissance',
+        weight: 3,
+    },
+    {
+        pattern: /shadow|passwd|credential|hash|dump|mimikatz/i,
+        intent: 'credential_harvesting',
+        weight: 5,
+    },
+    {
+        pattern: /encrypt|ransom|lockbit|cryptolocker|\.locked|\.crypt/i,
+        intent: 'ransomware_deployment',
+        weight: 8,
+    },
+    { pattern: /xmrig|miner|cryptonight|stratum|pool\./i, intent: 'cryptomining', weight: 8 },
+    {
+        pattern: /tar\s+.*\.gz|zip\s+|scp\s+|rsync|curl.*upload|wget.*post/i,
+        intent: 'data_theft',
+        weight: 5,
+    },
+    { pattern: /irc\s|c2\s|beacon|callback|botnet|zombie/i, intent: 'botnet_recruitment', weight: 6 },
+    { pattern: /ssh\s+\w+@|psexec|wmic|net\s+use|smbclient/i, intent: 'lateral_movement', weight: 5 },
+];
+/**
+ * Classify attacker intent based on behavior
+ * 根據行為分類攻擊者意圖
+ */
+export function classifyIntent(commands, mitreTechniques) {
+    const scores = {};
+    for (const cmd of commands) {
+        for (const indicator of INTENT_INDICATORS) {
+            if (indicator.pattern.test(cmd)) {
+                scores[indicator.intent] = (scores[indicator.intent] ?? 0) + indicator.weight;
+            }
+        }
+    }
+    const techniqueToIntent = {
+        T1082: 'reconnaissance',
+        T1016: 'reconnaissance',
+        T1057: 'reconnaissance',
+        T1003: 'credential_harvesting',
+        T1110: 'credential_harvesting',
+        T1486: 'ransomware_deployment',
+        T1496: 'cryptomining',
+        T1005: 'data_theft',
+        T1041: 'data_theft',
+        T1021: 'lateral_movement',
+        T1570: 'lateral_movement',
+    };
+    for (const tech of mitreTechniques) {
+        const intent = techniqueToIntent[tech];
+        if (intent) {
+            scores[intent] = (scores[intent] ?? 0) + 3;
+        }
+    }
+    let maxScore = 0;
+    let maxIntent = 'unknown';
+    for (const [intent, score] of Object.entries(scores)) {
+        if (score > maxScore) {
+            maxScore = score;
+            maxIntent = intent;
+        }
+    }
+    return maxIntent;
+}
+// ---------------------------------------------------------------------------
+// Tool Detection
+// 工具偵測
+// ---------------------------------------------------------------------------
+/**
+ * Detect tools used by attacker
+ * 偵測攻擊者使用的工具
+ */
+export function detectTools(commands, userAgents) {
+    const tools = new Set();
+    const allInputs = [...commands, ...(userAgents ?? [])];
+    for (const input of allInputs) {
+        for (const sig of TOOL_SIGNATURES) {
+            if (sig.pattern.test(input)) {
+                tools.add(sig.tool);
+            }
+        }
+    }
+    return Array.from(tools);
+}
+// ---------------------------------------------------------------------------
+// Attacker Profiler
+// 攻擊者分析器
+// ---------------------------------------------------------------------------
+/**
+ * AttackerProfiler - builds and maintains attacker profiles
+ * AttackerProfiler - 建立和維護攻擊者 profile
+ */
+export class AttackerProfiler {
+    profiles = new Map();
+    ipToProfile = new Map();
+    profileCounter = 0;
+    /**
+     * Process a completed trap session and update/create attacker profile
+     * 處理已完成的蜜罐連線並更新/建立攻擊者 profile
+     */
+    processSession(session) {
+        const existingProfileId = this.ipToProfile.get(session.sourceIP);
+        let profile;
+        if (existingProfileId) {
+            profile = this.profiles.get(existingProfileId);
+            this.updateProfile(profile, session);
+        }
+        else {
+            profile = this.createProfile(session);
+            this.profiles.set(profile.profileId, profile);
+            this.ipToProfile.set(session.sourceIP, profile.profileId);
+        }
+        session.attackerProfileId = profile.profileId;
+        logger.info(`Attacker profile updated: ${profile.profileId} (skill=${profile.skillLevel}, intent=${profile.intent}) / 攻擊者 profile 已更新`);
+        return profile;
+    }
+    /** Get a profile by ID / 依 ID 取得 profile */
+    getProfile(profileId) {
+        return this.profiles.get(profileId);
+    }
+    /** Get profile by IP / 依 IP 取得 profile */
+    getProfileByIP(ip) {
+        const profileId = this.ipToProfile.get(ip);
+        return profileId ? this.profiles.get(profileId) : undefined;
+    }
+    /** Get all profiles / 取得所有 profiles */
+    getAllProfiles() {
+        return Array.from(this.profiles.values());
+    }
+    /** Get top attackers by risk score / 依風險分數取得前幾名攻擊者 */
+    getTopAttackers(limit = 10) {
+        return this.getAllProfiles()
+            .sort((a, b) => b.riskScore - a.riskScore)
+            .slice(0, limit);
+    }
+    /** Get profile count / 取得 profile 數量 */
+    getProfileCount() {
+        return this.profiles.size;
+    }
+    /** Clear all profiles / 清除所有 profiles */
+    clear() {
+        this.profiles.clear();
+        this.ipToProfile.clear();
+    }
+    // -------------------------------------------------------------------------
+    // Internal
+    // -------------------------------------------------------------------------
+    createProfile(session) {
+        this.profileCounter += 1;
+        const profileId = `atk-${Date.now().toString(36)}-${this.profileCounter.toString(36).padStart(3, '0')}`;
+        const tools = detectTools(session.commands);
+        const { level, score } = estimateSkillLevel(session.commands, session.mitreTechniques, tools);
+        const intent = classifyIntent(session.commands, session.mitreTechniques);
+        return {
+            profileId,
+            sourceIPs: [session.sourceIP],
+            firstSeen: session.startTime,
+            lastSeen: session.endTime ?? session.startTime,
+            totalSessions: 1,
+            skillLevel: level,
+            intent,
+            toolsDetected: tools,
+            mitreTechniques: [...session.mitreTechniques],
+            credentialPatterns: {
+                commonUsernames: session.credentials.map((c) => c.username).filter(Boolean),
+                commonPasswords: session.credentials.map((c) => c.password).filter(Boolean),
+                totalAttempts: session.credentials.length,
+            },
+            geoHints: {},
+            riskScore: score,
+        };
+    }
+    updateProfile(profile, session) {
+        if (!profile.sourceIPs.includes(session.sourceIP)) {
+            profile.sourceIPs.push(session.sourceIP);
+        }
+        profile.lastSeen = session.endTime ?? session.startTime;
+        profile.totalSessions += 1;
+        for (const tech of session.mitreTechniques) {
+            if (!profile.mitreTechniques.includes(tech)) {
+                profile.mitreTechniques.push(tech);
+            }
+        }
+        const newTools = detectTools(session.commands);
+        for (const tool of newTools) {
+            if (!profile.toolsDetected.includes(tool)) {
+                profile.toolsDetected.push(tool);
+            }
+        }
+        for (const cred of session.credentials) {
+            if (cred.username && !profile.credentialPatterns.commonUsernames.includes(cred.username)) {
+                profile.credentialPatterns.commonUsernames.push(cred.username);
+            }
+            if (cred.password && !profile.credentialPatterns.commonPasswords.includes(cred.password)) {
+                profile.credentialPatterns.commonPasswords.push(cred.password);
+            }
+        }
+        profile.credentialPatterns.totalAttempts += session.credentials.length;
+        const { level, score } = estimateSkillLevel(session.commands, profile.mitreTechniques, profile.toolsDetected);
+        const SKILL_ORDER = ['script_kiddie', 'intermediate', 'advanced', 'apt'];
+        if (SKILL_ORDER.indexOf(level) > SKILL_ORDER.indexOf(profile.skillLevel)) {
+            profile.skillLevel = level;
+        }
+        profile.riskScore = Math.max(profile.riskScore, score);
+        profile.intent = classifyIntent(session.commands, profile.mitreTechniques);
+    }
+}
+//# sourceMappingURL=attacker-profiler.js.map

package/dist/profiler/attacker-profiler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attacker-profiler.js","sourceRoot":"","sources":["../../src/profiler/attacker-profiler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjD,MAAM,MAAM,GAAG,YAAY,CAAC,wBAAwB,CAAC,CAAC;AAEtD,8EAA8E;AAC9E,yBAAyB;AACzB,SAAS;AACT,8EAA8E;AAE9E,qCAAqC;AACrC,MAAM,eAAe,GAA4D;IAC/E,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE;IAClD,EAAE,OAAO,EAAE,oCAAoC,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,EAAE;IACrF,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE;IACpD,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;IACtD,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE;IACpD,EAAE,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE,kBAAkB,EAAE,UAAU,EAAE,EAAE,EAAE;IACjF,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,EAAE;IACxD,EAAE,OAAO,EAAE,yBAAyB,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,EAAE;IAC7E,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE;IAC1D,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,EAAE;IAC9D,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;IAC7D,EAAE,OAAO,EAAE,8BAA8B,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,EAAE;IAC/E,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE;IACxD,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;CACvD,CAAC;AAEF,2EAA2E;AAC3E,MAAM,iBAAiB,GAAa;IAClC,cAAc;IACd,cAAc;IACd,YAAY;IACZ,WAAW;IACX,cAAc;IACd,eAAe;IACf,aAAa;IACb,SAAS;IACT,WAAW;IACX,wBAAwB;IACxB,iBAAiB;IACjB,cAAc;CACf,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAkB,EAClB,eAAyB,EACzB,aAAuB;IAEvB,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,kCAAkC;IAClC,KAAK,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAEpC,qBAAqB;IACrB,KAAK,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IAElC,4BAA4B;IAC5B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACxC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,KAAK,IAAI,EAAE,CAAC;gBACZ,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IACpF,IAAI,cAAc,CAAC,IAAI,GAAG,EAAE;QAAE,KAAK,IAAI,EAAE,CAAC;SACrC,IAAI,cAAc,CAAC,IAAI,GAAG,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IAE7C,4BAA4B;IAC5B,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,IAAI,EAAE,CAAC;SACvC,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,IAAI,EAAE,CAAC;IAEjD,WAAW;IACX,IAAI,KAAyB,CAAC;IAC9B,IAAI,KAAK,IAAI,EAAE;QAAE,KAAK,GAAG,KAAK,CAAC;SAC1B,IAAI,KAAK,IAAI,EAAE;QAAE,KAAK,GAAG,UAAU,CAAC;SACpC,IAAI,KAAK,IAAI,EAAE;QAAE,KAAK,GAAG,cAAc,CAAC;;QACxC,KAAK,GAAG,eAAe,CAAC;IAE7B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,OAAO;AACP,8EAA8E;AAE9E,+BAA+B;AAC/B,MAAM,iBAAiB,GAAkE;IACvF;QACE,OAAO,EAAE,oEAAoE;QAC7E,MAAM,EAAE,gBAAgB;QACxB,MAAM,EAAE,CAAC;KACV;IACD;QACE,OAAO,EAAE,8CAA8C;QACvD,MAAM,EAAE,uBAAuB;QAC/B,MAAM,EAAE,CAAC;KACV;IACD;QACE,OAAO,EAAE,uDAAuD;QAChE,MAAM,EAAE,uBAAuB;QAC/B,MAAM,EAAE,CAAC;KACV;IACD,EAAE,OAAO,EAAE,yCAAyC,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE;IACzF;QACE,OAAO,EAAE,2DAA2D;QACpE,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,CAAC;KACV;IACD,EAAE,OAAO,EAAE,2CAA2C,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,CAAC,EAAE;IACjG,EAAE,OAAO,EAAE,6CAA6C,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,EAAE;CAClG,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAkB,EAAE,eAAyB;IAC1E,MAAM,MAAM,GAA4C,EAAE,CAAC;IAE3D,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,KAAK,MAAM,SAAS,IAAI,iBAAiB,EAAE,CAAC;YAC1C,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAmC;QACxD,KAAK,EAAE,gBAAgB;QACvB,KAAK,EAAE,gBAAgB;QACvB,KAAK,EAAE,gBAAgB;QACvB,KAAK,EAAE,uBAAuB;QAC9B,KAAK,EAAE,uBAAuB;QAC9B,KAAK,EAAE,uBAAuB;QAC9B,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,YAAY;QACnB,KAAK,EAAE,YAAY;QACnB,KAAK,EAAE,kBAAkB;QACzB,KAAK,EAAE,kBAAkB;KAC1B,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,SAAS,GAAmB,SAAS,CAAC;IAE1C,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,QAAQ,GAAG,KAAK,CAAC;YACjB,SAAS,GAAG,MAAwB,CAAC;QACvC,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,OAAO;AACP,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,QAAkB,EAAE,UAAqB;IACnE,MAAM,KAAK,GAAgB,IAAI,GAAG,EAAE,CAAC;IAErC,MAAM,SAAS,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;IAEvD,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YAClC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,SAAS;AACT,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IACnB,QAAQ,GAAiC,IAAI,GAAG,EAAE,CAAC;IACnD,WAAW,GAAwB,IAAI,GAAG,EAAE,CAAC;IAC7C,cAAc,GAAG,CAAC,CAAC;IAE3B;;;OAGG;IACH,cAAc,CAAC,OAAoB;QACjC,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,OAAwB,CAAC;QAE7B,IAAI,iBAAiB,EAAE,CAAC;YACtB,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAE,CAAC;YAChD,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,CAAC,iBAAiB,GAAG,OAAO,CAAC,SAAS,CAAC;QAE9C,MAAM,CAAC,IAAI,CACT,6BAA6B,OAAO,CAAC,SAAS,WAAW,OAAO,CAAC,UAAU,YAAY,OAAO,CAAC,MAAM,qBAAqB,CAC3H,CAAC;QAEF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,4CAA4C;IAC5C,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,0CAA0C;IAC1C,cAAc,CAAC,EAAU;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;IAED,uCAAuC;IACvC,cAAc;QACZ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,sDAAsD;IACtD,eAAe,CAAC,KAAK,GAAG,EAAE;QACxB,OAAO,IAAI,CAAC,cAAc,EAAE;aACzB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;aACzC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,wCAAwC;IACxC,eAAe;QACb,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,yCAAyC;IACzC,KAAK;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,4EAA4E;IAC5E,WAAW;IACX,4EAA4E;IAEpE,aAAa,CAAC,OAAoB;QACxC,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC;QACzB,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAExG,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QAEzE,OAAO;YACL,SAAS;YACT,SAAS,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC7B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS;YAC9C,aAAa,EAAE,CAAC;YAChB,UAAU,EAAE,KAAK;YACjB,MAAM;YACN,aAAa,EAAE,KAAK;YACpB,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;YAC7C,kBAAkB,EAAE;gBAClB,eAAe,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC3E,eAAe,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC3E,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,MAAM;aAC1C;YACD,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAEO,aAAa,CAAC,OAAwB,EAAE,OAAoB;QAClE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC;QACxD,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC;QAE3B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC3C,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5C,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzF,OAAO,CAAC,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzF,OAAO,CAAC,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QACD,OAAO,CAAC,kBAAkB,CAAC,aAAa,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC;QAEvE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,kBAAkB,CACzC,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,aAAa,CACtB,CAAC;QAEF,MAAM,WAAW,GAAyB,CAAC,eAAe,EAAE,cAAc,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAC/F,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACzE,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC;QAC7B,CAAC;QAED,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,CAAC,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7E,CAAC;CACF"}

package/dist/profiler/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Attacker Profiling Engine
+ * 攻擊者分析引擎
+ *
+ * @module @panguard-ai/panguard-trap/profiler
+ */
+export { AttackerProfiler, estimateSkillLevel, classifyIntent, detectTools, } from './attacker-profiler.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/profiler/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/profiler/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,WAAW,GACZ,MAAM,wBAAwB,CAAC"}

package/dist/profiler/index.js

@@ -0,0 +1,8 @@
+/**
+ * Attacker Profiling Engine
+ * 攻擊者分析引擎
+ *
+ * @module @panguard-ai/panguard-trap/profiler
+ */
+export { AttackerProfiler, estimateSkillLevel, classifyIntent, detectTools, } from './attacker-profiler.js';
+//# sourceMappingURL=index.js.map

package/dist/profiler/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/profiler/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,WAAW,GACZ,MAAM,wBAAwB,CAAC"}

package/dist/services/base-service.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Base trap service implementation
+ * 蜜罐基底服務實作
+ *
+ * Provides common functionality for all trap services:
+ * - TCP server lifecycle
+ * - Session management
+ * - Event recording
+ * 提供所有蜜罐服務的共用功能：
+ * - TCP 伺服器生命週期
+ * - 連線管理
+ * - 事件記錄
+ *
+ * @module @panguard-ai/panguard-trap/services/base-service
+ */
+import type { TrapServiceType, TrapServiceStatus, TrapServiceConfig, TrapSession, TrapEvent, TrapEventType, TrapService, SessionHandler } from '../types.js';
+/**
+ * Abstract base class for all trap services
+ * 所有蜜罐服務的抽象基底類別
+ */
+export declare abstract class BaseTrapService implements TrapService {
+    readonly serviceType: TrapServiceType;
+    private _status;
+    protected readonly config: TrapServiceConfig;
+    protected activeSessions: Map<string, TrapSession>;
+    protected completedSessionCount: number;
+    private sessionHandlers;
+    constructor(config: TrapServiceConfig);
+    get status(): TrapServiceStatus;
+    protected setStatus(status: TrapServiceStatus): void;
+    /**
+     * Start the service
+     * 啟動服務
+     */
+    start(): Promise<void>;
+    /**
+     * Stop the service
+     * 停止服務
+     */
+    stop(): Promise<void>;
+    getActiveSessions(): TrapSession[];
+    getTotalSessionCount(): number;
+    onSession(handler: SessionHandler): void;
+    /** Create a new session / 建立新連線 */
+    protected createSession(sourceIP: string, sourcePort: number): TrapSession;
+    /** End a session / 結束連線 */
+    protected endSession(sessionId: string, session?: TrapSession): TrapSession | undefined;
+    /** Record an event in a session / 在連線中記錄事件 */
+    protected recordEvent(sessionId: string, type: TrapEventType, data: string, details?: Record<string, unknown>): TrapEvent | undefined;
+    /** Record a credential attempt / 記錄認證嘗試 */
+    protected recordCredential(sessionId: string, username: string, password: string, grantedAccess: boolean): void;
+    /** Record a command input / 記錄指令輸入 */
+    protected recordCommand(sessionId: string, command: string): void;
+    /** Add MITRE technique to session / 新增 MITRE 技術到連線 */
+    protected addMitreTechnique(sessionId: string, technique: string): void;
+    /** Subclass starts the actual TCP server / 子類別啟動實際 TCP 伺服器 */
+    protected abstract doStart(): Promise<void>;
+    /** Subclass stops the actual TCP server / 子類別停止實際 TCP 伺服器 */
+    protected abstract doStop(): Promise<void>;
+}
+//# sourceMappingURL=base-service.d.ts.map

package/dist/services/base-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-service.d.ts","sourceRoot":"","sources":["../../src/services/base-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EACV,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,SAAS,EACT,aAAa,EAEb,WAAW,EACX,cAAc,EACf,MAAM,aAAa,CAAC;AAcrB;;;GAGG;AACH,8BAAsB,eAAgB,YAAW,WAAW;IAC1D,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC;IACtC,OAAO,CAAC,OAAO,CAAgC;IAC/C,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAC7C,SAAS,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAa;IAC/D,SAAS,CAAC,qBAAqB,SAAK;IACpC,OAAO,CAAC,eAAe,CAAwB;gBAEnC,MAAM,EAAE,iBAAiB;IAKrC,IAAI,MAAM,IAAI,iBAAiB,CAE9B;IAED,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI;IAIpD;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAiB5B;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAgB3B,iBAAiB,IAAI,WAAW,EAAE;IAIlC,oBAAoB,IAAI,MAAM;IAI9B,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IASxC,mCAAmC;IACnC,SAAS,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW;IAsB1E,2BAA2B;IAC3B,SAAS,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,WAAW,GAAG,SAAS;IA0BvF,8CAA8C;IAC9C,SAAS,CAAC,WAAW,CACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,SAAS,GAAG,SAAS;IAcxB,2CAA2C;IAC3C,SAAS,CAAC,gBAAgB,CACxB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,OAAO,GACrB,IAAI;IAkBP,sCAAsC;IACtC,SAAS,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAQjE,sDAAsD;IACtD,SAAS,CAAC,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAavE,8DAA8D;IAC9D,SAAS,CAAC,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAE3C,6DAA6D;IAC7D,SAAS,CAAC,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAC3C"}