@vorionsys/security 1.0.0

package/dist/security/anomaly/detectors/index.js

@@ -0,0 +1,118 @@
+/**
+ * Anomaly Detectors Index
+ *
+ * Exports all anomaly detectors for the UEBA (User and Entity Behavior Analytics) system.
+ *
+ * Core Detectors (existing):
+ * - GeographicDetector: Impossible travel and location anomalies
+ * - TemporalDetector: Unusual access time patterns
+ * - VolumeDetector: Request volume spikes
+ *
+ * UEBA Detectors (new):
+ * - PrivilegeEscalationDetector: Permission grants and role changes
+ * - DataExfiltrationDetector: Bulk exports and unusual data access
+ * - LateralMovementDetector: System-to-system movement patterns
+ * - AccountCompromiseDetector: Multi-signal compromise detection
+ *
+ * @packageDocumentation
+ * @module security/anomaly/detectors
+ */
+// =============================================================================
+// Core Detectors
+// =============================================================================
+export { GeographicDetector, createGeographicDetector, calculateHaversineDistance, calculateTravelSpeed, } from './geographic.js';
+export { TemporalDetector, createTemporalDetector, } from './temporal.js';
+export { VolumeDetector, createVolumeDetector, } from './volume.js';
+// =============================================================================
+// UEBA Detectors
+// =============================================================================
+export { PrivilegeEscalationDetector, createPrivilegeEscalationDetector, DEFAULT_PRIVILEGE_ESCALATION_CONFIG, } from './privilege-escalation.js';
+export { DataExfiltrationDetector, createDataExfiltrationDetector, DEFAULT_DATA_EXFILTRATION_CONFIG, } from './data-exfiltration.js';
+export { LateralMovementDetector, createLateralMovementDetector, DEFAULT_LATERAL_MOVEMENT_CONFIG, } from './lateral-movement.js';
+export { AccountCompromiseDetector, createAccountCompromiseDetector, DEFAULT_ACCOUNT_COMPROMISE_CONFIG, } from './account-compromise.js';
+import { GeographicDetector } from './geographic.js';
+import { TemporalDetector } from './temporal.js';
+import { VolumeDetector } from './volume.js';
+import { PrivilegeEscalationDetector } from './privilege-escalation.js';
+import { DataExfiltrationDetector } from './data-exfiltration.js';
+import { LateralMovementDetector } from './lateral-movement.js';
+import { AccountCompromiseDetector } from './account-compromise.js';
+/**
+ * All available detector types
+ */
+export const DetectorType = {
+    GEOGRAPHIC: 'geographic',
+    TEMPORAL: 'temporal',
+    VOLUME: 'volume',
+    PRIVILEGE_ESCALATION: 'privilege-escalation',
+    DATA_EXFILTRATION: 'data-exfiltration',
+    LATERAL_MOVEMENT: 'lateral-movement',
+    ACCOUNT_COMPROMISE: 'account-compromise',
+};
+/**
+ * Registry of all available detectors
+ */
+export const detectorRegistry = {
+    [DetectorType.GEOGRAPHIC]: GeographicDetector,
+    [DetectorType.TEMPORAL]: TemporalDetector,
+    [DetectorType.VOLUME]: VolumeDetector,
+    [DetectorType.PRIVILEGE_ESCALATION]: PrivilegeEscalationDetector,
+    [DetectorType.DATA_EXFILTRATION]: DataExfiltrationDetector,
+    [DetectorType.LATERAL_MOVEMENT]: LateralMovementDetector,
+    [DetectorType.ACCOUNT_COMPROMISE]: AccountCompromiseDetector,
+};
+/**
+ * Create a detector instance by type
+ *
+ * @param type - The detector type to create
+ * @param config - Optional configuration for the detector
+ * @returns A new detector instance
+ *
+ * @example
+ * ```typescript
+ * const detector = createDetector('privilege-escalation', {
+ *   maxDailyGrants: 10,
+ * });
+ * ```
+ */
+export function createDetector(type, config) {
+    const DetectorClass = detectorRegistry[type];
+    if (!DetectorClass) {
+        throw new Error(`Unknown detector type: ${type}`);
+    }
+    return new DetectorClass(config);
+}
+/**
+ * Create all UEBA detectors with default configurations
+ *
+ * @returns Array of all UEBA detector instances
+ *
+ * @example
+ * ```typescript
+ * const detectors = createAllUEBADetectors();
+ * for (const detector of detectors) {
+ *   anomalyEngine.registerDetector(detector);
+ * }
+ * ```
+ */
+export function createAllUEBADetectors() {
+    return [
+        new PrivilegeEscalationDetector(),
+        new DataExfiltrationDetector(),
+        new LateralMovementDetector(),
+        new AccountCompromiseDetector(),
+    ];
+}
+/**
+ * Get list of all available detector types
+ */
+export function getAvailableDetectorTypes() {
+    return Object.values(DetectorType);
+}
+/**
+ * Check if a detector type is valid
+ */
+export function isValidDetectorType(type) {
+    return Object.values(DetectorType).includes(type);
+}
+//# sourceMappingURL=index.js.map

package/dist/security/anomaly/detectors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/security/anomaly/detectors/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,cAAc,EACd,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,EAEjC,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAE9B,gCAAgC,GACjC,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAE7B,+BAA+B,GAChC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAE/B,iCAAiC,GAClC,MAAM,yBAAyB,CAAC;AAOjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,UAAU,EAAE,YAAY;IACxB,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,oBAAoB,EAAE,sBAAsB;IAC5C,iBAAiB,EAAE,mBAAmB;IACtC,gBAAgB,EAAE,kBAAkB;IACpC,kBAAkB,EAAE,oBAAoB;CAChC,CAAC;AASX;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA8C;IACzE,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,kBAAkB;IAC7C,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,gBAAgB;IACzC,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,cAAc;IACrC,CAAC,YAAY,CAAC,oBAAoB,CAAC,EAAE,2BAA2B;IAChE,CAAC,YAAY,CAAC,iBAAiB,CAAC,EAAE,wBAAwB;IAC1D,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE,uBAAuB;IACxD,CAAC,YAAY,CAAC,kBAAkB,CAAC,EAAE,yBAAyB;CAC7D,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAkB,EAClB,MAAgC;IAEhC,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAE7C,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO;QACL,IAAI,2BAA2B,EAAE;QACjC,IAAI,wBAAwB,EAAE;QAC9B,IAAI,uBAAuB,EAAE;QAC7B,IAAI,yBAAyB,EAAE;KAChC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,IAAoB,CAAC,CAAC;AACpE,CAAC"}

package/dist/security/anomaly/detectors/lateral-movement.d.ts

@@ -0,0 +1,168 @@
+/**
+ * Lateral Movement Detector
+ *
+ * Detects suspicious lateral movement patterns by analyzing:
+ * - Access to new systems/services
+ * - Authentication from unusual service accounts
+ * - Cross-tenant access patterns
+ *
+ * Uses behavioral baselines to score based on hop count,
+ * time between hops, and destination sensitivity.
+ *
+ * @packageDocumentation
+ * @module security/anomaly/detectors/lateral-movement
+ */
+import type { Detector, DetectionResult, SecurityEvent } from '../types.js';
+/**
+ * Configuration for lateral movement detection
+ */
+export interface LateralMovementDetectorConfig {
+    /** Maximum hops in a single session before alerting */
+    maxHopsPerSession: number;
+    /** Minimum time between hops to be considered suspicious (seconds) */
+    minTimeBetweenHopsSeconds: number;
+    /** High-sensitivity systems/services */
+    highSensitivitySystems: string[];
+    /** Service account patterns (regex) */
+    serviceAccountPatterns: string[];
+    /** Maximum cross-tenant access in session */
+    maxCrossTenantsPerSession: number;
+    /** System sensitivity levels */
+    systemSensitivity: Record<string, number>;
+    /** Enable service account monitoring */
+    enableServiceAccountMonitoring: boolean;
+}
+export declare const DEFAULT_LATERAL_MOVEMENT_CONFIG: LateralMovementDetectorConfig;
+/**
+ * User's lateral movement baseline
+ */
+interface LateralMovementBaseline {
+    userId: string;
+    /** Normal systems accessed */
+    normalSystems: string[];
+    /** Normal services accessed */
+    normalServices: string[];
+    /** Normal tenants accessed */
+    normalTenants: string[];
+    /** Average systems per session */
+    avgSystemsPerSession: number;
+    /** Average hops per hour */
+    avgHopsPerHour: number;
+    /** Standard deviation of hops per hour */
+    stdDevHopsPerHour: number;
+    /** Total sessions tracked */
+    sessionCount: number;
+    /** Total events tracked */
+    totalEvents: number;
+    /** Last updated */
+    lastUpdated: string;
+}
+/**
+ * Lateral movement anomaly detector
+ */
+export declare class LateralMovementDetector implements Detector {
+    readonly name = "lateral-movement";
+    readonly description = "Detects access to new systems, unusual service account usage, and cross-tenant access patterns";
+    private readonly config;
+    private readonly redis;
+    private readonly keyPrefix;
+    constructor(config?: Partial<LateralMovementDetectorConfig>, keyPrefix?: string);
+    /**
+     * Analyze an event for lateral movement anomalies
+     */
+    detect(event: SecurityEvent): Promise<DetectionResult>;
+    /**
+     * Learn from an event by updating baselines
+     */
+    learn(event: SecurityEvent): Promise<void>;
+    /**
+     * Reset all learned baselines
+     */
+    reset(): Promise<void>;
+    /**
+     * Get baseline for a specific user
+     */
+    getBaseline(userId: string): Promise<LateralMovementBaseline>;
+    /**
+     * Update baseline for a user based on a security event
+     */
+    updateBaseline(userId: string, event: SecurityEvent): Promise<void>;
+    /**
+     * Check if event is access-related
+     */
+    private isAccessEvent;
+    /**
+     * Check if user ID matches service account patterns
+     */
+    private isServiceAccount;
+    /**
+     * Check for access to new systems
+     */
+    private checkNewSystemAccess;
+    /**
+     * Check hop patterns for suspicious behavior
+     */
+    private checkHopPattern;
+    /**
+     * Check for service account anomalies
+     */
+    private checkServiceAccountAnomaly;
+    /**
+     * Check for cross-tenant access patterns
+     */
+    private checkCrossTenantAccess;
+    /**
+     * Check destination system sensitivity
+     */
+    private checkDestinationSensitivity;
+    /**
+     * Update hop tracking for current session
+     */
+    private updateHopTracking;
+    /**
+     * Update user's lateral movement baseline
+     */
+    private updateUserBaseline;
+    /**
+     * Update service account pattern
+     */
+    private updateServiceAccountPattern;
+    /**
+     * Update tenant access tracking
+     */
+    private updateTenantAccess;
+    /**
+     * Get service account pattern
+     */
+    private getServiceAccountPattern;
+    /**
+     * Get system sensitivity level
+     */
+    private getSystemSensitivity;
+    /**
+     * Create empty baseline for new user
+     */
+    private createEmptyBaseline;
+    /**
+     * Calculate combined risk score
+     */
+    private calculateRiskScore;
+    /**
+     * Generate human-readable description
+     */
+    private generateDescription;
+    /**
+     * Create a detection result
+     */
+    private createResult;
+    /**
+     * Delete keys matching a pattern
+     */
+    private deleteKeysByPattern;
+}
+/**
+ * Create a new lateral movement detector instance
+ */
+export declare function createLateralMovementDetector(config?: Partial<LateralMovementDetectorConfig>, keyPrefix?: string): LateralMovementDetector;
+export {};
+//# sourceMappingURL=lateral-movement.d.ts.map

package/dist/security/anomaly/detectors/lateral-movement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lateral-movement.d.ts","sourceRoot":"","sources":["../../../../src/security/anomaly/detectors/lateral-movement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EACV,QAAQ,EACR,eAAe,EACf,aAAa,EAGd,MAAM,aAAa,CAAC;AAkCrB;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,uDAAuD;IACvD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,yBAAyB,EAAE,MAAM,CAAC;IAClC,wCAAwC;IACxC,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,uCAAuC;IACvC,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,6CAA6C;IAC7C,yBAAyB,EAAE,MAAM,CAAC;IAClC,gCAAgC;IAChC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,wCAAwC;IACxC,8BAA8B,EAAE,OAAO,CAAC;CACzC;AAED,eAAO,MAAM,+BAA+B,EAAE,6BAsC7C,CAAC;AAMF;;GAEG;AACH,UAAU,uBAAuB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,8BAA8B;IAC9B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,+BAA+B;IAC/B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,8BAA8B;IAC9B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,kCAAkC;IAClC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,4BAA4B;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,0CAA0C;IAC1C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,6BAA6B;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAmCD;;GAEG;AACH,qBAAa,uBAAwB,YAAW,QAAQ;IACtD,SAAgB,IAAI,sBAAsB;IAC1C,SAAgB,WAAW,oGACwE;IAEnG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAGjC,MAAM,GAAE,OAAO,CAAC,6BAA6B,CAAM,EACnD,SAAS,GAAE,MAA+B;IAO5C;;OAEG;IACG,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC;IAgH5D;;OAEG;IACG,KAAK,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBhD;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB5B;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAenE;;OAEG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzE;;OAEG;IACH,OAAO,CAAC,aAAa;IAqBrB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAMxB;;OAEG;YACW,oBAAoB;IAwDlC;;OAEG;IACH,OAAO,CAAC,eAAe;IAmEvB;;OAEG;YACW,0BAA0B;IAiDxC;;OAEG;YACW,sBAAsB;IAmDpC;;OAEG;IACH,OAAO,CAAC,2BAA2B;IAkDnC;;OAEG;YACW,iBAAiB;IAqC/B;;OAEG;YACW,kBAAkB;IAmEhC;;OAEG;YACW,2BAA2B;IA0CzC;;OAEG;YACW,kBAAkB;IAiBhC;;OAEG;YACW,wBAAwB;IA6BtC;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAY5B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAe3B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA+C1B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA6B3B;;OAEG;IACH,OAAO,CAAC,YAAY;IAepB;;OAEG;YACW,mBAAmB;CAkBlC;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,CAAC,EAAE,OAAO,CAAC,6BAA6B,CAAC,EAC/C,SAAS,CAAC,EAAE,MAAM,GACjB,uBAAuB,CAEzB"}