@vorionsys/security 1.0.0

package/dist/security/anomaly/detectors/volume.js

@@ -0,0 +1,424 @@
+/**
+ * Volume Spike Anomaly Detector
+ *
+ * Detects unusual request volume patterns by:
+ * - Tracking request counts per user, IP, and endpoint
+ * - Learning baseline volume statistics over time
+ * - Flagging when volume exceeds statistical thresholds
+ *
+ * Uses a sliding window approach with statistical analysis to identify
+ * traffic spikes that may indicate:
+ * - Credential stuffing attacks
+ * - API abuse
+ * - Automated scraping
+ * - Denial of service attempts
+ *
+ * @packageDocumentation
+ * @module security/anomaly/detectors/volume
+ */
+import { createLogger } from '../../../common/logger.js';
+import { getRedis } from '../../../common/redis.js';
+import { DEFAULT_VOLUME_DETECTOR_CONFIG, AnomalySeverity as Severity, } from '../types.js';
+const logger = createLogger({ component: 'volume-detector' });
+// =============================================================================
+// Constants
+// =============================================================================
+/** Redis key prefix for volume counts */
+const VOLUME_COUNT_PREFIX = 'vorion:anomaly:volume:count:';
+/** Redis key prefix for volume baselines */
+const VOLUME_BASELINE_PREFIX = 'vorion:anomaly:volume:baseline:';
+/** Time-to-live for count buckets in seconds (1 hour) */
+const COUNT_TTL_SECONDS = 60 * 60;
+/** Time-to-live for baselines in seconds (30 days) */
+const BASELINE_TTL_SECONDS = 30 * 24 * 60 * 60;
+/** Minimum samples required for reliable baseline */
+const MIN_BASELINE_SAMPLES = 10;
+/** Rolling window for baseline updates */
+const BASELINE_WINDOW_SIZE = 100;
+// =============================================================================
+// Helper Functions
+// =============================================================================
+/**
+ * Get the current time window bucket key
+ */
+function getTimeBucket(windowMinutes) {
+    const now = Date.now();
+    const bucketSize = windowMinutes * 60 * 1000;
+    const bucket = Math.floor(now / bucketSize);
+    return bucket.toString();
+}
+/**
+ * Calculate mean of an array
+ */
+function calculateMean(values) {
+    if (values.length === 0)
+        return 0;
+    return values.reduce((a, b) => a + b, 0) / values.length;
+}
+/**
+ * Calculate standard deviation
+ */
+function calculateStdDev(values, mean) {
+    if (values.length < 2)
+        return 0;
+    const m = mean ?? calculateMean(values);
+    const squaredDiffs = values.map((v) => Math.pow(v - m, 2));
+    const variance = squaredDiffs.reduce((a, b) => a + b, 0) / (values.length - 1);
+    return Math.sqrt(variance);
+}
+/**
+ * Create an empty baseline
+ */
+function createEmptyBaseline(identifier, identifierType) {
+    return {
+        identifier,
+        identifierType,
+        mean: 0,
+        stdDev: 0,
+        sampleCount: 0,
+        lastUpdated: new Date(),
+    };
+}
+// =============================================================================
+// Volume Detector Implementation
+// =============================================================================
+/**
+ * Volume spike anomaly detector
+ */
+export class VolumeDetector {
+    name = 'volume';
+    description = 'Detects unusual request volume spikes per user, IP, or endpoint';
+    config;
+    redis;
+    countPrefix;
+    baselinePrefix;
+    constructor(config = {}, countPrefix = VOLUME_COUNT_PREFIX, baselinePrefix = VOLUME_BASELINE_PREFIX) {
+        this.config = { ...DEFAULT_VOLUME_DETECTOR_CONFIG, ...config };
+        this.redis = getRedis();
+        this.countPrefix = countPrefix;
+        this.baselinePrefix = baselinePrefix;
+    }
+    /**
+     * Analyze an event for volume anomalies
+     */
+    async detect(event) {
+        const startTime = performance.now();
+        const indicators = [];
+        const suggestedActions = [];
+        try {
+            const timeBucket = getTimeBucket(this.config.windowMinutes);
+            // Check user volume
+            if (this.config.trackPerUser && event.userId) {
+                const userResult = await this.checkVolume('user', event.userId, timeBucket);
+                if (userResult.isSpike) {
+                    indicators.push(...userResult.indicators);
+                    suggestedActions.push('Investigate user activity for automated behavior', 'Consider temporary rate limiting for this user');
+                }
+            }
+            // Check IP volume
+            if (this.config.trackPerIp && event.ipAddress) {
+                const ipResult = await this.checkVolume('ip', event.ipAddress, timeBucket);
+                if (ipResult.isSpike) {
+                    indicators.push(...ipResult.indicators);
+                    suggestedActions.push('Check if IP is associated with known proxy/VPN services', 'Consider IP-based rate limiting or blocking');
+                }
+            }
+            // Check endpoint volume
+            if (this.config.trackPerEndpoint && event.resource) {
+                const endpointResult = await this.checkVolume('endpoint', event.resource, timeBucket);
+                if (endpointResult.isSpike) {
+                    indicators.push(...endpointResult.indicators);
+                    suggestedActions.push('Review endpoint for potential abuse vectors', 'Consider implementing endpoint-specific rate limits');
+                }
+            }
+            // Calculate overall result
+            const hasAnomaly = indicators.length > 0;
+            let severity;
+            let confidence;
+            let description;
+            if (hasAnomaly) {
+                const totalWeight = indicators.reduce((sum, i) => sum + i.weight, 0);
+                // Average the weights since we might have multiple indicators
+                confidence = Math.min(100, Math.round(totalWeight / Math.max(1, indicators.length) * 1.5));
+                severity = this.calculateSeverity(confidence, indicators);
+                description = this.generateDescription(indicators);
+            }
+            return {
+                detectorName: this.name,
+                anomalyDetected: hasAnomaly,
+                confidence,
+                severity,
+                description,
+                indicators,
+                suggestedActions,
+                durationMs: performance.now() - startTime,
+            };
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+            logger.error({ error, eventId: event.eventId }, 'Volume detection failed');
+            return {
+                detectorName: this.name,
+                anomalyDetected: false,
+                indicators: [],
+                suggestedActions: [],
+                durationMs: performance.now() - startTime,
+                error: errorMessage,
+            };
+        }
+    }
+    /**
+     * Learn from an event by updating volume counts and baselines
+     */
+    async learn(event) {
+        try {
+            const timeBucket = getTimeBucket(this.config.windowMinutes);
+            // Increment counts
+            const incrementPromises = [];
+            if (this.config.trackPerUser && event.userId) {
+                incrementPromises.push(this.incrementCount('user', event.userId, timeBucket));
+            }
+            if (this.config.trackPerIp && event.ipAddress) {
+                incrementPromises.push(this.incrementCount('ip', event.ipAddress, timeBucket));
+            }
+            if (this.config.trackPerEndpoint && event.resource) {
+                incrementPromises.push(this.incrementCount('endpoint', event.resource, timeBucket));
+            }
+            await Promise.all(incrementPromises);
+            logger.debug({
+                userId: event.userId,
+                ipAddress: event.ipAddress,
+                resource: event.resource,
+            }, 'Updated volume counts');
+        }
+        catch (error) {
+            logger.error({ error, eventId: event.eventId }, 'Failed to update volume counts');
+        }
+    }
+    /**
+     * Reset all learned baselines and counts
+     */
+    async reset() {
+        try {
+            // Reset counts
+            await this.deleteKeysByPattern(`${this.countPrefix}*`);
+            // Reset baselines
+            await this.deleteKeysByPattern(`${this.baselinePrefix}*`);
+            logger.info('Volume detector baselines and counts reset');
+        }
+        catch (error) {
+            logger.error({ error }, 'Failed to reset volume detector');
+            throw error;
+        }
+    }
+    /**
+     * Update baseline with a new sample
+     * Called periodically to update baselines from accumulated counts
+     */
+    async updateBaseline(identifierType, identifier, count) {
+        const baseline = await this.getBaseline(identifierType, identifier);
+        const samples = baseline.sampleCount;
+        // Use Welford's online algorithm for mean and variance
+        const newSamples = samples + 1;
+        const delta = count - baseline.mean;
+        const newMean = baseline.mean + delta / newSamples;
+        const delta2 = count - newMean;
+        // Update variance incrementally (for stdDev calculation)
+        // This is an approximation that works well for our purposes
+        let newStdDev;
+        if (newSamples < 2) {
+            newStdDev = 0;
+        }
+        else if (samples === 0) {
+            newStdDev = 0;
+        }
+        else {
+            // Running variance update
+            const oldVariance = baseline.stdDev * baseline.stdDev * samples;
+            const newVariance = (oldVariance + delta * delta2) / newSamples;
+            newStdDev = Math.sqrt(newVariance);
+        }
+        const updatedBaseline = {
+            identifier,
+            identifierType,
+            mean: newMean,
+            stdDev: newStdDev,
+            sampleCount: Math.min(newSamples, BASELINE_WINDOW_SIZE),
+            lastUpdated: new Date(),
+        };
+        await this.saveBaseline(identifierType, identifier, updatedBaseline);
+    }
+    /**
+     * Check volume for a specific identifier
+     */
+    async checkVolume(identifierType, identifier, timeBucket) {
+        const indicators = [];
+        // Get current count
+        const count = await this.getCount(identifierType, identifier, timeBucket);
+        // Check against absolute maximum
+        if (count > this.config.absoluteMaxRequests) {
+            const excess = count - this.config.absoluteMaxRequests;
+            indicators.push({
+                type: `absolute_volume_spike_${identifierType}`,
+                description: `${this.formatIdentifierType(identifierType)} ${identifier} exceeded absolute maximum: ${count} requests (max: ${this.config.absoluteMaxRequests}) in ${this.config.windowMinutes} minutes`,
+                value: count,
+                weight: Math.min(100, 60 + Math.round((excess / this.config.absoluteMaxRequests) * 40)),
+            });
+        }
+        // Check against learned baseline
+        const baseline = await this.getBaseline(identifierType, identifier);
+        if (baseline.sampleCount >= MIN_BASELINE_SAMPLES && baseline.stdDev > 0) {
+            const zScore = (count - baseline.mean) / baseline.stdDev;
+            if (zScore > this.config.spikeThresholdStdDev) {
+                const percentageIncrease = baseline.mean > 0
+                    ? Math.round(((count - baseline.mean) / baseline.mean) * 100)
+                    : 0;
+                indicators.push({
+                    type: `statistical_volume_spike_${identifierType}`,
+                    description: `${this.formatIdentifierType(identifierType)} ${identifier} volume spike: ${count} requests (baseline: ${Math.round(baseline.mean)} +/- ${Math.round(baseline.stdDev)}, ${percentageIncrease}% increase)`,
+                    value: zScore,
+                    weight: Math.min(100, 40 + Math.round(zScore * 10)),
+                });
+            }
+        }
+        // Update baseline with current count for future reference
+        if (count > 0) {
+            // Schedule baseline update (don't await to avoid blocking detection)
+            this.updateBaseline(identifierType, identifier, count).catch((error) => {
+                logger.warn({ error, identifierType, identifier }, 'Failed to update baseline');
+            });
+        }
+        return { isSpike: indicators.length > 0, indicators };
+    }
+    /**
+     * Increment count for an identifier in the current time bucket
+     */
+    async incrementCount(identifierType, identifier, timeBucket) {
+        const key = this.getCountKey(identifierType, identifier, timeBucket);
+        const count = await this.redis.incr(key);
+        // Set TTL only if this is a new key
+        if (count === 1) {
+            await this.redis.expire(key, COUNT_TTL_SECONDS);
+        }
+        return count;
+    }
+    /**
+     * Get current count for an identifier
+     */
+    async getCount(identifierType, identifier, timeBucket) {
+        const key = this.getCountKey(identifierType, identifier, timeBucket);
+        const count = await this.redis.get(key);
+        return count ? parseInt(count, 10) : 0;
+    }
+    /**
+     * Get Redis key for count
+     */
+    getCountKey(identifierType, identifier, timeBucket) {
+        return `${this.countPrefix}${identifierType}:${identifier}:${timeBucket}`;
+    }
+    /**
+     * Get baseline for an identifier
+     */
+    async getBaseline(identifierType, identifier) {
+        const key = this.getBaselineKey(identifierType, identifier);
+        const data = await this.redis.get(key);
+        if (!data) {
+            return createEmptyBaseline(identifier, identifierType);
+        }
+        try {
+            const parsed = JSON.parse(data);
+            return {
+                ...parsed,
+                lastUpdated: new Date(parsed.lastUpdated),
+            };
+        }
+        catch {
+            return createEmptyBaseline(identifier, identifierType);
+        }
+    }
+    /**
+     * Save baseline for an identifier
+     */
+    async saveBaseline(identifierType, identifier, baseline) {
+        const key = this.getBaselineKey(identifierType, identifier);
+        await this.redis.set(key, JSON.stringify(baseline), 'EX', BASELINE_TTL_SECONDS);
+    }
+    /**
+     * Get Redis key for baseline
+     */
+    getBaselineKey(identifierType, identifier) {
+        return `${this.baselinePrefix}${identifierType}:${identifier}`;
+    }
+    /**
+     * Delete keys matching a pattern
+     */
+    async deleteKeysByPattern(pattern) {
+        let cursor = '0';
+        do {
+            const [nextCursor, keys] = await this.redis.scan(cursor, 'MATCH', pattern, 'COUNT', 100);
+            cursor = nextCursor;
+            if (keys.length > 0) {
+                await this.redis.del(...keys);
+            }
+        } while (cursor !== '0');
+    }
+    /**
+     * Format identifier type for display
+     */
+    formatIdentifierType(type) {
+        switch (type) {
+            case 'user':
+                return 'User';
+            case 'ip':
+                return 'IP';
+            case 'endpoint':
+                return 'Endpoint';
+            default:
+                return type;
+        }
+    }
+    /**
+     * Calculate severity based on confidence and indicators
+     */
+    calculateSeverity(confidence, indicators) {
+        const hasAbsoluteSpike = indicators.some((i) => i.type.startsWith('absolute_volume_spike'));
+        const multipleTypes = new Set(indicators.map((i) => i.type.split('_').pop())).size > 1;
+        if (hasAbsoluteSpike && confidence >= 80) {
+            return Severity.CRITICAL;
+        }
+        if (hasAbsoluteSpike || (multipleTypes && confidence >= 70)) {
+            return Severity.HIGH;
+        }
+        if (confidence >= 60) {
+            return Severity.MEDIUM;
+        }
+        return Severity.LOW;
+    }
+    /**
+     * Generate human-readable description
+     */
+    generateDescription(indicators) {
+        const types = [];
+        if (indicators.some((i) => i.type.includes('_user'))) {
+            types.push('user');
+        }
+        if (indicators.some((i) => i.type.includes('_ip'))) {
+            types.push('IP');
+        }
+        if (indicators.some((i) => i.type.includes('_endpoint'))) {
+            types.push('endpoint');
+        }
+        const isAbsolute = indicators.some((i) => i.type.startsWith('absolute'));
+        if (isAbsolute) {
+            return `Volume spike detected: ${types.join(', ')} exceeded absolute limits`;
+        }
+        return `Unusual volume pattern detected for ${types.join(', ')} based on historical baseline`;
+    }
+}
+/**
+ * Create a new volume detector instance
+ */
+export function createVolumeDetector(config, countPrefix, baselinePrefix) {
+    return new VolumeDetector(config, countPrefix, baselinePrefix);
+}
+//# sourceMappingURL=volume.js.map

package/dist/security/anomaly/detectors/volume.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"volume.js","sourceRoot":"","sources":["../../../../src/security/anomaly/detectors/volume.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAUpD,OAAO,EACL,8BAA8B,EAC9B,eAAe,IAAI,QAAQ,GAC5B,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAE9D,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,yCAAyC;AACzC,MAAM,mBAAmB,GAAG,8BAA8B,CAAC;AAE3D,4CAA4C;AAC5C,MAAM,sBAAsB,GAAG,iCAAiC,CAAC;AAEjE,yDAAyD;AACzD,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,CAAC;AAElC,sDAAsD;AACtD,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAE/C,qDAAqD;AACrD,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,0CAA0C;AAC1C,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;GAEG;AACH,SAAS,aAAa,CAAC,aAAqB;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,MAAgB;IACrC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,MAAgB,EAAE,IAAa;IACtD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,IAAI,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,UAAkB,EAClB,cAA0C;IAE1C,OAAO;QACL,UAAU;QACV,cAAc;QACd,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,WAAW,EAAE,CAAC;QACd,WAAW,EAAE,IAAI,IAAI,EAAE;KACxB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,iCAAiC;AACjC,gFAAgF;AAEhF;;GAEG;AACH,MAAM,OAAO,cAAc;IACT,IAAI,GAAG,QAAQ,CAAC;IAChB,WAAW,GACzB,iEAAiE,CAAC;IAEnD,MAAM,CAAuB;IAC7B,KAAK,CAAQ;IACb,WAAW,CAAS;IACpB,cAAc,CAAS;IAExC,YACE,SAAwC,EAAE,EAC1C,cAAsB,mBAAmB,EACzC,iBAAyB,sBAAsB;QAE/C,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,8BAA8B,EAAE,GAAG,MAAM,EAAE,CAAC;QAC/D,IAAI,CAAC,KAAK,GAAG,QAAQ,EAAE,CAAC;QACxB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,KAAoB;QAC/B,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,UAAU,GAAgB,EAAE,CAAC;QACnC,MAAM,gBAAgB,GAAa,EAAE,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAE5D,oBAAoB;YACpB,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC7C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CACvC,MAAM,EACN,KAAK,CAAC,MAAM,EACZ,UAAU,CACX,CAAC;gBACF,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;oBACvB,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;oBAC1C,gBAAgB,CAAC,IAAI,CACnB,kDAAkD,EAClD,gDAAgD,CACjD,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,kBAAkB;YAClB,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CACrC,IAAI,EACJ,KAAK,CAAC,SAAS,EACf,UAAU,CACX,CAAC;gBACF,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACrB,UAAU,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;oBACxC,gBAAgB,CAAC,IAAI,CACnB,yDAAyD,EACzD,6CAA6C,CAC9C,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,wBAAwB;YACxB,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,WAAW,CAC3C,UAAU,EACV,KAAK,CAAC,QAAQ,EACd,UAAU,CACX,CAAC;gBACF,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;oBAC3B,UAAU,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;oBAC9C,gBAAgB,CAAC,IAAI,CACnB,6CAA6C,EAC7C,qDAAqD,CACtD,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,2BAA2B;YAC3B,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;YACzC,IAAI,QAAqC,CAAC;YAC1C,IAAI,UAA8B,CAAC;YACnC,IAAI,WAA+B,CAAC;YAEpC,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBACrE,8DAA8D;gBAC9D,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;gBAC3F,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;gBAC1D,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;YACrD,CAAC;YAED,OAAO;gBACL,YAAY,EAAE,IAAI,CAAC,IAAI;gBACvB,eAAe,EAAE,UAAU;gBAC3B,UAAU;gBACV,QAAQ;gBACR,WAAW;gBACX,UAAU;gBACV,gBAAgB;gBAChB,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;aAC1C,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YAC9E,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,yBAAyB,CAAC,CAAC;YAE3E,OAAO;gBACL,YAAY,EAAE,IAAI,CAAC,IAAI;gBACvB,eAAe,EAAE,KAAK;gBACtB,UAAU,EAAE,EAAE;gBACd,gBAAgB,EAAE,EAAE;gBACpB,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;gBACzC,KAAK,EAAE,YAAY;aACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,KAAoB;QAC9B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAE5D,mBAAmB;YACnB,MAAM,iBAAiB,GAAsB,EAAE,CAAC;YAEhD,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC7C,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;YAChF,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC9C,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;YACjF,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnD,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;YACtF,CAAC;YAED,MAAM,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAErC,MAAM,CAAC,KAAK,CACV;gBACE,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,EACD,uBAAuB,CACxB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,gCAAgC,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,CAAC;YACH,eAAe;YACf,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;YAEvD,kBAAkB;YAClB,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC;YAE1D,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,iCAAiC,CAAC,CAAC;YAC3D,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAClB,cAA0C,EAC1C,UAAkB,EAClB,KAAa;QAEb,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC;QAErC,uDAAuD;QACvD,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC;QACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,GAAG,KAAK,GAAG,UAAU,CAAC;QACnD,MAAM,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;QAE/B,yDAAyD;QACzD,4DAA4D;QAC5D,IAAI,SAAiB,CAAC;QACtB,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,SAAS,GAAG,CAAC,CAAC;QAChB,CAAC;aAAM,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YACzB,SAAS,GAAG,CAAC,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,0BAA0B;YAC1B,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC;YAChE,MAAM,WAAW,GAAG,CAAC,WAAW,GAAG,KAAK,GAAG,MAAM,CAAC,GAAG,UAAU,CAAC;YAChE,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,eAAe,GAAmB;YACtC,UAAU;YACV,cAAc;YACd,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,oBAAoB,CAAC;YACvD,WAAW,EAAE,IAAI,IAAI,EAAE;SACxB,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW,CACvB,cAA0C,EAC1C,UAAkB,EAClB,UAAkB;QAElB,MAAM,UAAU,GAAgB,EAAE,CAAC;QAEnC,oBAAoB;QACpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QAE1E,iCAAiC;QACjC,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;YACvD,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,yBAAyB,cAAc,EAAE;gBAC/C,WAAW,EAAE,GAAG,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,IAAI,UAAU,+BAA+B,KAAK,mBAAmB,IAAI,CAAC,MAAM,CAAC,mBAAmB,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,UAAU;gBACxM,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC,CAAC;aACxF,CAAC,CAAC;QACL,CAAC;QAED,iCAAiC;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QAEpE,IAAI,QAAQ,CAAC,WAAW,IAAI,oBAAoB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxE,MAAM,MAAM,GAAG,CAAC,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;YAEzD,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;gBAC9C,MAAM,kBAAkB,GAAG,QAAQ,CAAC,IAAI,GAAG,CAAC;oBAC1C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;oBAC7D,CAAC,CAAC,CAAC,CAAC;gBAEN,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,4BAA4B,cAAc,EAAE;oBAClD,WAAW,EAAE,GAAG,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,IAAI,UAAU,kBAAkB,KAAK,wBAAwB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,kBAAkB,aAAa;oBACtN,KAAK,EAAE,MAAM;oBACb,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;iBACpD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,0DAA0D;QAC1D,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,qEAAqE;YACrE,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACrE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,EAAE,2BAA2B,CAAC,CAAC;YAClF,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC;IACxD,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,cAAc,CAC1B,cAA0C,EAC1C,UAAkB,EAClB,UAAkB;QAElB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEzC,oCAAoC;QACpC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,QAAQ,CACpB,cAA0C,EAC1C,UAAkB,EAClB,UAAkB;QAElB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACK,WAAW,CACjB,cAA0C,EAC1C,UAAkB,EAClB,UAAkB;QAElB,OAAO,GAAG,IAAI,CAAC,WAAW,GAAG,cAAc,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC;IAC5E,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW,CACvB,cAA0C,EAC1C,UAAkB;QAElB,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,mBAAmB,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,OAAO;gBACL,GAAG,MAAM;gBACT,WAAW,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;aACxB,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,mBAAmB,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,YAAY,CACxB,cAA0C,EAC1C,UAAkB,EAClB,QAAwB;QAExB,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAClF,CAAC;IAED;;OAEG;IACK,cAAc,CACpB,cAA0C,EAC1C,UAAkB;QAElB,OAAO,GAAG,IAAI,CAAC,cAAc,GAAG,cAAc,IAAI,UAAU,EAAE,CAAC;IACjE,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,mBAAmB,CAAC,OAAe;QAC/C,IAAI,MAAM,GAAG,GAAG,CAAC;QAEjB,GAAG,CAAC;YACF,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAC9C,MAAM,EACN,OAAO,EACP,OAAO,EACP,OAAO,EACP,GAAG,CACJ,CAAC;YACF,MAAM,GAAG,UAAU,CAAC;YAEpB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YAChC,CAAC;QACH,CAAC,QAAQ,MAAM,KAAK,GAAG,EAAE;IAC3B,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,IAAgC;QAC3D,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,MAAM;gBACT,OAAO,MAAM,CAAC;YAChB,KAAK,IAAI;gBACP,OAAO,IAAI,CAAC;YACd,KAAK,UAAU;gBACb,OAAO,UAAU,CAAC;YACpB;gBACE,OAAO,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,iBAAiB,CACvB,UAAkB,EAClB,UAAuB;QAEvB,MAAM,gBAAgB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7C,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAC3C,CAAC;QACF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;QAEvF,IAAI,gBAAgB,IAAI,UAAU,IAAI,EAAE,EAAE,CAAC;YACzC,OAAO,QAAQ,CAAC,QAAQ,CAAC;QAC3B,CAAC;QACD,IAAI,gBAAgB,IAAI,CAAC,aAAa,IAAI,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5D,OAAO,QAAQ,CAAC,IAAI,CAAC;QACvB,CAAC;QACD,IAAI,UAAU,IAAI,EAAE,EAAE,CAAC;YACrB,OAAO,QAAQ,CAAC,MAAM,CAAC;QACzB,CAAC;QACD,OAAO,QAAQ,CAAC,GAAG,CAAC;IACtB,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,UAAuB;QACjD,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzB,CAAC;QAED,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QAEzE,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,0BAA0B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC;QAC/E,CAAC;QAED,OAAO,uCAAuC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAAC;IAChG,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAsC,EACtC,WAAoB,EACpB,cAAuB;IAEvB,OAAO,IAAI,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;AACjE,CAAC"}

package/dist/security/anomaly/index.d.ts

@@ -0,0 +1,128 @@
+/**
+ * Anomaly Detection Engine
+ *
+ * Rule-based anomaly detection system for identifying suspicious security patterns.
+ * No machine learning required - uses statistical analysis and configurable rules.
+ *
+ * Features:
+ * - Geographic anomaly detection (impossible travel)
+ * - Temporal anomaly detection (unusual access times)
+ * - Volume spike detection (request rate anomalies)
+ * - Pluggable detector architecture
+ * - Redis-backed baseline storage
+ * - Event callbacks for alerting
+ *
+ * @example
+ * ```typescript
+ * import { AnomalyDetector, createAnomalyDetector } from './security/anomaly';
+ *
+ * const detector = createAnomalyDetector({
+ *   enabled: true,
+ *   alertThreshold: 70,
+ *   autoBlock: false,
+ * });
+ *
+ * // Analyze an event
+ * const result = await detector.analyze(securityEvent);
+ *
+ * // Register callback for anomalies
+ * detector.onAnomaly((anomaly) => {
+ *   console.log('Anomaly detected:', anomaly);
+ * });
+ * ```
+ *
+ * @packageDocumentation
+ * @module security/anomaly
+ */
+import type { AnomalyDetectorConfig, AggregatedDetectionResult, SecurityEvent, Detector, AnomalyCallback, AlertCallback } from './types.js';
+/**
+ * Main anomaly detection engine that orchestrates multiple detectors
+ */
+export declare class AnomalyDetector {
+    private readonly config;
+    private readonly detectors;
+    private readonly anomalyCallbacks;
+    private readonly alertCallbacks;
+    constructor(config?: Partial<AnomalyDetectorConfig>);
+    /**
+     * Initialize the default set of detectors
+     */
+    private initializeDefaultDetectors;
+    /**
+     * Register a custom detector
+     */
+    registerDetector(detector: Detector): void;
+    /**
+     * Unregister a detector
+     */
+    unregisterDetector(name: string): boolean;
+    /**
+     * Get a registered detector by name
+     */
+    getDetector(name: string): Detector | undefined;
+    /**
+     * Get all registered detector names
+     */
+    getDetectorNames(): string[];
+    /**
+     * Register a callback for when anomalies are detected
+     */
+    onAnomaly(callback: AnomalyCallback): void;
+    /**
+     * Register a callback for when alerts are generated
+     */
+    onAlert(callback: AlertCallback): void;
+    /**
+     * Analyze a security event for anomalies
+     */
+    analyze(event: SecurityEvent): Promise<AggregatedDetectionResult>;
+    /**
+     * Learn from an event to update baselines
+     */
+    learnFromEvent(event: SecurityEvent): Promise<void>;
+    /**
+     * Reset all detector baselines
+     */
+    resetBaselines(): Promise<void>;
+    /**
+     * Get current configuration
+     */
+    getConfig(): Readonly<AnomalyDetectorConfig>;
+    /**
+     * Update configuration
+     */
+    updateConfig(updates: Partial<AnomalyDetectorConfig>): void;
+    /**
+     * Create an anomaly from a detection result
+     */
+    private createAnomaly;
+    /**
+     * Map detector name to anomaly type
+     */
+    private mapDetectorToAnomalyType;
+    /**
+     * Create an alert from an anomaly
+     */
+    private createAlert;
+    /**
+     * Emit anomaly to registered callbacks
+     */
+    private emitAnomaly;
+    /**
+     * Emit alert to registered callbacks
+     */
+    private emitAlert;
+    /**
+     * Handle automatic blocking when threshold is met
+     */
+    private handleAutoBlock;
+}
+/**
+ * Create a new AnomalyDetector instance
+ */
+export declare function createAnomalyDetector(config?: Partial<AnomalyDetectorConfig>): AnomalyDetector;
+export * from './types.js';
+export { GeographicDetector, createGeographicDetector, calculateHaversineDistance, calculateTravelSpeed, } from './detectors/geographic.js';
+export { TemporalDetector, createTemporalDetector } from './detectors/temporal.js';
+export { VolumeDetector, createVolumeDetector } from './detectors/volume.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/anomaly/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/security/anomaly/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,KAAK,EAEV,qBAAqB,EACrB,yBAAyB,EACzB,aAAa,EACb,QAAQ,EAER,eAAe,EAEf,aAAa,EAGd,MAAM,YAAY,CAAC;AAgBpB;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;IAClD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAoB;IACrD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAkB;gBAErC,MAAM,GAAE,OAAO,CAAC,qBAAqB,CAAM;IAoBvD;;OAEG;IACH,OAAO,CAAC,0BAA0B;IA0BlC;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI;IAK1C;;OAEG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAQzC;;OAEG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS;IAI/C;;OAEG;IACH,gBAAgB,IAAI,MAAM,EAAE;IAI5B;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAI1C;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAItC;;OAEG;IACG,OAAO,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAiGvE;;OAEG;IACG,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBzD;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAqCrC;;OAEG;IACH,SAAS,IAAI,QAAQ,CAAC,qBAAqB,CAAC;IAI5C;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,qBAAqB,CAAC,GAAG,IAAI;IAK3D;;OAEG;IACH,OAAO,CAAC,aAAa;IAsBrB;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA0BhC;;OAEG;IACH,OAAO,CAAC,WAAW;IAWnB;;OAEG;YACW,WAAW;IAUzB;;OAEG;YACW,SAAS;IAUvB;;OAEG;YACW,eAAe;CAe9B;AAMD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,GACtC,eAAe,CAEjB;AAOD,cAAc,YAAY,CAAC;AAG3B,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEnF,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC"}