secure-scan 1.2.2

package/src/rules/malware/scoring/index.ts

@@ -0,0 +1,549 @@
+/**
+ * @fileoverview Malware Score Calculator
+ * @module rules/malware/scoring
+ * 
+ * Dynamic scoring system for malware detection that calculates risk scores
+ * based on multiple factors including pattern matches, obfuscation level,
+ * network indicators, and rule correlation.
+ */
+
+import {
+  MalwareRule,
+  MalwareScore,
+  MalwareScoreBreakdown,
+  MalwareSeverity,
+  PatternMatch,
+  AnalysisContext,
+  MalwareFinding,
+  IScoreCalculator,
+  ConfidenceLevel
+} from '../types';
+import {
+  SCORE_THRESHOLDS,
+  RISK_LEVELS,
+  DEFAULT_SCORING_WEIGHTS,
+  LIMITS
+} from '../constants';
+import {
+  calculateEntropy,
+  detectObfuscationLevel,
+  detectEnvironmentChecks
+} from '../utils';
+
+// ============================================================================
+// SCORE CALCULATOR IMPLEMENTATION
+// ============================================================================
+
+/**
+ * Malware Score Calculator
+ * Implements dynamic scoring based on multiple risk factors
+ */
+export class MalwareScoreCalculator implements IScoreCalculator {
+  private weights: typeof DEFAULT_SCORING_WEIGHTS;
+
+  constructor(customWeights?: Partial<typeof DEFAULT_SCORING_WEIGHTS>) {
+    this.weights = { ...DEFAULT_SCORING_WEIGHTS, ...customWeights };
+  }
+
+  /**
+   * Calculate malware score for a finding
+   */
+  calculateScore(
+    rule: MalwareRule,
+    matches: PatternMatch[],
+    context: AnalysisContext
+  ): MalwareScore {
+    const breakdown = this.calculateBreakdown(rule, matches, context);
+    const totalScore = this.calculateTotalScore(breakdown);
+    const severity = this.scoreToSeverity(totalScore);
+    const riskLevel = this.scoreToRiskLevel(totalScore);
+
+    return {
+      score: Math.round(totalScore),
+      breakdown,
+      calculatedSeverity: severity,
+      riskLevel,
+      explanation: this.generateExplanation(breakdown, matches.length)
+    };
+  }
+
+  /**
+   * Calculate score breakdown
+   */
+  private calculateBreakdown(
+    rule: MalwareRule,
+    matches: PatternMatch[],
+    context: AnalysisContext
+  ): MalwareScoreBreakdown {
+    // Base score from rule definition
+    const baseScore = rule.baseScore ?? this.getDefaultBaseScore(rule.severity);
+
+    // Pattern match score - more matches = higher confidence
+    const patternScore = this.calculatePatternScore(matches, rule);
+
+    // Obfuscation score
+    const obfuscationScore = this.calculateObfuscationScore(context);
+
+    // Network indicator score
+    const networkScore = this.calculateNetworkScore(context.content, matches);
+
+    // Execution indicator score
+    const executionScore = this.calculateExecutionScore(context.content, matches);
+
+    // Persistence indicator score
+    const persistenceScore = this.calculatePersistenceScore(context.content, matches);
+
+    // Correlation score (boost from related findings)
+    const correlationScore = this.calculateCorrelationScore(
+      rule,
+      context.previousFindings || [],
+      context.relatedFindings || []
+    );
+
+    // False positive penalty
+    const falsePositivePenalty = this.calculateFalsePositivePenalty(
+      rule,
+      context
+    );
+
+    return {
+      baseScore,
+      patternScore,
+      obfuscationScore,
+      networkScore,
+      executionScore,
+      persistenceScore,
+      correlationScore,
+      falsePositivePenalty,
+      totalScore: 0 // Will be calculated
+    };
+  }
+
+  /**
+   * Calculate total score from breakdown
+   */
+  private calculateTotalScore(breakdown: MalwareScoreBreakdown): number {
+    const weighted = (
+      breakdown.baseScore * 0.3 +
+      breakdown.patternScore * this.weights.patternCount +
+      breakdown.obfuscationScore * this.weights.obfuscation +
+      breakdown.networkScore * this.weights.networkAccess +
+      breakdown.executionScore * this.weights.commandExecution +
+      breakdown.persistenceScore * this.weights.persistence +
+      breakdown.correlationScore * 0.1
+    );
+
+    const penalized = weighted - breakdown.falsePositivePenalty;
+    const total = Math.max(0, Math.min(100, penalized));
+    
+    // Update breakdown with total
+    breakdown.totalScore = total;
+    
+    return total;
+  }
+
+  /**
+   * Get default base score from severity
+   */
+  private getDefaultBaseScore(severity: MalwareSeverity): number {
+    switch (severity) {
+      case MalwareSeverity.CRITICAL: return 80;
+      case MalwareSeverity.HIGH: return 60;
+      case MalwareSeverity.MEDIUM: return 40;
+      case MalwareSeverity.LOW: return 20;
+      case MalwareSeverity.INFO: return 10;
+      default: return 30;
+    }
+  }
+
+  /**
+   * Calculate score from pattern matches
+   */
+  private calculatePatternScore(
+    matches: PatternMatch[],
+    rule: MalwareRule
+  ): number {
+    if (matches.length === 0) return 0;
+
+    // Base score for having any match
+    let score = 30;
+
+    // Bonus for multiple matches (diminishing returns)
+    const matchBonus = Math.min(matches.length * 5, 30);
+    score += matchBonus;
+
+    // Bonus for matches from different patterns
+    const uniquePatterns = new Set(
+      matches.map(m => m.pattern.patternId || JSON.stringify(m.pattern))
+    );
+    const diversityBonus = Math.min(uniquePatterns.size * 10, 20);
+    score += diversityBonus;
+
+    // Weight by pattern weights if defined
+    const weightedSum = matches.reduce((sum, match) => {
+      return sum + (match.pattern.weight ?? 1);
+    }, 0);
+    const avgWeight = weightedSum / matches.length;
+    score *= avgWeight;
+
+    return Math.min(score, 100);
+  }
+
+  /**
+   * Calculate obfuscation score
+   */
+  private calculateObfuscationScore(context: AnalysisContext): number {
+    const obfLevel = detectObfuscationLevel(context.content, context.language);
+    const entropy = calculateEntropy(context.content);
+
+    // Combine obfuscation level and entropy
+    let score = obfLevel * 60;
+
+    // High entropy bonus
+    if (entropy > 6.5) {
+      score += 25;
+    } else if (entropy > 5.5) {
+      score += 15;
+    }
+
+    // Environment check detection
+    const envChecks = detectEnvironmentChecks(context.content);
+    if (envChecks.detected) {
+      score += envChecks.checks.length * 5;
+    }
+
+    return Math.min(score, 100);
+  }
+
+  /**
+   * Calculate network indicator score
+   */
+  private calculateNetworkScore(content: string, matches: PatternMatch[]): number {
+    let score = 0;
+
+    // Check for network-related patterns in matches
+    const networkPatterns = [
+      /fetch|axios|request|http|socket/i,
+      /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/,
+      /https?:\/\//i,
+      /websocket|ws:\/\//i
+    ];
+
+    for (const pattern of networkPatterns) {
+      if (pattern.test(content)) {
+        score += 15;
+      }
+    }
+
+    // Check for suspicious destinations
+    const suspiciousPatterns = [
+      /pastebin|hastebin|ghostbin/i,
+      /ngrok|serveo|localtunnel/i,
+      /\.onion|\.bit|\.i2p/i
+    ];
+
+    for (const pattern of suspiciousPatterns) {
+      if (pattern.test(content)) {
+        score += 25;
+      }
+    }
+
+    return Math.min(score, 100);
+  }
+
+  /**
+   * Calculate execution indicator score
+   */
+  private calculateExecutionScore(content: string, matches: PatternMatch[]): number {
+    let score = 0;
+
+    // Direct execution patterns
+    const execPatterns = [
+      { pattern: /eval\s*\(/i, weight: 30 },
+      { pattern: /Function\s*\(/i, weight: 25 },
+      { pattern: /exec\s*\(/i, weight: 30 },
+      { pattern: /system\s*\(/i, weight: 35 },
+      { pattern: /shell_exec/i, weight: 35 },
+      { pattern: /subprocess\./i, weight: 25 },
+      { pattern: /child_process/i, weight: 30 },
+      { pattern: /Process\.Start/i, weight: 30 },
+      { pattern: /Runtime\.exec/i, weight: 30 }
+    ];
+
+    for (const { pattern, weight } of execPatterns) {
+      if (pattern.test(content)) {
+        score += weight;
+      }
+    }
+
+    return Math.min(score, 100);
+  }
+
+  /**
+   * Calculate persistence indicator score
+   */
+  private calculatePersistenceScore(content: string, matches: PatternMatch[]): number {
+    let score = 0;
+
+    // Persistence patterns
+    const persistencePatterns = [
+      { pattern: /crontab|systemd|launchd/i, weight: 25 },
+      { pattern: /registry|HKEY_/i, weight: 25 },
+      { pattern: /startup|autorun/i, weight: 20 },
+      { pattern: /\.bashrc|\.profile|\.zshrc/i, weight: 20 },
+      { pattern: /scheduled.*task|schtasks/i, weight: 25 },
+      { pattern: /service.*install|daemon/i, weight: 20 }
+    ];
+
+    for (const { pattern, weight } of persistencePatterns) {
+      if (pattern.test(content)) {
+        score += weight;
+      }
+    }
+
+    return Math.min(score, 100);
+  }
+
+  /**
+   * Calculate correlation score from related findings
+   */
+  private calculateCorrelationScore(
+    rule: MalwareRule,
+    previousFindings: MalwareFinding[],
+    relatedFindings: MalwareFinding[]
+  ): number {
+    let score = 0;
+
+    if (!rule.correlation) {
+      return score;
+    }
+
+    const allFindings = [...previousFindings, ...relatedFindings];
+    const findingRuleIds = new Set(allFindings.map(f => f.ruleId));
+
+    // Check for amplifying rules
+    if (rule.correlation.amplifyWith) {
+      for (const amplifyId of rule.correlation.amplifyWith) {
+        if (findingRuleIds.has(amplifyId)) {
+          score += rule.correlation.severityBoost ?? 15;
+        }
+      }
+    }
+
+    return Math.min(score, 50);
+  }
+
+  /**
+   * Calculate false positive penalty
+   */
+  private calculateFalsePositivePenalty(
+    rule: MalwareRule,
+    context: AnalysisContext
+  ): number {
+    let penalty = 0;
+
+    // Vendor code penalty
+    if (context.isVendorCode) {
+      penalty += 20;
+    }
+
+    // Test file penalty
+    if (context.isTestFile) {
+      penalty += 30;
+    }
+
+    // Check for false positive patterns
+    if (rule.falsePositivePatterns) {
+      for (const fpPattern of rule.falsePositivePatterns) {
+        if (fpPattern.type === 'regex') {
+          const regex = new RegExp(fpPattern.pattern, fpPattern.flags || 'gi');
+          if (regex.test(context.content)) {
+            penalty += 15;
+          }
+        }
+      }
+    }
+
+    return Math.min(penalty, 50);
+  }
+
+  /**
+   * Convert score to severity
+   */
+  private scoreToSeverity(score: number): MalwareSeverity {
+    if (score >= SCORE_THRESHOLDS.CRITICAL) return MalwareSeverity.CRITICAL;
+    if (score >= SCORE_THRESHOLDS.HIGH) return MalwareSeverity.HIGH;
+    if (score >= SCORE_THRESHOLDS.MEDIUM) return MalwareSeverity.MEDIUM;
+    if (score >= SCORE_THRESHOLDS.LOW) return MalwareSeverity.LOW;
+    return MalwareSeverity.INFO;
+  }
+
+  /**
+   * Convert score to risk level
+   */
+  private scoreToRiskLevel(score: number): 'critical' | 'high' | 'medium' | 'low' | 'minimal' {
+    if (score >= RISK_LEVELS.CRITICAL.min) return RISK_LEVELS.CRITICAL.label;
+    if (score >= RISK_LEVELS.HIGH.min) return RISK_LEVELS.HIGH.label;
+    if (score >= RISK_LEVELS.MEDIUM.min) return RISK_LEVELS.MEDIUM.label;
+    if (score >= RISK_LEVELS.LOW.min) return RISK_LEVELS.LOW.label;
+    return RISK_LEVELS.MINIMAL.label;
+  }
+
+  /**
+   * Generate human-readable explanation
+   */
+  private generateExplanation(
+    breakdown: MalwareScoreBreakdown,
+    matchCount: number
+  ): string {
+    const factors: string[] = [];
+
+    if (breakdown.patternScore > 50) {
+      factors.push(`Strong pattern match (${matchCount} matches)`);
+    } else if (breakdown.patternScore > 20) {
+      factors.push(`Pattern detected (${matchCount} matches)`);
+    }
+
+    if (breakdown.obfuscationScore > 50) {
+      factors.push('High code obfuscation detected');
+    } else if (breakdown.obfuscationScore > 25) {
+      factors.push('Moderate obfuscation present');
+    }
+
+    if (breakdown.networkScore > 50) {
+      factors.push('Suspicious network activity indicators');
+    }
+
+    if (breakdown.executionScore > 50) {
+      factors.push('Dangerous code execution patterns');
+    }
+
+    if (breakdown.persistenceScore > 25) {
+      factors.push('Persistence mechanism indicators');
+    }
+
+    if (breakdown.correlationScore > 0) {
+      factors.push('Correlated with other malware indicators');
+    }
+
+    if (breakdown.falsePositivePenalty > 0) {
+      factors.push('Possible false positive indicators present');
+    }
+
+    if (factors.length === 0) {
+      return 'Low-confidence detection based on basic pattern matching';
+    }
+
+    return factors.join('. ') + '.';
+  }
+
+  /**
+   * Calculate combined score for multiple findings
+   */
+  calculateCombinedScore(findings: MalwareFinding[]): MalwareScore {
+    if (findings.length === 0) {
+      return {
+        score: 0,
+        breakdown: {
+          baseScore: 0,
+          patternScore: 0,
+          obfuscationScore: 0,
+          networkScore: 0,
+          executionScore: 0,
+          persistenceScore: 0,
+          correlationScore: 0,
+          falsePositivePenalty: 0,
+          totalScore: 0
+        },
+        calculatedSeverity: MalwareSeverity.INFO,
+        riskLevel: 'minimal',
+        explanation: 'No findings detected'
+      };
+    }
+
+    // Aggregate breakdowns
+    const aggregated: MalwareScoreBreakdown = {
+      baseScore: 0,
+      patternScore: 0,
+      obfuscationScore: 0,
+      networkScore: 0,
+      executionScore: 0,
+      persistenceScore: 0,
+      correlationScore: 0,
+      falsePositivePenalty: 0,
+      totalScore: 0
+    };
+
+    for (const finding of findings) {
+      const b = finding.malwareScore.breakdown;
+      aggregated.baseScore = Math.max(aggregated.baseScore, b.baseScore);
+      aggregated.patternScore += b.patternScore * 0.5;
+      aggregated.obfuscationScore = Math.max(aggregated.obfuscationScore, b.obfuscationScore);
+      aggregated.networkScore = Math.max(aggregated.networkScore, b.networkScore);
+      aggregated.executionScore = Math.max(aggregated.executionScore, b.executionScore);
+      aggregated.persistenceScore = Math.max(aggregated.persistenceScore, b.persistenceScore);
+      aggregated.correlationScore += 5; // Bonus for multiple findings
+    }
+
+    // Cap values
+    aggregated.patternScore = Math.min(aggregated.patternScore, 100);
+    aggregated.correlationScore = Math.min(aggregated.correlationScore, 50);
+
+    const totalScore = this.calculateTotalScore(aggregated);
+    const severity = this.scoreToSeverity(totalScore);
+    const riskLevel = this.scoreToRiskLevel(totalScore);
+
+    return {
+      score: Math.round(totalScore),
+      breakdown: aggregated,
+      calculatedSeverity: severity,
+      riskLevel,
+      explanation: `Combined analysis of ${findings.length} findings. ${this.generateExplanation(aggregated, findings.length)}`
+    };
+  }
+}
+
+// ============================================================================
+// CONFIDENCE CALCULATOR
+// ============================================================================
+
+/**
+ * Calculate confidence level based on evidence
+ */
+export function calculateConfidence(
+  matchCount: number,
+  patternDiversity: number,
+  hasContextualEvidence: boolean,
+  hasCorrelation: boolean
+): ConfidenceLevel {
+  let score = 0;
+
+  // Match count contribution
+  if (matchCount >= 5) score += 30;
+  else if (matchCount >= 3) score += 20;
+  else if (matchCount >= 1) score += 10;
+
+  // Pattern diversity contribution
+  if (patternDiversity >= 3) score += 25;
+  else if (patternDiversity >= 2) score += 15;
+  else score += 5;
+
+  // Contextual evidence contribution
+  if (hasContextualEvidence) score += 25;
+
+  // Correlation contribution
+  if (hasCorrelation) score += 20;
+
+  // Map to confidence level
+  if (score >= 80) return ConfidenceLevel.CONFIRMED;
+  if (score >= 60) return ConfidenceLevel.HIGH;
+  if (score >= 40) return ConfidenceLevel.MEDIUM;
+  if (score >= 20) return ConfidenceLevel.LOW;
+  return ConfidenceLevel.TENTATIVE;
+}
+
+// ============================================================================
+// EXPORTS
+// ============================================================================
+
+export const scoreCalculator = new MalwareScoreCalculator();