Merge pull request #9 from parv68/SIEM

Siem

Author: parv68

examples/01_simple_detect.rs

@@ -0,0 +1,22 @@
+fn main() {
+    let inputs = [
+        "5d41402abc4b2a76b9719d911017c592",
+        "SGVsbG8gV29ybGQ=",
+        "The quick brown fox jumps over the lazy dog",
+    ];
+
+    for input in inputs {
+        println!("Input: {:?}", input);
+
+        if let Some(hash) = cryptotrace::core::hashing::detect_hash(input) {
+            println!("  Hash: {} (confidence {:.2})", hash.algorithm, hash.confidence);
+        }
+        if let Some(enc) = cryptotrace::core::encoding::detect_encoding(input) {
+            println!("  Encoding: {} (confidence {:.2})", enc.encoding_type, enc.confidence);
+        }
+
+        let (entropy, _freq) = cryptotrace::core::entropy::shannon_entropy(input.as_bytes());
+        println!("  Entropy: {:.2}", entropy);
+        println!();
+    }
+}

examples/02_scan_file.rs

@@ -0,0 +1,25 @@
+use std::env;
+use std::fs;
+
+fn main() {
+    let args: Vec<String> = env::args().collect();
+    let path = if args.len() > 1 { &args[1] } else { "Cargo.toml" };
+
+    let data = fs::read(path).expect("Failed to read file");
+
+    match cryptotrace::analyzers::file::analyze_bytes(&data, cryptotrace::types::SourceType::Binary) {
+        Ok(result) => {
+            println!("File: {}", path);
+            println!("Algorithm: {}", result.algorithm.unwrap_or_else(|| "<none>".into()));
+            println!("Encoding: {}", result.detected_type);
+            let (entropy, _) = cryptotrace::core::entropy::shannon_entropy(&data);
+            println!("Entropy: {:.2}", entropy);
+            println!("Confidence: {:.2}", result.confidence);
+            println!("Risk: {:?}", result.risk_level);
+            if !result.weakness_cve.is_empty() {
+                println!("CVEs: {:?}", result.weakness_cve);
+            }
+        }
+        Err(e) => eprintln!("Error: {}", e),
+    }
+}

examples/03_batch_folder.rs

@@ -0,0 +1,33 @@
+use std::env;
+use std::fs;
+
+fn main() {
+    let args: Vec<String> = env::args().collect();
+    let dir = if args.len() > 1 { &args[1] } else { "." };
+    let max_size: u64 = std::env::var("MAX_FILE_SIZE").ok().and_then(|s| s.parse().ok()).unwrap_or(10_485_760);
+
+    for entry in fs::read_dir(dir).unwrap().flatten() {
+        let path = entry.path();
+        if !path.is_file() { continue; }
+
+        let _meta = match fs::metadata(&path) {
+            Ok(m) if m.len() <= max_size => m,
+            _ => continue,
+        };
+
+        let data = match fs::read(&path) {
+            Ok(d) => d,
+            Err(_) => continue,
+        };
+
+        match cryptotrace::analyzers::file::analyze_bytes(&data, cryptotrace::types::SourceType::Binary) {
+            Ok(result) => {
+                let algo = result.algorithm.unwrap_or_else(|| "-".into());
+                let (entropy, _) = cryptotrace::core::entropy::shannon_entropy(&data);
+                println!("{}\t{}\t{}\t{:.2}\t{:.2}",
+                    path.display(), algo, result.detected_type, entropy, result.confidence);
+            }
+            Err(e) => eprintln!("Error scanning {}: {}", path.display(), e),
+        }
+    }
+}

examples/04_compare_inputs.rs

@@ -0,0 +1,26 @@
+use std::io::Read;
+use std::path::Path;
+
+fn main() {
+    let test_data = b"Hello World this is a test string with some data to analyze";
+
+    // Method 1: Raw bytes
+    println!("=== Raw bytes ===");
+    let r1 = cryptotrace::analyzers::file::analyze_bytes(test_data, cryptotrace::types::SourceType::Binary).unwrap();
+    println!("  algo={:?} type={} ent={:.2} conf={:.2}", r1.algorithm, r1.detected_type, r1.entropy, r1.confidence);
+
+    // Method 2: File
+    println!("=== From file ===");
+    let r2 = cryptotrace::analyzers::file::analyze_file(Path::new("Cargo.toml")).unwrap();
+    println!("  algo={:?} type={} ent={:.2} conf={:.2}", r2.algorithm, r2.detected_type, r2.entropy, r2.confidence);
+
+    // Method 3: Stdin (if piped)
+    println!("=== Stdin (pipe data or skip) ===");
+    let mut buf = Vec::new();
+    if std::io::stdin().read_to_end(&mut buf).is_ok() && !buf.is_empty() {
+        let r3 = cryptotrace::analyzers::file::analyze_bytes(&buf, cryptotrace::types::SourceType::Binary).unwrap();
+        println!("  algo={:?} type={} ent={:.2} conf={:.2}", r3.algorithm, r3.detected_type, r3.entropy, r3.confidence);
+    } else {
+        println!("  (no stdin data)");
+    }
+}

examples/05_csv_export.rs

@@ -0,0 +1,34 @@
+use std::env;
+use std::fs;
+
+fn main() {
+    let args: Vec<String> = env::args().collect();
+    let dir = args.get(1).map(|s| s.as_str()).unwrap_or(".");
+    let out = args.get(2).map(|s| s.as_str()).unwrap_or("scan_report.csv");
+
+    let mut wtr = csv::Writer::from_path(out).expect("Failed to create CSV");
+    wtr.write_record(["path", "algorithm", "detected_type", "entropy", "confidence", "risk_level"])
+        .unwrap();
+
+    for entry in fs::read_dir(dir).unwrap().flatten() {
+        let path = entry.path();
+        if !path.is_file() { continue; }
+        let data = match fs::read(&path) {
+            Ok(d) if d.len() <= 10_485_760 => d,
+            _ => continue,
+        };
+        if let Ok(r) = cryptotrace::analyzers::file::analyze_bytes(&data, cryptotrace::types::SourceType::Binary) {
+            let (entropy, _) = cryptotrace::core::entropy::shannon_entropy(&data);
+            wtr.write_record([
+                path.to_string_lossy().as_ref(),
+                r.algorithm.as_deref().unwrap_or("-"),
+                &r.detected_type,
+                &format!("{:.4}", entropy),
+                &format!("{:.4}", r.confidence),
+                &format!("{:?}", r.risk_level),
+            ]).ok();
+        }
+    }
+    wtr.flush().ok();
+    println!("Report written to {}", out);
+}

examples/06_recursive_decode.rs

@@ -0,0 +1,51 @@
+use std::io::{Read, Write};
+
+fn main() {
+    let plaintext = b"Secret configuration: API_KEY=sk-abc123 SECRET=xyz789";
+
+    // Gzip then base64 encode
+    let mut compressed = Vec::new();
+    {
+        let mut encoder = flate2::write::GzEncoder::new(&mut compressed, flate2::Compression::default());
+        encoder.write_all(plaintext).unwrap();
+        encoder.finish().unwrap();
+    }
+
+    use base64::Engine;
+    let b64_payload = base64::engine::general_purpose::STANDARD.encode(&compressed);
+
+    println!("Encoded payload (first 80 chars): {:?}", &b64_payload[..80.min(b64_payload.len())]);
+
+    // Decode layer by layer
+    let mut current = b64_payload.as_bytes().to_vec();
+    for layer in 1..=5 {
+        let s = String::from_utf8_lossy(&current);
+
+        if let Some(enc) = cryptotrace::core::encoding::detect_encoding(&s) {
+            println!("Layer {}: detected encoding = {} (conf={:.2})", layer, enc.encoding_type, enc.confidence);
+
+            match enc.encoding_type.as_str() {
+                "Base64" => {
+                    if let Ok(decoded) = base64::engine::general_purpose::STANDARD.decode(s.trim()) {
+                        current = decoded;
+                        continue;
+                    }
+                }
+                _ => { break; }
+            }
+        }
+
+        if cryptotrace::core::compression::detect_compression(&current).is_some() {
+            let mut decompressed = Vec::new();
+            let mut d = flate2::read::GzDecoder::new(std::io::Cursor::new(&current));
+            if d.read_to_end(&mut decompressed).is_ok() && !decompressed.is_empty() {
+                println!("Layer {}: gzip decompressed ({} bytes)", layer, decompressed.len());
+                current = decompressed;
+                continue;
+            }
+        }
+        break;
+    }
+
+    println!("Final decoded text: {:?}", String::from_utf8_lossy(&current));
+}

examples/07_sandbox_crash_test.rs

@@ -0,0 +1,43 @@
+// Build worker binary first: cargo build --bin cryptotrace-worker
+
+fn main() {
+    let config = cryptotrace::sanitization::sandbox::SandboxConfig {
+        enabled: true,
+        timeout_seconds: 5,
+        max_memory_mb: 256,
+        max_concurrent: 2,
+        worker_path: None,
+    };
+    let sandbox = cryptotrace::sanitization::sandbox::Sandbox::new(config);
+
+    let test_data = b"5d41402abc4b2a76b9719d911017c592";
+    match sandbox.run_worker("detect", test_data) {
+        Ok(output) => {
+            println!("Sandbox worker succeeded ({} bytes)", output.len());
+            if let Ok(text) = String::from_utf8(output) {
+                println!("Output: {}", text);
+            }
+        }
+        Err(e) => {
+            println!("Sandbox worker failed (expected if no worker binary): {}", e);
+            println!("Falling back to in-process analysis...");
+            match cryptotrace::analyzers::file::analyze_bytes(test_data, cryptotrace::types::SourceType::Binary) {
+                Ok(r) => println!("In-process result: algo={:?} ent={}", r.algorithm, r.entropy),
+                Err(e2) => eprintln!("Fallback also failed: {}", e2),
+            }
+        }
+    }
+
+    let tight = cryptotrace::sanitization::sandbox::SandboxConfig {
+        enabled: true,
+        timeout_seconds: 1,
+        worker_path: None,
+        ..Default::default()
+    };
+    let tight_sandbox = cryptotrace::sanitization::sandbox::Sandbox::new(tight);
+    let large_input = vec![b'A'; 1_000_000];
+    match tight_sandbox.run_worker("detect", &large_input) {
+        Ok(_) => println!("Tight timeout: worker finished in time"),
+        Err(e) => println!("Tight timeout: worker timed out as expected: {}", e),
+    }
+}

examples/08_confidence_calibration.rs

@@ -0,0 +1,37 @@
+use cryptotrace::core::calibration::{generate_synthetic_dataset, train, predict_proba, signal_contributions, save_model, load_model};
+use cryptotrace::types::SignalBreakdown;
+
+fn main() {
+    println!("Generating synthetic training data...");
+
+    let dataset = generate_synthetic_dataset(250);
+    println!("  {} samples generated", dataset.len());
+
+    let model = train(&dataset, 0.01, 1000, 0.001);
+    println!("Model trained: intercept={:.4}, weights={:?}", model.intercept, model.weights);
+    println!("Dataset size: {}", model.dataset_size);
+
+    let test_signals = SignalBreakdown {
+        entropy: 0.85,
+        block_alignment: 0.72,
+        magic_bytes: 0.65,
+        length_pattern: 0.91,
+        charset_purity: Some(0.48),
+        byte_distribution: None,
+        window_variance: Some(0.73),
+    };
+    let prob = predict_proba(&model, &test_signals);
+    println!("\nPrediction for high-entropy sample: {:.4}", prob);
+
+    let contribs = signal_contributions(&model, &test_signals);
+    println!("\nSignal contributions:");
+    for sc in &contribs {
+        println!("  {:20} {:>8} {:.4}", sc.signal_name, if sc.coefficient > 0.0 { "+" } else { "-" }, sc.contribution);
+    }
+
+    save_model(&model, "calibration_example.json").ok();
+    if let Ok(loaded) = load_model("calibration_example.json") {
+        println!("\nModel save/load roundtrip: OK (weights={:?})", loaded.weights);
+    }
+    std::fs::remove_file("calibration_example.json").ok();
+}

examples/09_sliding_entropy.rs

@@ -0,0 +1,41 @@
+use std::fs;
+
+fn main() {
+    let args: Vec<String> = std::env::args().collect();
+    let path = if args.len() > 1 { &args[1] } else { "Cargo.toml" };
+    let data = fs::read(path).expect("Failed to read file");
+
+    println!("File: {} ({} bytes)", path, data.len());
+    let (entropy, _) = cryptotrace::core::entropy::shannon_entropy(&data);
+    println!("Global Shannon entropy: {:.2} bits/byte", entropy);
+
+    let sw = cryptotrace::core::sliding_entropy::sliding_window_entropy(&data, Some(4096), None, Some(7.5));
+
+    if sw.window_scores.is_empty() {
+        println!("File too small for any window");
+        return;
+    }
+
+    let avg: f64 = sw.window_scores.iter().sum::<f64>() / sw.window_scores.len() as f64;
+    let max_score = sw.window_scores.iter().cloned().fold(f64::NEG_INFINITY, f64::max);
+    let min_score = sw.window_scores.iter().cloned().fold(f64::INFINITY, f64::min);
+
+    println!("Windows analyzed: {}", sw.window_scores.len());
+    println!("Avg window entropy: {:.2}", avg);
+    println!("Max window entropy: {:.2}", max_score);
+    println!("Min window entropy: {:.2}", min_score);
+    println!("Max window entropy (struct): {:.2}", sw.max_window_entropy);
+    println!("Entropy variance: {:.2}", sw.entropy_variance);
+
+    let hot_count = sw.window_scores.iter().filter(|&&s| s > 7.5).count();
+    if hot_count > 0 {
+        println!("\nHigh-entropy regions (>7.5 bits/byte):");
+        println!("  {} windows above threshold", hot_count);
+        for region in sw.embedded_regions.iter().take(10) {
+            println!("  offset {}-{}", region.start, region.end);
+        }
+        if sw.embedded_regions.len() > 10 {
+            println!("  ... and {} more", sw.embedded_regions.len() - 10);
+        }
+    }
+}

examples/10_threat_intel_pipeline.rs

@@ -0,0 +1,50 @@
+#[tokio::main]
+async fn main() {
+    let sample_hash = "d41d8cd98f00b204e9800998ecf8427e";
+
+    println!("Step 1: Hash identification");
+    if let Some(h) = cryptotrace::core::hashing::detect_hash(sample_hash) {
+        println!("  Algorithm: {} (confidence {:.2})", h.algorithm, h.confidence);
+    }
+
+    println!("\nStep 2: CVE lookup");
+    let cve_map = cryptotrace::intelligence::risk::build_cve_map(
+        "signatures/cve_map.yaml",
+        "cve-db.json",
+    );
+    if let Some(cves) = cve_map.get("MD5") {
+        println!("  Known CVEs for MD5: {:?}", cves);
+    }
+
+    println!("\nStep 3: Threat intel scan");
+    let config = cryptotrace::intelligence::threat_intel::ThreatIntelConfig {
+        vt_api_key: None,
+        yara_rules_path: None,
+        enable_scan: true,
+    };
+
+    let reports = cryptotrace::intelligence::threat_intel::composite_threat_scan(
+        sample_hash,
+        &[],
+        &config,
+    ).await.unwrap_or_default();
+    println!("  Threat reports: {}", reports.len());
+    for report in &reports {
+        println!("    Source: {} | Positives: {}/{} | Malicious: {}",
+            report.source, report.positives, report.total_scanners, report.malicious);
+    }
+
+    let malicious = reports.iter().any(|r| r.malicious);
+    let max_positives = reports.iter().map(|r| r.positives).max().unwrap_or(0);
+    let risk = if malicious {
+        "Critical"
+    } else if max_positives > 5 {
+        "High"
+    } else if max_positives > 2 {
+        "Medium"
+    } else {
+        "Low"
+    };
+    println!("\nStep 4: Composite risk assessment");
+    println!("  Final risk level: {}", risk);
+}