Spaces:
Sleeping
Sleeping
File size: 4,480 Bytes
e40ee72 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 | """
Cybersecurity threat analysis and explainability engine:
Generates risk severity assessments, behavioral threat summaries, and actionable
SOC/CSIRT incident response playbooks.
"""
from typing import Dict, Any, List
from src.feature_engineering import extract_threat_indicators
def assess_threat_level(predicted_class: str, probabilities: Dict[str, float], indicators: Dict[str, Any]) -> Dict[str, Any]:
"""
Synthesizes machine learning probabilities with deterministic threat indicators
to determine the operational risk level and defense recommendations.
"""
susp_prob = probabilities.get("Suspicious", 0.0)
spam_prob = probabilities.get("Spam", 0.0)
legit_prob = probabilities.get("Legitimate", 0.0)
# Base severity mapping
if predicted_class == "Suspicious" or susp_prob >= 0.50:
if indicators["credential_count"] > 0 or indicators["financial_count"] > 0 or indicators["ip_url_count"] > 0:
severity = "CRITICAL THREAT"
badge_color = "#e53e3e" # Deep red
risk_score = min(round(8.5 + susp_prob * 1.5, 1), 10.0)
summary = "Critical Business Email Compromise (BEC) or credential harvesting threat detected."
else:
severity = "HIGH THREAT"
badge_color = "#dd6b20" # Orange
risk_score = min(round(7.0 + susp_prob * 2.0, 1), 9.0)
summary = "High probability phishing attempt with social engineering characteristics."
elif predicted_class == "Spam" or spam_prob >= 0.50:
severity = "MODERATE RISK"
badge_color = "#d69e2e" # Amber/Yellow
risk_score = round(3.5 + spam_prob * 2.5, 1)
summary = "Unsolicited commercial email or promotional spam message."
else:
severity = "LOW RISK"
badge_color = "#38a169" # Emerald green
risk_score = round(max(0.5, 10.0 - (legit_prob * 9.5)), 1)
summary = "Legitimate business or personal communication with normal linguistic markers."
# Generate actionable defensive guidance
recommendations = generate_recommendations(predicted_class, indicators, severity)
return {
"severity": severity,
"badge_color": badge_color,
"risk_score_out_of_10": risk_score,
"summary": summary,
"recommendations": recommendations
}
def generate_recommendations(predicted_class: str, indicators: Dict[str, Any], severity: str) -> List[str]:
"""
Generates SOC / CSIRT security playbook action items tailored to detected signals.
"""
recs = []
if severity in ["CRITICAL THREAT", "HIGH THREAT"]:
recs.append("DO NOT click any embedded hyperlinks or access external portals.")
recs.append("DO NOT download or execute any attached files (archives, documents, scripts).")
recs.append("Forward this message as an RFC 822 attachment to your SOC abuse mailbox (e.g., abuse@yourcompany.com).")
if indicators["financial_count"] > 0:
recs.append("DO NOT process wire transfers or banking changes without verbal out-of-band verification via official phone channels.")
if indicators["credential_count"] > 0:
recs.append("If you entered login credentials on any linked webpage, immediately change your corporate password and revoke active sessions.")
if indicators["ip_url_count"] > 0 or indicators["shortened_url_count"] > 0:
recs.append("The email contains raw IP or shortened redirect links commonly used to bypass reputation filters.")
recs.append("Report sender domain to IT Security to initiate domain-wide gateway quarantine.")
elif severity == "MODERATE RISK":
recs.append("Mark message as Junk / Spam to update local filtering rules.")
recs.append("Do not reply to this email, as confirmation validates your active inbox to bulk senders.")
recs.append("Avoid clicking unsubscribed links on unverified senders; use your email client's native block feature instead.")
recs.append("Never share sensitive personal or corporate data with unknown commercial vendors.")
else: # LOW RISK / LEGITIMATE
recs.append("Standard business communication; safe to process under normal workflow.")
recs.append("Verify unfamiliar external senders if unanticipated attachments or requests arrive.")
recs.append("Maintain good cybersecurity hygiene by verifying sender address headers.")
return recs
|