Spaces:
Sleeping
Sleeping
| """ | |
| Cybersecurity threat analysis and explainability engine: | |
| Generates risk severity assessments, behavioral threat summaries, and actionable | |
| SOC/CSIRT incident response playbooks. | |
| """ | |
| from typing import Dict, Any, List | |
| from src.feature_engineering import extract_threat_indicators | |
| def assess_threat_level(predicted_class: str, probabilities: Dict[str, float], indicators: Dict[str, Any]) -> Dict[str, Any]: | |
| """ | |
| Synthesizes machine learning probabilities with deterministic threat indicators | |
| to determine the operational risk level and defense recommendations. | |
| """ | |
| susp_prob = probabilities.get("Suspicious", 0.0) | |
| spam_prob = probabilities.get("Spam", 0.0) | |
| legit_prob = probabilities.get("Legitimate", 0.0) | |
| # Base severity mapping | |
| if predicted_class == "Suspicious" or susp_prob >= 0.50: | |
| if indicators["credential_count"] > 0 or indicators["financial_count"] > 0 or indicators["ip_url_count"] > 0: | |
| severity = "CRITICAL THREAT" | |
| badge_color = "#e53e3e" # Deep red | |
| risk_score = min(round(8.5 + susp_prob * 1.5, 1), 10.0) | |
| summary = "Critical Business Email Compromise (BEC) or credential harvesting threat detected." | |
| else: | |
| severity = "HIGH THREAT" | |
| badge_color = "#dd6b20" # Orange | |
| risk_score = min(round(7.0 + susp_prob * 2.0, 1), 9.0) | |
| summary = "High probability phishing attempt with social engineering characteristics." | |
| elif predicted_class == "Spam" or spam_prob >= 0.50: | |
| severity = "MODERATE RISK" | |
| badge_color = "#d69e2e" # Amber/Yellow | |
| risk_score = round(3.5 + spam_prob * 2.5, 1) | |
| summary = "Unsolicited commercial email or promotional spam message." | |
| else: | |
| severity = "LOW RISK" | |
| badge_color = "#38a169" # Emerald green | |
| risk_score = round(max(0.5, 10.0 - (legit_prob * 9.5)), 1) | |
| summary = "Legitimate business or personal communication with normal linguistic markers." | |
| # Generate actionable defensive guidance | |
| recommendations = generate_recommendations(predicted_class, indicators, severity) | |
| return { | |
| "severity": severity, | |
| "badge_color": badge_color, | |
| "risk_score_out_of_10": risk_score, | |
| "summary": summary, | |
| "recommendations": recommendations | |
| } | |
| def generate_recommendations(predicted_class: str, indicators: Dict[str, Any], severity: str) -> List[str]: | |
| """ | |
| Generates SOC / CSIRT security playbook action items tailored to detected signals. | |
| """ | |
| recs = [] | |
| if severity in ["CRITICAL THREAT", "HIGH THREAT"]: | |
| recs.append("DO NOT click any embedded hyperlinks or access external portals.") | |
| recs.append("DO NOT download or execute any attached files (archives, documents, scripts).") | |
| recs.append("Forward this message as an RFC 822 attachment to your SOC abuse mailbox (e.g., abuse@yourcompany.com).") | |
| if indicators["financial_count"] > 0: | |
| recs.append("DO NOT process wire transfers or banking changes without verbal out-of-band verification via official phone channels.") | |
| if indicators["credential_count"] > 0: | |
| recs.append("If you entered login credentials on any linked webpage, immediately change your corporate password and revoke active sessions.") | |
| if indicators["ip_url_count"] > 0 or indicators["shortened_url_count"] > 0: | |
| recs.append("The email contains raw IP or shortened redirect links commonly used to bypass reputation filters.") | |
| recs.append("Report sender domain to IT Security to initiate domain-wide gateway quarantine.") | |
| elif severity == "MODERATE RISK": | |
| recs.append("Mark message as Junk / Spam to update local filtering rules.") | |
| recs.append("Do not reply to this email, as confirmation validates your active inbox to bulk senders.") | |
| recs.append("Avoid clicking unsubscribed links on unverified senders; use your email client's native block feature instead.") | |
| recs.append("Never share sensitive personal or corporate data with unknown commercial vendors.") | |
| else: # LOW RISK / LEGITIMATE | |
| recs.append("Standard business communication; safe to process under normal workflow.") | |
| recs.append("Verify unfamiliar external senders if unanticipated attachments or requests arrive.") | |
| recs.append("Maintain good cybersecurity hygiene by verifying sender address headers.") | |
| return recs | |