# /etc/nginx/conf.d/waf-collector.conf
log_format waf_audit '$remote_addr - $request_time - $upstream_response_time - '
                     '$http_user_agent - $http_x_forwarded_for - '
                     '$request_method $request_uri $status $body_bytes_sent - '
                     '$http_referer - $http_cookie';

access_log /var/log/nginx/waf-audit.log waf_audit;

# All requests pass through WAF module
location / {
    modsecurity on;
    modsecurity_rules_file /etc/nginx/modsecurity/waf-rules.conf;
    proxy_pass http://backend;
}

# /etc/nginx/modsecurity/waf-baseline.conf
SecEngineActivation on
SecRequestBodyAccess On
SecResponseBodyAccess On
SecRequestBodyLimit 13107200
SecRequestBodyNoFilesLimit 131072

# Basic request scanning
SecRule REQUEST_BODY "@rx (?i)(select|insert|update|delete|drop|union|concat)" \
    "id:100001,phase:2,deny,status:403,msg:'SQL Injection Detection'"

SecRule REQUEST_BODY "@rx (?i)(<script|javascript:|onerror|onload)" \
    "id:100002,phase:2,deny,status:403,msg:'XSS Injection Detection'"

# LLM Injection Protection
SecRule REQUEST_BODY "@rx (?i)(prompt injection|ignore previous|jailbreak|sysprompt)" \
    "id:100003,phase:2,deny,status:403,msg:'LLM Injection Detection'"

import psycopg2
import json
from datetime import datetime, timedelta
from collections import defaultdict
import numpy as np

class TrafficBaselineLearner:
    """Traffic baseline learner"""
    
    def __init__(self, db_config):
        self.conn = psycopg2.connect(**db_config)
        self.baseline = {}
    
    def collect_traffic_fingerprint(self, days=7):
        """Collect traffic fingerprints"""
        cutoff = datetime.now() - timedelta(days=days)
        
        query = """
        SELECT 
            remote_addr, request_method, request_uri,
            http_user_agent, http_referer,
            DATE_TRUNC('hour', timestamp) as hour_bucket,
            COUNT(*) as request_count
        FROM waf_audit_log
        WHERE timestamp > %s
        GROUP BY remote_addr, request_method, request_uri, 
                 http_user_agent, http_referer, hour_bucket
        ORDER BY request_count DESC
        """
        
        with self.conn.cursor() as cur:
            cur.execute(query, (cutoff,))
            rows = cur.fetchall()
        
        # Build baseline model
        self.baseline = {
            'normal_uris': self._extract_normal_patterns(rows),
            'normal_agents': self._extract_agent_patterns(rows),
            'traffic_volume': self._compute_volume_baselines(rows),
            'geo_distribution': self._compute_geo_patterns(rows),
            'time_distribution': self._compute_time_patterns(rows),
            'collected_at': datetime.now().isoformat()
        }
        
        return self.baseline
    
    def _extract_normal_patterns(self, rows):
        """Extract normal URI patterns"""
        uri_freq = defaultdict(int)
        for row in rows:
            uri_freq[row[3]] += row[6]
        return dict(sorted(uri_freq.items(), 
                          key=lambda x: x[1], reverse=True)[:1000])
    
    def _compute_volume_baselines(self, rows):
        """Compute traffic volume baselines"""
        volumes = [row[6] for row in rows]
        if not volumes:
            return {}
        return {
            'mean': np.mean(volumes),
            'std': np.std(volumes),
            'p95': np.percentile(volumes, 95),
            'p99': np.percentile(volumes, 99),
            'max': np.max(volumes)
        }
    
    def save_baseline(self):
        """Save baseline to database"""
        with self.conn.cursor() as cur:
            cur.execute("""
                INSERT INTO waf_baseline (data, created_at) 
                VALUES (%s, %s)
            """, (json.dumps(self.baseline), datetime.now()))
        self.conn.commit()

-- Baseline table
CREATE TABLE waf_baseline (
    id SERIAL PRIMARY KEY,
    data JSONB NOT NULL,
    created_at TIMESTAMP NOT NULL DEFAULT NOW(),
    is_active BOOLEAN DEFAULT true
);

-- Request audit table
CREATE TABLE waf_audit_log (
    id SERIAL PRIMARY KEY,
    timestamp TIMESTAMP NOT NULL DEFAULT NOW(),
    remote_addr INET,
    request_method VARCHAR(10),
    request_uri TEXT,
    status_code INTEGER,
    body_bytes_sent INTEGER,
    http_user_agent TEXT,
    http_referer TEXT,
    request_time FLOAT,
    upstream_response_time FLOAT,
    is_blocked BOOLEAN DEFAULT false,
    block_reason TEXT,
    ai_confidence FLOAT,
    processed_by_ai BOOLEAN DEFAULT false
);

CREATE INDEX idx_waf_audit_timestamp ON waf_audit_log(timestamp);
CREATE INDEX idx_waf_audit_addr ON waf_audit_log(remote_addr);
CREATE INDEX idx_waf_audit_blocked ON waf_audit_log(is_blocked);

import asyncio
import json
import redis
import psycopg2
from datetime import datetime
from typing import Dict, List, Optional
import numpy as np
from openai import AsyncOpenAI

class AITraficDetector:
    """AI traffic detection engine"""
    
    def __init__(self, redis_host='localhost', db_config=None, llm_config=None):
        self.redis = redis.Redis(host=redis_host, decode_responses=True)
        self.db_config = db_config
        self.llm_client = AsyncOpenAI(
            api_key=llm_config['api_key'],
            base_url=llm_config.get('base_url', 'https://api.openai.com/v1')
        )
        self.llm_model = llm_config.get('model', 'gpt-4o-mini')
    
    async def analyze_request(self, request_data: Dict) -> Dict:
        """Analyze a single request, return detection result"""
        
        # Layer 1: Fast rule matching
        fast_result = self._fast_rule_check(request_data)
        if fast_result['is_threat']:
            return fast_result
        
        # Layer 2: Statistical analysis
        stat_result = await self._statistical_analysis(request_data)
        if stat_result['threat_score'] > 0.8:
            return stat_result
        
        # Layer 3: AI deep analysis (only for suspicious requests)
        if stat_result['threat_score'] > 0.4:
            ai_result = await self._llm_deep_analysis(request_data, stat_result)
            return ai_result
        
        # Normal request
        return {
            'is_threat': False,
            'threat_score': 0.0,
            'action': 'allow',
            'reason': 'Normal traffic',
            'layer': 'baseline'
        }
    
    def _fast_rule_check(self, request: Dict) -> Dict:
        """Layer 1: Fast filtering based on known patterns"""
        import re
        threats = []
        
        sql_patterns = [
            r"(?i)(\b(SELECT|INSERT|UPDATE|DELETE|DROP|UNION|ALTER)\b.*\b(FROM|INTO|TABLE|SET)\b)",
            r"(?i)(\b(OR|AND)\b\s+\d+\s*=\s*\d+)",
            r"(?i)(--|#|/\*)",
        ]
        
        xss_patterns = [
            r"(?i)<script[^>]*>",
            r"(?i)javascript\s*:",
            r"(?i)\bon\w+\s*=",
        ]
        
        llm_patterns = [
            r"(?i)(prompt\s+injection|ignore\s+previous|jailbreak|sysprompt)",
            r"(?i)(you\s+are\s+now|let's\s+roleplay)",
        ]
        
        combined = request.get('request_uri', '') + ' ' + request.get('request_body', '')
        
        for pattern in sql_patterns + xss_patterns + llm_patterns:
            if re.search(pattern, combined):
                threats.append({'type': 'detected', 'pattern': pattern})
        
        if threats:
            return {
                'is_threat': True,
                'threat_score': 0.95,
                'action': 'block',
                'reason': f"Fast rule match: {[t['type'] for t in threats]}",
                'threats': threats,
                'layer': 'fast_rule'
            }
        
        return {'is_threat': False, 'threat_score': 0.0, 'action': 'allow', 'layer': 'fast_rule'}
    
    async def _statistical_analysis(self, request: Dict) -> Dict:
        """Layer 2: Statistical anomaly detection"""
        uri = request.get('request_uri', '/')
        addr = str(request.get('remote_addr', '0.0.0.0'))
        
        uri_count = self.redis.get(f"waf:uri_freq:{uri}") or 0
        uri_count = int(uri_count) if uri_count else 0
        
        req_key = f"waf:addr_reqs:{addr}"
        req_count = self.redis.incr(req_key)
        self.redis.expire(req_key, 60)
        
        uri_anomaly = max(0, 1.0 - np.log1p(uri_count) / 10.0) if uri_count > 0 else 0
        freq_anomaly = min(1.0, req_count / 100.0)
        
        threat_score = 0.4 * uri_anomaly + 0.3 * freq_anomaly + 0.3 * self._path_anomaly(uri)
        
        return {
            'is_threat': threat_score > 0.5,
            'threat_score': round(threat_score, 3),
            'action': 'block' if threat_score > 0.8 else 'monitor',
            'uri_freq': uri_count,
            'addr_freq': req_count,
            'layer': 'statistical'
        }
    
    def _path_anomaly(self, uri: str) -> float:
        """Calculate URI path anomaly score"""
        length_score = min(1.0, len(uri) / 500.0)
        special_char_score = sum(1 for c in uri if c in '?&="\'%') / max(1, len(uri))
        encoding_score = 1.0 if '%0' in uri.lower() or '%27' in uri.lower() else 0.0
        return min(1.0, length_score * 0.4 + special_char_score * 0.3 + encoding_score * 0.3)
    
    async def _llm_deep_analysis(self, request: Dict, stat_result: Dict) -> Dict:
        """Layer 3: LLM semantic deep analysis"""
        
        context = {
            'request_uri': request.get('request_uri', '')[:200],
            'request_method': request.get('request_method', 'GET'),
            'request_body': request.get('request_body', '')[:300],
            'user_agent': request.get('http_user_agent', '')[:100],
            'remote_addr': str(request.get('remote_addr', '')),
            'statistical_score': stat_result['threat_score'],
        }
        
        prompt = f"""You are a professional web security analyst. Analyze whether this HTTP request contains attack behavior.

Request info:
- Method: {context['request_method']}
- URI: {context['request_uri']}
- Body: {context['request_body']}
- User-Agent: {context['user_agent']}
- Statistical threat score: {context['statistical_score']}

Please analyze:
1.是否存在 SQL 注入、XSS、command injection、path traversal attacks?
2.是否存在 LLM 注入攻击（prompt injection, roleplay bypass）?
3.Is this request likely normal business traffic?

Return analysis result as JSON:
{{
  "is_threat": true/false,
  "threat_type": "sql_injection|xss|command_injection|llm_injection|none",
  "threat_score": 0.0-1.0,
  "reason": "brief explanation",
  "suggested_action": "block|rate_limit|challenge|allow"
}}"""
        
        try:
            response = await self.llm_client.chat.completions.create(
                model=self.llm_model,
                messages=[{"role": "user", "content": prompt}],
                temperature=0.1,
                max_tokens=300
            )
            
            content = response.choices[0].message.content
            ai_result = self._parse_llm_response(content)
            
            final_score = 0.6 * ai_result.get('threat_score', 0) + 0.4 * stat_result['threat_score']
            ai_result['threat_score'] = round(final_score, 3)
            ai_result['layer'] = 'llm_deep'
            
            return ai_result
            
        except Exception as e:
            return {
                'is_threat': stat_result['threat_score'] > 0.7,
                'threat_score': stat_result['threat_score'],
                'action': 'block' if stat_result['threat_score'] > 0.8 else 'monitor',
                'reason': f'LLM analysis failed, using statistical result: {str(e)}',
                'layer': 'llm_fallback'
            }
    
    def _parse_llm_response(self, content: str) -> Dict:
        """Parse LLM JSON response"""
        import re
        try:
            json_match = re.search(r'\{[^{}]*\}', content, re.DOTALL)
            if json_match:
                return json.loads(json_match.group())
        except json.JSONDecodeError:
            pass
        
        return {
            'is_threat': False,
            'threat_type': 'none',
            'threat_score': 0.1,
            'reason': 'Could not parse result, defaulting to allow',
            'suggested_action': 'allow'
        }

import aiohttp
from datetime import datetime
import psycopg2

class RequestPipeline:
    """Asynchronous request processing pipeline"""
    
    def __init__(self, config):
        self.detector = AITraficDetector(**config['detector'])
        self.rule_generator = RuleGenerator(**config['rule_gen'])
        self.db_config = config['db']
        
    async def process_request(self, request: Dict) -> Dict:
        """Process a single request"""
        start_time = datetime.now()
        
        # 1. Asynchronous detection
        detection_result = await self.detector.analyze_request(request)
        
        # 2. Decide action
        action = self._decide_action(detection_result)
        
        # 3. Async log recording
        asyncio.create_task(self._log_request(request, detection_result, action))
        
        # 4. Trigger rule generation for new attack patterns
        if action == 'block' and detection_result.get('threat_type') == 'none':
            asyncio.create_task(
                self.rule_generator.generate_rules_from_attack(request, detection_result)
            )
        
        elapsed = (datetime.now() - start_time).total_seconds() * 1000
        detection_result['processing_time_ms'] = round(elapsed, 2)
        
        return detection_result
    
    def _decide_action(self, result: Dict) -> str:
        """Decide final action based on threat score"""
        score = result.get('threat_score', 0)
        
        if score >= 0.9:
            return 'block'
        elif score >= 0.7:
            return 'rate_limit'
        elif score >= 0.5:
            return 'challenge'
        else:
            return 'allow'
    
    async def _log_request(self, request: Dict, result: Dict, action: str):
        """Async request logging"""
        conn = psycopg2.connect(**self.db_config)
        try:
            with conn.cursor() as cur:
                cur.execute("""
                    INSERT INTO waf_audit_log 
                    (remote_addr, request_method, request_uri, status_code,
                     http_user_agent, http_referer, request_time,
                     is_blocked, block_reason, ai_confidence, processed_by_ai, timestamp)
                    VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, NOW())
                """, (
                    str(request.get('remote_addr', '')),
                    request.get('request_method', 'GET'),
                    request.get('request_uri', '/'),
                    403 if action == 'block' else 200,
                    request.get('http_user_agent', '')[:200],
                    request.get('http_referer', '')[:200],
                    request.get('request_time', 0),
                    action == 'block',
                    result.get('reason', ''),
                    result.get('threat_score', 0),
                    result.get('layer', '') != 'fast_rule'
                ))
            conn.commit()
        finally:
            conn.close()

import re
from typing import Dict
import subprocess

class RuleGenerator:
    """AI-driven rule generator"""
    
    def __init__(self, db_config, output_dir='/etc/nginx/modsecurity/generated'):
        self.db_config = db_config
        self.output_dir = output_dir
        self.rule_counter = 200000
    
    async def generate_rules_from_attack(self, attack_request: Dict, 
                                          detection_result: Dict):
        """Generate WAF rules from attack request"""
        
        # 1. Extract attack features
        features = self._extract_attack_features(attack_request, detection_result)
        
        # 2. Generate rule expression
        rule_expr = self._generate_rule_expression(features)
        
        # 3. Build ModSecurity rule
        modsec_rule = self._build_modsec_rule(features, rule_expr)
        
        # 4. Validate rule
        if self._validate_rule(modsec_rule):
            # 5. Save rule
            self._save_rule(modsec_rule, features)
            
            # 6. Reload Nginx
            self._reload_nginx()
            
            return {'success': True, 'rule_id': modsec_rule['id']}
        
        return {'success': False, 'reason': 'Rule validation failed'}
    
    def _extract_attack_features(self, request: Dict, detection: Dict) -> Dict:
        """Extract attack features"""
        uri = request.get('request_uri', '')
        body = request.get('request_body', '')
        combined = uri + ' ' + body
        
        return {
            'attack_type': detection.get('threat_type', 'unknown'),
            'pattern': self._find_attack_pattern(combined),
            'original_payload': combined[:200],
            'source_addr': str(request.get('remote_addr', '')),
            'severity': self._assess_severity(detection.get('threat_score', 0)),
            'detected_at': datetime.now().isoformat()
        }
    
    def _generate_rule_expression(self, features: Dict) -> str:
        """Generate rule expression based on attack type"""
        attack_type = features['attack_type']
        
        expressions = {
            'sql_injection': (
                r'(?i)(\b(SELECT|INSERT|UPDATE|DELETE|DROP|UNION|ALTER|CREATE)\b'
                r'.*\b(FROM|INTO|TABLE|SET|WHERE|DATABASE)\b)'
            ),
            'xss': r'(?i)(<script[^>]*>|javascript\s*:|on(error|load)\s*=)',
            'command_injection': r'(?i)(;|\||\$\()(ls|cat|id|whoami|wget|curl)\b',
            'llm_injection': (
                r'(?i)(prompt\s+injection|ignore\s+previous|jailbreak|'
                r'dan\s+mode|system\s*prompt|developer\s+mode)'
            ),
            'path_traversal': r'(\.\./|\.\.\\|%2e%2e)',
            'ssrf': r'(?i)(file://|gopher://|dict://|ssh://|localhost|127\.0\.0\.1)'
        }
        
        return expressions.get(attack_type, features['pattern'])
    
    def _build_modsec_rule(self, features: Dict, expression: str) -> Dict:
        """Build ModSecurity rule syntax"""
        rule_id = self.rule_counter
        self.rule_counter += 1
        
        severity_map = {'high': 'CRITICAL', 'medium': 'ERROR', 'low': 'WARNING'}
        severity = severity_map.get(features['severity'], 'WARNING')
        
        rule = {
            'id': rule_id,
            'expression': expression,
            'phase': '2',
            'severity': severity,
            'action': 'deny,status:403',
            'message': f"AI auto-generated {features['attack_type']} protection rule",
            'tags': [f'ai-auto-{features['attack_type']}', 'auto-generated'],
            'created_at': features['detected_at'],
            'source': 'ai_rule_generator',
            'modsec_syntax': (
                f"SecRule REQUEST_BODY|REQUEST_URI|ARGS \"@rx {expression}\" "
                f"\"id:{rule_id},phase:{rule['phase']},"
                f"{rule['action']},"
                f"msg:'{rule['message']}',"
                f"tag:'{rule['tags'][0]}',severity:'{severity}'\""
            )
        }
        
        return rule
    
    def _validate_rule(self, rule: Dict) -> bool:
        """Validate rule syntax"""
        try:
            re.compile(rule['expression'])
            return True
        except re.error:
            return False
    
    def _save_rule(self, rule: Dict, features: Dict):
        """Save rule to file and database"""
        import os
        
        rule_file = os.path.join(self.output_dir, 'ai-generated-rules.conf')
        with open(rule_file, 'a') as f:
            f.write(f"\n# Auto-generated AI rule: {rule['id']}\n")
            f.write(f"# Type: {features['attack_type']}\n")
            f.write(f"# Pattern: {rule['expression'][:100]}\n")
            f.write(rule['modsec_syntax'] + "\n\n")
        
        conn = psycopg2.connect(**self.db_config)
        try:
            with conn.cursor() as cur:
                cur.execute("""
                    INSERT INTO waf_generated_rules 
                    (rule_id, rule_expression, attack_type, severity, 
                     modsec_syntax, source, created_at)
                    VALUES (%s, %s, %s, %s, %s, %s, NOW())
                """, (
                    rule['id'], rule['expression'], features['attack_type'],
                    features['severity'], rule['modsec_syntax'], 'ai_auto'
                ))
            conn.commit()
        finally:
            conn.close()
    
    def _reload_nginx(self):
        """Reload Nginx configuration"""
        try:
            subprocess.run(['nginx', '-t'], check=True, capture_output=True)
            subprocess.run(['nginx', '-s', 'reload'], check=True, capture_output=True)
        except subprocess.CalledProcessError as e:
            self._rollback_last_rule()
            raise
    
    def _rollback_last_rule(self):
        """Rollback the last generated rule"""
        # Implementation for rolling back the most recent rule
        pass
    
    def _assess_severity(self, score: float) -> str:
        """Assess attack severity based on threat score"""
        if score >= 0.9:
            return 'high'
        elif score >= 0.7:
            return 'medium'
        return 'low'
    
    def _find_attack_pattern(self, text: str) -> str:
        """Extract regex pattern from attack text"""
        patterns = []
        
        # Find encoded sequences
        encoded = re.findall(r'%[0-9a-fA-F]{2}', text)
        if encoded:
            patterns.append('%[0-9a-fA-F]{2,}')
        
        # Find special character sequences
        special = re.findall(r'[\x00-\x1f\x7f-\xff]{2,}', text)
        if special:
            patterns.append(r'[\x00-\x1f\x7f-\xff]{2,}')
        
        return '|'.join(patterns) if patterns else text[:50]

-- Rule version management table
CREATE TABLE waf_generated_rules (
    id SERIAL PRIMARY KEY,
    rule_id INTEGER UNIQUE NOT NULL,
    rule_expression TEXT NOT NULL,
    attack_type VARCHAR(50) NOT NULL,
    severity VARCHAR(20) NOT NULL,
    modsec_syntax TEXT NOT NULL,
    source VARCHAR(50) DEFAULT 'ai_auto',
    is_active BOOLEAN DEFAULT true,
    auto_blocked_count INTEGER DEFAULT 0,
    false_positive_count INTEGER DEFAULT 0,
    created_at TIMESTAMP NOT NULL DEFAULT NOW(),
    activated_at TIMESTAMP,
    deactivated_at TIMESTAMP
);

-- Rule performance tracking
CREATE TABLE waf_rule_performance (
    id SERIAL PRIMARY KEY,
    rule_id INTEGER REFERENCES waf_generated_rules(rule_id),
    triggered_at TIMESTAMP NOT NULL DEFAULT NOW(),
    request_uri TEXT,
    matched_payload TEXT,
    is_false_positive BOOLEAN DEFAULT false,
    user_feedback TEXT
);

CREATE INDEX idx_waf_rules_type ON waf_generated_rules(attack_type);
CREATE INDEX idx_waf_rules_active ON waf_generated_rules(is_active);
CREATE INDEX idx_waf_perf_rule ON waf_rule_performance(rule_id);

class RuleQualityEvaluator:
    """Rule quality evaluator"""
    
    def __init__(self, db_config, redis_config):
        self.db_config = db_config
        self.redis = redis.Redis(**redis_config)
    
    def evaluate_rules(self, days=7) -> Dict:
        """Evaluate all auto-generated rules quality"""
        conn = psycopg2.connect(**self.db_config)
        with conn.cursor() as cur:
            cur.execute("""
                SELECT 
                    r.rule_id, r.attack_type, r.is_active,
                    r.auto_blocked_count, r.false_positive_count,
                    COUNT(p.id) as total_triggers,
                    AVG(CASE WHEN p.is_false_positive THEN 1.0 ELSE 0.0 END) as fp_rate
                FROM waf_generated_rules r
                LEFT JOIN waf_rule_performance p ON r.rule_id = p.rule_id
                WHERE r.created_at > NOW() - INTERVAL '%s days'
                GROUP BY r.rule_id, r.attack_type, r.is_active, 
                         r.auto_blocked_count, r.false_positive_count
                ORDER BY r.created_at DESC
            """, (days,))
            
            rules = cur.fetchall()
        
        evaluation = []
        for rule in rules:
            rule_id, attack_type, is_active, blocked, fp, total, fp_rate = rule
            
            if total == 0:
                quality_score = 0.5
            else:
                quality_score = (
                    min(1.0, blocked / max(1, total)) * 0.6 +
                    (1.0 - min(1.0, fp_rate or 0)) * 0.4
                )
            
            decision = 'keep'
            if quality_score < 0.3 and total >= 10:
                decision = 'deactivate'
            elif quality_score > 0.9 and total >= 5:
                decision = 'promote'
            
            evaluation.append({
                'rule_id': rule_id,
                'attack_type': attack_type,
                'quality_score': round(quality_score, 3),
                'total_triggers': total,
                'false_positive_rate': round(fp_rate, 4) if fp_rate else 0,
                'decision': decision
            })
        
        conn.close()
        return {'rules': evaluation, 'evaluated_at': datetime.now().isoformat()}

class DynamicIPBlocklist:
    """Dynamic IP blocking manager"""
    
    def __init__(self, redis, threshold=10, block_duration=3600):
        self.redis = redis
        self.threshold = threshold
        self.block_duration = block_duration
    
    def record_threat(self, ip: str, score: float):
        """Record threat behavior"""
        threat_key = f"waf:threats:{ip}"
        self.redis.incrbyfloat(threat_key, score)
        self.redis.expire(threat_key, self.block_duration)
        
        current_score = self.redis.getfloat(threat_key) or 0
        if current_score >= self.threshold:
            self._block_ip(ip, current_score)
    
    def _block_ip(self, ip: str, score: float):
        """Execute IP blocking"""
        block_key = f"waf:blocked:{ip}"
        if self.redis.get(block_key):
            return
        
        self.redis.setex(block_key, self.block_duration, json.dumps({
            'blocked_at': datetime.now().isoformat(),
            'threat_score': score,
            'reason': f"Cumulative threat score {score:.2f} exceeded threshold {self.threshold}"
        }))
        
        print(f"[WAF] IP {ip} has been blocked, threat score: {score:.2f}")
    
    def is_blocked(self, ip: str) -> bool:
        """Check if IP is blocked"""
        return bool(self.redis.get(f"waf:blocked:{ip}"))
    
    def unblock_ip(self, ip: str):
        """Manually unblock IP"""
        self.redis.delete(f"waf:blocked:{ip}")
        self.redis.delete(f"waf:threats:{ip}")

class FalsePositiveCorrector:
    """False positive self-corrector"""
    
    def __init__(self, db_config, redis):
        self.db_config = db_config
        self.redis = redis
    
    def record_user_feedback(self, request_id: str, is_false_positive: bool, 
                              user_comment: str = ''):
        """Record user feedback"""
        conn = psycopg2.connect(**self.db_config)
        try:
            with conn.cursor() as cur:
                cur.execute("""
                    INSERT INTO waf_user_feedback 
                    (request_id, is_false_positive, comment, created_at)
                    VALUES (%s, %s, %s, NOW())
                """, (request_id, is_false_positive, user_comment))
            conn.commit()
            
            if is_false_positive:
                self._update_rule_fp_count(request_id)
        finally:
            conn.close()
    
    def _update_rule_fp_count(self, request_id: str):
        """Update rule false positive count"""
        conn = psycopg2.connect(**self.db_config)
        try:
            with conn.cursor() as cur:
                cur.execute("""
                    SELECT rule_id FROM waf_audit_log 
                    WHERE id = %s AND is_blocked = true
                """, (request_id,))
                row = cur.fetchone()
                
                if row:
                    rule_id = row[0]
                    cur.execute("""
                        UPDATE waf_generated_rules 
                        SET false_positive_count = false_positive_count + 1
                        WHERE rule_id = %s
                    """, (rule_id,))
                    
                    cur.execute("""
                        SELECT auto_blocked_count, false_positive_count, 
                               is_active FROM waf_generated_rules 
                        WHERE rule_id = %s
                    """, (rule_id,))
                    rule = cur.fetchone()
                    
                    if rule and rule[0] > 0:
                        fp_rate = rule[1] / rule[0]
                        if fp_rate > 0.3 and rule[2]:
                            cur.execute("""
                                UPDATE waf_generated_rules 
                                SET is_active = false, deactivated_at = NOW()
                                WHERE rule_id = %s
                            """, (rule_id,))
                            print(f"[WAF] Rule {rule_id} auto-deactivated due to high FP rate")
                    
                    conn.commit()
        finally:
            conn.close()
    
    def auto_tune_rules(self, batch_size=50):
        """Auto-tune rules based on performance"""
        conn = psycopg2.connect(**self.db_config)
        try:
            with conn.cursor() as cur:
                cur.execute("""
                    SELECT rule_id, attack_type, auto_blocked_count, 
                           false_positive_count, is_active
                    FROM waf_generated_rules
                    WHERE auto_blocked_count >= 10 
                      AND false_positive_count > 0
                      AND is_active = true
                    ORDER BY (false_positive_count::float / 
                              NULLIF(auto_blocked_count, 0)) DESC
                    LIMIT %s
                """, (batch_size,))
                
                for rule_id, attack_type, blocked, fp, active in cur.fetchall():
                    fp_rate = fp / blocked if blocked > 0 else 0
                    
                    if fp_rate > 0.25:
                        cur.execute("""
                            UPDATE waf_generated_rules 
                            SET severity = 'WARNING',
                                action_override = 'rate_limit'
                            WHERE rule_id = %s
                        """, (rule_id,))
                        print(f"[WAF] Rule {rule_id} tuned to rate_limit")
                
                conn.commit()
        finally:
            conn.close()

# docker-compose.waf.yml
version: '3.8'

services:
  nginx-waf:
    image: nginx:1.25-alpine
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/conf.d:/etc/nginx/conf.d
      - ./nginx/modsecurity:/etc/nginx/modsecurity
      - ./logs/nginx:/var/log/nginx
    depends_on:
      - ai-engine
      - redis
      - postgres
    restart: unless-stopped

  ai-engine:
    build: ./ai-engine
    environment:
      - REDIS_HOST=redis
      - DB_HOST=postgres
      - DB_NAME=waf
      - DB_USER=waf_user
      - DB_PASSWORD=${WAF_DB_PASSWORD}
      - LLM_API_KEY=${LLM_API_KEY}
      - LLM_BASE_URL=${LLM_BASE_URL}
      - LEARNING_MODE=true
    volumes:
      - ./ai-engine/rules:/app/rules
      - ./logs/ai:/app/logs
    depends_on:
      - redis
      - postgres
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    command: redis-server --appendonly yes
    volumes:
      - redis_data:/data
    restart: unless-stopped

  postgres:
    image: postgres:16-alpine
    environment:
      - POSTGRES_DB=waf
      - POSTGRES_USER=waf_user
      - POSTGRES_PASSWORD=${WAF_DB_PASSWORD}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    restart: unless-stopped

  waf-dashboard:
    build: ./waf-dashboard
    ports:
      - "8080:80"
    environment:
      - API_URL=http://ai-engine:8000
    depends_on:
      - ai-engine
      - postgres
    restart: unless-stopped

volumes:
  redis_data:
  postgres_data:

# ai-engine/Dockerfile
FROM python:3.11-slim

WORKDIR /app

RUN apt-get update && apt-get install -y \
    gcc \
    libpq-dev \
    && rm -rf /var/lib/apt/lists/*

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY . .

EXPOSE 8000

CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]

# 1. Set environment variables
cp .env.example .env
# Edit .env, fill in LLM_API_KEY and WAF_DB_PASSWORD

# 2. Initialize database
docker-compose -f docker-compose.waf.yml run --rm ai-engine \
    python manage.py migrate

# 3. Start in learning mode (7-14 days)
docker-compose -f docker-compose.waf.yml up -d
# Set LEARNING_MODE=true

# 4. Switch to protection mode after learning
# Edit .env, set LEARNING_MODE=false
docker-compose -f docker-compose.waf.yml restart ai-engine

# 5. View protection stats
curl http://localhost:8080/dashboard/stats

# Recommended configuration
ai_engine:
  # Learning period (days)
  learning_days: 7
  
  # Detection thresholds per layer
  thresholds:
    fast_rule_block: 0.95
    statistical_block: 0.8
    llm_trigger: 0.4
  
  # Rule quality thresholds
  rule_quality:
    auto_deactivate_fp_rate: 0.3
    auto_deactivate_min_triggers: 10
    promote_min_triggers: 5
  
  # IP blocking
  ip_blocking:
    threshold_score: 10.0
    block_duration_hours: 24
  
  # LLM settings
  llm:
    model: gpt-4o-mini  # Best cost-performance ratio
    max_tokens: 300
    temperature: 0.1
    timeout_seconds: 5