def extract_features(log_entry):
    """从日志中提取安全特征"""
    features = {
        'timestamp': log_entry['timestamp'],
        'source_ip': extract_ip(log_entry['message']),
        'user': extract_username(log_entry['message']),
        'action': classify_action(log_entry['message']),
        'severity': log_level_to_severity(log_entry['level']),
        'location': extract_location(log_entry.get('geoip', {})),
        'device_type': detect_device(log_entry.get('user_agent', ''))
    }
    
    # 计算时间特征
    features['hour_of_day'] = features['timestamp'].hour
    features['is_weekend'] = features['timestamp'].weekday() >= 5
    
    return features

def analyze_ssh_attack(log_entries):
    """使用 LLM 分析 SSH 暴力破解攻击"""
    
    # 汇总关键信息
    summary = summarize_ssh_logs(log_entries)
    
    # 构建 LLM 提示词
    prompt = f"""你是一位经验丰富的安全分析师。请分析以下 SSH 登录事件，判断是否为暴力破解攻击：

{summary}

请回答：
1. 是否确认为暴力破解攻击（是/否）
2. 攻击源 IP 地址及数量
3. 被攻击的用户名列表
4. 攻击持续时间（分钟）
5. 严重程度（低/中/高/紧急）
6. 建议采取的措施
7. 是否有进一步关联的其他威胁
返回 JSON 格式的结果。"""
    
    response = call_llm_api(prompt)
    return parse_json_response(response)

#!/bin/bash
# ssh_block.sh

THRESHOLD=5  # 最大允许失败次数

# 获取最近失败的登录记录
FAILED_LOGS=$(grep "Failed password" /var/log/auth.log | tail -100 | awk '{print $11}' | sort | uniq -c | sort -nr)

while read count ip; do
    if [ $count -gt $THRESHOLD ]; then
        echo "检测到暴力破解: $IP 出现 $count 次，正在封锁..."
        
        # 添加到 hosts.deny
        echo "$IP : ALL" >> /etc/hosts.deny
        
        # 或者使用 iptables 封禁
        iptables -A INPUT -s $ip -j DROP
        
        # 发送告警
        send_alert "SSH 暴力破解封堵: $IP (失败次数: $count)"
        
        # 如果有必要，重启 SSH 服务更改端口
        systemctl restart ssh
    fi
done <<< "$FAILED_LOGS"

def analyze_web_logs(nginx_logs):
    """分析 Nginx 访问日志检测 Web 攻击"""
    
    suspicious_patterns = [
        r'.*\/.*\.php\?.*=.*system.*',      # PHP 命令注入
        r'.*select\s+.*from.*union.*',      # SQL 注入
        r'.*<script>',                      # XSS
        r'.*etc/passwd',                   # 路径遍历
        r'.*\\.\\.',                        # 目录遍历
    ]
    
    analysis = {
        'total_requests': len(nginx_logs),
        'suspicious_requests': [],
        'attack_sources': {},
        'most_common_attack': None
    }
    
    for log in nginx_logs:
        for pattern in suspicious_patterns:
            if re.search(pattern, log.get('uri', ''), re.IGNORECASE):
                analysis['suspicious_requests'].append({
                    'ip': log.get('ip'),
                    'uri': log.get('uri'),
                    'pattern': pattern,
                    'timestamp': log.get('timestamp')
                })
                
                # 统计攻击源
                ip = log.get('ip')
                analysis['attack_sources'][ip] = analysis['attack_sources'].get(ip, 0) + 1
    
    # 找出最常见的攻击类型
    if analysis['suspicious_requests']:
        most_common = max(set(p['pattern'] for p in analysis['suspicious_requests']), 
                          key=lambda p: sum(1 for r in analysis['suspicious_requests'] if r['pattern'] == p))
        analysis['most_common_attack'] = most_common
    
    return analysis

def llm_web_analysis(log_entry):
    """使用 LLM 分析复杂的 Web 请求"""
    
    prompt = f"""你是一位 Web 安全专家。请分析以下 HTTP 请求，判断是否存在安全风险：

方法: {log_entry['method']}
URL: {log_entry['url']}
User-Agent: {log_entry.get('user_agent', 'N/A')}
Referer: {log_entry.get('referer', 'N/A')}
参数: {log_entry.get('params', '{}')}

请回答：
1. 是否存在安全威胁（是/否）
2. 威胁类型（SQL注入/XSS/命令注入/其他）
3. 严重程度（低/中/高）
4. 详细说明和建议的操作
返回 JSON 格式的结果。"""
    
    response = call_llm_api(prompt)
    return parse_json_response(response)

class InternalThreatMonitor:
    def __init__(self, baseline_db):
        self.baseline = baseline_db  # 存储正常行为基线
        self.alert_threshold = 3  # 触发告警的异常次数
    
    def check_process_creation(self, event):
        """检测可疑进程创建"""
        suspicious_executables = [
            '/bin/netcat', '/curl', '/socat', '/base64', '/openssl',
            '/tmp/', '/dev/shm/'
        ]
        
        for exe in suspicious_executables:
            if exe in event['executable']:
                self.increment_suspicion(event['user'], event['process_id'])
                return True
        
        return False
    
    def check_file_access(self, event):
        """检测敏感文件访问"""
        sensitive_files = [
            '/etc/passwd', '/etc/shadow', '/root/.ssh/id*', 
            '~/.config/docker/config.json', '.env', '.aws/'
        ]
        
        for sfile in sensitive_files:
            if sfile in event['file_path']:
                self.increment_suspicion(event['user'], event['process_id'])
                return True
        
        return False
    
    def increment_suspicion(self, user, pid):
        """增加怀疑计数并可能触发告警"""
        key = f"{user}:{pid}"
        self.suspicion_counts[key] = self.suspicion_counts.get(key, 0) + 1
        
        if self.suspicion_counts[key] >= self.alert_threshold:
            self.generate_threat_alert(user, pid)
            self.suspicion_counts[key] = 0  # 重置计数器
    
    def generate_threat_alert(self, user, pid):
        """生成威胁告警"""
        alert = {
            'type': 'internal_threat',
            'user': user,
            'process_id': pid,
            'suspicion_count': self.suspicion_counts[pid],
            'timestamp': datetime.now().isoformat(),
            'recommendation': f"调查用户 {user} 的进程 {pid} 的行为，考虑重置凭证"
        }
        send_security_alert(alert)
        notify_admin(alert)

def analyze_user_behavior(log_entries, user_context):
    """使用 LLM 综合分析用户行为模式"""
    
    # 聚合用户近期行为
    behavior_summary = aggregate_user_behavior(log_entries)
    
    prompt = f"""你是一位安全运营专家。请分析以下用户行为模式，判断是否存在异常或潜在威胁：

用户: {user_context['username']}
角色: {user_context['role']}
正常活动时间: {user_context['normal_hours']}
通常登录位置: {user_context['normal_locations']}

近期活动摘要:
{behavior_summary}

具体问题：
1. 当前行为是否与历史模式有显著差异（是/否）
2. 如果存在差异，具体体现在哪些方面（时间/地点/设备/操作类型）
3. 风险等级评估（低/中/高）
4. 是否建议暂时冻结账户或要求二次验证
5. 详细的调查建议和取证步骤
返回 JSON 格式的结果。"""
    
    analysis = call_llm_api(prompt)
    return analysis

def block_ip(ip_address, duration_minutes=60):
    """封禁恶意 IP"""
    
    # 检查是否已存在封禁
    if is_blocked(ip_address):
        return False
    
    # 添加防火墙规则
    try:
        if use_fail2ban():
            subprocess.run(['fail2ban-client', 'set', 'sshd', 'banip', ip_address])
        elif use_ufw():
            subprocess.run(['ufw', 'deny', 'from', ip_address])
        elif use_iptables():
            subprocess.run(['iptables', '-A', 'INPUT', '-s', ip_address, '-j', 'DROP'])
        
        # 记录操作
        audit_log(action='block_ip', target=ip_address, initiated_by='AI_Security_System')
        
        # 设置定时解除（如果需要）
        schedule_unblock(ip_address, duration_minutes)
        
        return True
    except Exception as e:
        log_error(f"封禁 IP {ip_address} 失败: {e}")
        return False

def terminate_suspicious_process(pid, process_name):
    """终止可疑进程"""
    
    # 先发送 SIGTERM，再发送 SIGKILL
    try:
        os.kill(pid, signal.SIGTERM)
        time.sleep(2)
        
        # 检查进程是否还在
        if psutil.pid_exists(pid):
            os.kill(pid, signal.SIGSIGKILL)
        
        # 收集进程上下文（用于取证）
        process_info = get_process_context(pid)
        save_evidence(pid, process_info)
        
        audit_log(action='terminate_process', pid=pid, name=process_name, initiated_by='AI_Security_System')
        
        return True
    except ProcessLookupError:
        return False
    except PermissionError:
        return False

def isolate_docker_container(container_name):
    """隔离受感染的 Docker 容器"""
    
    client = docker.from_env()
    
    try:
        container = client.containers.get(container_name)
        
        # 停止容器的网络访问
        container.update(network_mode="none")
        
        # 创建保存现场副本
        snapshot_tag = f"{container_name}-snapshot-{int(time.time())}"
        container.commit(snapshot=snapshot_tag)
        
        # 记录镜像哈希用于后续分析
        image_digest = container.image.digest()
        save_incident_evidence(container_name, image_digest)
        
        # 发送告警
        send_alert(f"容器 {container_name} 已隔离，请调查原因")
        
        audit_log(action='isolate_container', container=container_name, initiated_by='AI_Security_System')
        
        return True
    except docker.errors.NotFound:
        return False

# security-config.yaml
system:
  enabled: true
  auto_scale: true
  log_retention_days: 30

llm_client:
  provider: qwen
  base_url: https://dashscope.aliyuncs.com/api/v1/services/aigc/text-generation/geminal-chat
  api_key: ${DASHSCOPE_API_KEY}
  model: qwen-max
  
  # 优化策略
  caching_enabled: true
  cache_max_size: 1000
  max_calls_per_hour: 1000

detection_rules:
  ssh_failed_attempts: 5
  ssh_window_seconds: 60
  web_suspicious_requests: 10
  window_minutes: 5

response_policies:
  level_1:  # P1 紧急
    actions: ['block_ip', 'terminate_process', 'isolate_container']
    require_approval: false
    notify_channels: ['slack', 'email', 'sms']
  
  level_2:  # P2 高
    actions: ['block_ip', 'alert_admin']
    require_approval: false
    notify_channels: ['slack', 'email']
  
  level_3:  # P3 中
    actions: ['log_event', 'monitor_more']
    require_approval: true
    notify_channels: ['slack']
  
  level_4:  # P4 低
    actions: ['log_only']
    require_approval: true
    notify_channels: []

safety_rules:
  max_concurrent_operations: 3
  cooldown_period: 300
  maintenance_windows:
    - '02:00-06:00'  # 维护窗口，不自动执行高风险操作
  protected_ips:
    - '192.168.1.0/24'
    - 'your-office-ip'

sudo apt update
sudo apt install -y python3-pip docker.io
pip3 install requests docker python-multipart pyyaml
sudo systemctl enable --now docker

# 创建 systemd 服务单元
sudo vim /etc/systemd/system/ai-security-monitor.service

[Unit]
Description=AI Security Monitoring Service
After=network.target docker.service

[Service]
Type=simple
User=root
WorkingDirectory=/opt/ai-security
ExecStart=/usr/bin/python3 /opt/ai-security/security_monitor.py
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable ai-security-monitor
sudo systemctl start ai-security-monitor

# /etc/environment or ~/.bashrc
export DASHSCOPE_API_KEY=your-api-key-export
export OPENAI_API_KEY=optional

# init_db.py
import sqlite3

conn = sqlite3.connect('/var/lib/ai-security/events.db')
cursor = conn.cursor()

cursor.execute('''
CREATE TABLE IF NOT EXISTS events (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    timestamp DATETIME DEFAULT CURRENT_TIMESTAMP,
    event_type TEXT,
    severity TEXT,
    source_ip TEXT,
    description TEXT,
    analyzed BOOLEAN DEFAULT 0,
    action_taken TEXT
)
''')

cursor.execute('''
CREATE INDEX IF NOT EXISTS idx_timestamp ON events(timestamp)
''')

cursor.execute('''
CREATE INDEX IF NOT EXISTS idx_severity ON events(severity)
''')

conn.commit()
conn.close()

SYSTEM_PROMPTS = {
    "ssh_audit": """你是一位资深 SSH 安全分析师。请分析以下 SSH 登录尝试日志：
- 区分正常登录和暴力破解尝试
- 识别异常登录时间和地理位置
- 评估账户被攻破的风险
- 提供具体的加固建议
以 JSON 格式返回结果：{threat_score: number, is_brute_force: bool, recommended_actions: []}""",

    "web_request": """你是一位 Web 安全专家。请分析以下 HTTP 请求：
- 检测 SQL 注入、XSS、命令注入等常见攻击
- 评估请求的危险等级
- 如果是攻击，分类并提供修复建议
以 JSON 格式返回：{is_malicious: bool, threat_type: string, severity: string, mitigation_steps: []}""",

    "incident_report": """你是一名安全 incident responder。请根据以下事件信息：
- 总结发生了什么
- 确定影响范围和损失程度
- 提出短期应对措施和长期改进建议
- 编写一份适合管理层阅读的简明报告""",
    
    "forensics_analysis": """你是一名数字取证专家。请分析以下系统状态：
- 识别潜在的持久化机制
- 查找隐藏的恶意文件或后门
- 评估攻击者的访问权限
- 建议取证和清除步骤""",
}

import time
from functools import lru_cache
import hashlib

class SecureLLMClient:
    def __init__(self, api_key, base_url, max_retries=3):
        self.api_key = api_key
        self.base_url = base_url
        self.max_retries = max_retries
        self.call_history = []
        self.call_rate_limit = 10  # 每秒最大调用次数
        self.last_call_time = 0
    
    @lru_cache(maxsize=500)
    def cached_analysis(self, prompt_hash, system_prompt, user_prompt):
        """缓存相同提示词的响应，避免重复调用相同分析"""
        return self._call_api(system_prompt, user_prompt)
    
    def rate_limit(self):
        """实施速率限制，防止 API 超限"""
        elapsed = time.time() - self.last_call_time
        if elapsed < (1 / self.call_rate_limit):
            time.sleep((1 / self.call_rate_limit) - elapsed)
        self.last_call_time = time.time()
    
    def _call_api(self, system_prompt, user_prompt):
        """带重试机制的安全 API 调用"""
        for attempt in range(self.max_retries):
            try:
                self.rate_limit()
                
                payload = {
                    "model": "qwen-max",
                    "messages": [
                        {"role": "system", "content": system_prompt},
                        {"role": "user", "content": user_prompt}
                    ],
                    "timeout": 30
                }
                
                response = requests.post(
                    f"{self.base_url}/chat/completions",
                    json=payload,
                    headers={"Authorization": f"Bearer {self.api_key}"},
                    timeout=30
                )
                
                result = response.json()
                
                # 记录调用历史（脱敏）
                self.call_history.append({
                    'timestamp': time.time(),
                    'success': response.status_code == 200
                })
                
                if len(self.call_history) > 1000:
                    self.call_history.pop(0)
                
                return result
                
            except (requests.RequestException, TimeoutError) as e:
                if attempt == self.max_retries - 1:
                    raise
                time.sleep(2 ** attempt)  # 指数退避
    
    def monitor_api_usage(self):
        """监控 API 使用情况，防止费用超支"""
        total_calls = len([c for c in self.call_history if c['success']])
        hourly_cost = total_calls * 0.0002  # 假设每次$0.0002
        
        if hourly_cost > 10.0:  # 每小时超过$10
            self.disable_auto_responses()
            send_critical_alert("API 费用超出阈值，已自动禁用自动响应")
        
        return total_calls, hourly_cost
    
    def disable_auto_responses(self):
        """禁用自动响应功能，改为仅告警"""
        print("⚠️  自动响应功能已禁用，请联系管理员")

# safety-security-rules.yaml
safety_rules:
  max_concurrent_operations: 3  # 最多同时执行 3 个安全操作
  cooldown_period: 300  # 操作间隔至少 300 秒
  maintenance_windows:
    - '02:00-06:00'    # 维护窗口（不执行自动操作）
    - '12:00-13:30'    # 午休时间
  
  require_approval_for:
    - "delete_operations"
    - "configuration_changes"
    - "production_service_restart"
    - "database_modification"
  
  allowlist:
    trusted_ips:
      - '192.168.1.0/24'
      - 'office.ip.address'
      - 'backup.server.ip'
    
    allowed_processes:
      - "/usr/sbin/sshd"
      - "/usr/bin/docker"
      - "/usr/bin/systemctl"
      - "/usr/bin/apt"
  
  rollback_strategy:
    enabled: true
    auto_rollback_on_failure: true
    backup_before_change: true
    snapshot_timeout: 300
  
  monitoring:
    track_all_actions: true
    alert_on_unusual_patterns: true
    daily_summary_report: true
    
    # 特别关注以下异常情况
    anomaly_triggers:
      - concurrent_operations > 3
      - operation_frequency > 10_per_minute
      - operation_during_maintenance_window
      - multiple_failed_attempts在同一小时内

class AuditLogger:
    def __init__(self, log_path='/var/log/ai-security-audit.log'):
        self.log_path = log_path
        self.signer = load_signing_key()  # 私钥签名确保完整性
    
    def log(self, action, target=None, details=None, initiated_by='system'):
        """记录安全操作审计日志"""
        record = {
            'timestamp': datetime.now().isoformat(),
            'action': action,
            'target': target,
            'details': details or {},
            'initiated_by': initiated_by,
            'ip': get_request_ip()  如果是来自 HTTP 请求
        }
        
        # 对记录进行数字签名以确保完整性
        record_str = json.dumps(record, sort_keys=True).encode()
        signature = sign_record(record_str, self.signer)
        record['signature'] = base64.b64encode(signature).decode()
        
        # 写入日志
        with open(self.log_path, 'a') as f:
            f.write(json.dumps(record) + '\n')
        
        # 同步到 SIEM 系统（可选）
        send_to_siem(record)
    
    def verify_signature(self, record):
        """验证审计记录的完整性"""
        # 验证签名...
        pass

def collect_feedback(from_alert, analyst_decision):
    """收集安全分析师的反馈用于训练模型"""
    
    feedback_record = {
        'alert_id': alert.id,
        'threat_type': alert.threat_type,
        'llm_prediction': llm_prediction,
        'analyst_decision': analyst_decision,  # 'true_positive' / 'false_positive' / 'ignored'
        'feedback_comments': comments,
        'timestamp': datetime.now().isoformat()
    }
    
    # 保存到反馈数据库
    db.save(feedback_record)
    
    # 定期重新训练异常检测模型
    if feedback_count_since_last_train > 100:
        retrain_anomaly_model(feedback_records)
        clear_cached_models()  # 清空旧模型缓存
    
    return feedback_record

def update_threat_intelligence():
    """定期更新威胁情报知识库"""
    
    # 从外部源获取最新威胁指标
    indicators = fetch_threat_intelligence_feeds([
        'aliensware', 'virus_total', 'custom_internal_feeds'
    ])
    
    # 使用 LLM 整理和分类
    prompt = f"""请整理以下威胁情报指标，按类别分组，并为每条指标标记来源可信度和紧急程度：

{indicators}

输出格式：YAML 字典，包含 category, indicators, confidence, priority 字段"""
    
    organized = call_llm_api(prompt)
    
    # 更新本地知识库
    threat_knowledgebase.update(organized)
    
    # 重新加载检测规则
    reload_detection_rules()