Class: AiRootShield::Analyzers::NetworkAnalyzer

Inherits:
Object
  • Object
show all
Defined in:
lib/ai_root_shield/analyzers/network_analyzer.rb

Overview

Analyzes network security configurations and detects MITM threats

Constant Summary collapse

MITM_INDICATORS =

Known proxy and MITM tools

%w[
  burpsuite
  charles
  fiddler
  owasp zap
  mitmproxy
  proxyman
  wireshark
  tcpdump
  packet capture
  http toolkit
  proxydroid
  drony
].freeze
SUSPICIOUS_CA_PATTERNS =

Suspicious certificate authorities

%w[
  burp
  portswigger
  charles
  fiddler
  zap
  mitmproxy
  proxy
  intercept
  debug
  test
].freeze
SUSPICIOUS_VPN_PATTERNS =

VPN indicators that might be used for malicious purposes

%w[
  tor
  onion
  proxy
  tunnel
  bypass
  unblock
  hide
  anonymous
].freeze

Instance Method Summary collapse

Instance Method Details

#analyze(device_data) ⇒ Object 



51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
 
# File 'lib/ai_root_shield/analyzers/network_analyzer.rb', line 51

def analyze(device_data)
  factors = []
  risk_score = 0

  # Check TLS/SSL configuration
  tls_result = check_tls_configuration(device_data)
  factors.concat(tls_result[:factors])
  risk_score += tls_result[:risk_score]

  # Check for custom CA certificates
  ca_result = check_custom_certificates(device_data)
  factors.concat(ca_result[:factors])
  risk_score += ca_result[:risk_score]

  # Check proxy configuration
  proxy_result = check_proxy_configuration(device_data)
  factors.concat(proxy_result[:factors])
  risk_score += proxy_result[:risk_score]

  # Check VPN configuration
  vpn_result = check_vpn_configuration(device_data)
  factors.concat(vpn_result[:factors])
  risk_score += vpn_result[:risk_score]

  # Check for MITM tools
  mitm_result = check_mitm_tools(device_data)
  factors.concat(mitm_result[:factors])
  risk_score += mitm_result[:risk_score]

  {
    factors: factors,
    risk_score: [risk_score, 100].min
  }
end