Class: AiRootShield::Enterprise::HybridDetectionEngine

Inherits:
Object
  • Object
show all
Defined in:
lib/ai_root_shield/enterprise/hybrid_detection_engine.rb

Overview

Hybrid RASP + AI detection engine combining real-time and offline analysis

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(config = {}) ⇒ HybridDetectionEngine

Returns a new instance of HybridDetectionEngine.



13
14
15
16
17
18
19
20
21
22
23
 
# File 'lib/ai_root_shield/enterprise/hybrid_detection_engine.rb', line 13

def initialize(config = {})
  @config = default_config.merge(config)
  @status = { active: false, mode: :hybrid }
  @event_queue = Queue.new
  @analysis_cache = {}
  @threat_patterns = load_threat_patterns
  @ml_models = load_ml_models
  @performance_metrics = init_performance_metrics
  
  initialize_engines
end

Instance Attribute Details

#ai_engine ⇒ Object (readonly)

Returns the value of attribute ai_engine.



11
12
13
 
# File 'lib/ai_root_shield/enterprise/hybrid_detection_engine.rb', line 11

def ai_engine
  @ai_engine
end

#offline_engine ⇒ Object (readonly)

Returns the value of attribute offline_engine.



11
12
13
 
# File 'lib/ai_root_shield/enterprise/hybrid_detection_engine.rb', line 11

def offline_engine
  @offline_engine
end

#real_time_engine ⇒ Object (readonly)

Returns the value of attribute real_time_engine.



11
12
13
 
# File 'lib/ai_root_shield/enterprise/hybrid_detection_engine.rb', line 11

def real_time_engine
  @real_time_engine
end

#status ⇒ Object (readonly)

Returns the value of attribute status.



11
12
13
 
# File 'lib/ai_root_shield/enterprise/hybrid_detection_engine.rb', line 11

def status
  @status
end

Instance Method Details

#analyze_threat(data, options = {}) ⇒ Object

Analyze threat using hybrid approach



54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
 
# File 'lib/ai_root_shield/enterprise/hybrid_detection_engine.rb', line 54

def analyze_threat(data, options = {})
  analysis_id = generate_analysis_id
  start_time = Time.now
  
  # Real-time analysis (immediate response)
  real_time_result = @real_time_engine.analyze(data, { analysis_id: analysis_id })
  
  # Queue for offline analysis if needed
  if should_run_offline_analysis?(real_time_result, options)
    queue_offline_analysis(data, analysis_id, options)
  end
  
  # AI-enhanced analysis for complex patterns
  ai_result = @ai_engine.analyze(data, real_time_result, { analysis_id: analysis_id })
  
  # Combine results
  combined_result = combine_analysis_results(real_time_result, ai_result, analysis_id)
  
  # Update performance metrics
  update_performance_metrics(start_time, combined_result)
  
  combined_result
end

#start ⇒ Object

Start hybrid detection system



26
27
28
29
30
31
32
33
34
35
36
37
38
39
 
# File 'lib/ai_root_shield/enterprise/hybrid_detection_engine.rb', line 26

def start
  return false if @status[:active]
  
  @status[:active] = true
  @status[:started_at] = Time.now.utc.iso8601
  
  start_real_time_engine
  start_offline_engine
  start_ai_engine
  start_event_processor
  
  log_event("Hybrid detection engine started", { mode: @status[:mode] })
  true
end

#stop ⇒ Object

Stop hybrid detection system



42
43
44
45
46
47
48
49
50
51
 
# File 'lib/ai_root_shield/enterprise/hybrid_detection_engine.rb', line 42

def stop
  return false unless @status[:active]
  
  @status[:active] = false
  @status[:stopped_at] = Time.now.utc.iso8601
  
  stop_engines
  log_event("Hybrid detection engine stopped")
  true
end

#system_status ⇒ Object

Get system status



79
80
81
82
83
84
85
86
87
88
89
90
91
92
 
# File 'lib/ai_root_shield/enterprise/hybrid_detection_engine.rb', line 79

def system_status
  {
    active: @status[:active],
    mode: @status[:mode],
    engines: {
      real_time: @real_time_engine&.status || {},
      offline: @offline_engine&.status || {},
      ai: @ai_engine&.status || {}
    },
    performance: @performance_metrics,
    queue_size: @event_queue.size,
    cache_size: @analysis_cache.size
  }
end