Class: AiRootShield::RiskCalculator

Inherits:
Object
  • Object
show all
Defined in:
lib/ai_root_shield/risk_calculator.rb

Overview

Calculates overall risk scores based on detected security factors

Constant Summary collapse

RISK_WEIGHTS =

Risk factor weights for different types of threats

{
  # Root/Jailbreak factors (high risk)
  "ROOT_SU_FOUND" => 25,
  "ROOT_SUPERUSER_APK" => 20,
  "JAILBREAK_CYDIA" => 25,
  "BOOTLOADER_UNLOCKED" => 15,
  "SELINUX_PERMISSIVE" => 20,
  
  # Emulator factors (medium-high risk)
  "EMULATOR_QEMU" => 20,
  "EMULATOR_GENYMOTION" => 18,
  "SIMULATOR_IOS" => 15,
  "MISSING_BASEBAND" => 12,
  "VIRTUAL_SENSORS" => 10,
  
  # Hooking/Instrumentation factors (high risk)
  "FRIDA_GADGET" => 25,
  "XPOSED_FRAMEWORK" => 22,
  "MAGISK_MODULES" => 20,
  "SUBSTRATE_INJECTION" => 18,
  "DEBUGGER_ATTACHED" => 15,
  
  # Integrity factors (medium risk)
  "REPACKAGED_APP" => 18,
  "SIGNATURE_MISMATCH" => 15,
  "DEX_TAMPERED" => 12,
  "BUNDLE_MODIFIED" => 10,
  
  # Network security factors (medium risk)
  "TLS_UNPINNED" => 12,
  "CUSTOM_CA_INSTALLED" => 15,
  "MITM_PROXY_DETECTED" => 18,
  "VPN_SUSPICIOUS" => 8
}.freeze

Class Method Summary collapse

Class Method Details

.calculate_overall_risk(risk_scores, factors, ai_confidence: nil) ⇒ Integer

Calculate overall risk score from individual analyzer results

Parameters:

  • risk_scores (Array<Integer>) —

    Individual risk scores from analyzers

  • factors (Array<String>) —

    Detected risk factors

  • ai_confidence (Float, nil) (defaults to: nil) —

    AI confidence score (0.0-1.0)

Returns:

  • (Integer) —

    Overall risk score (0-100)



48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
 
# File 'lib/ai_root_shield/risk_calculator.rb', line 48

def calculate_overall_risk(risk_scores, factors, ai_confidence: nil)
  return 0 if factors.empty?

  # Calculate weighted score based on detected factors
  weighted_score = calculate_weighted_factor_score(factors)
  
  # Calculate average analyzer score
  avg_analyzer_score = risk_scores.empty? ? 0 : (risk_scores.sum.to_f / risk_scores.length)
  
  # Combine weighted factor score (70%) and analyzer average (30%)
  combined_score = (weighted_score * 0.7) + (avg_analyzer_score * 0.3)
  
  # Apply risk amplification for multiple high-risk factors
  amplified_score = apply_risk_amplification(combined_score, factors)
  
  # Apply AI confidence weighting if available
  if ai_confidence && ai_confidence > 0.5
    ai_weight = (ai_confidence - 0.5) * 2  # Scale 0.5-1.0 to 0.0-1.0
    amplified_score *= (1.0 + ai_weight * 0.2)  # Up to 20% boost for high confidence
  end
  
  # Ensure score is within bounds
  [amplified_score.round, 100].min
end

.recommended_actions(factors) ⇒ Array<String>

Get recommended actions based on risk factors

Parameters:

  • factors (Array<String>) —

    Detected risk factors

Returns:

  • (Array<String>) —

    Recommended security actions



94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
 
# File 'lib/ai_root_shield/risk_calculator.rb', line 94

def recommended_actions(factors)
  actions = []
  
  if has_root_factors?(factors)
    actions << "Block app execution on rooted/jailbroken devices"
  end
  
  if has_emulator_factors?(factors)
    actions << "Implement additional emulator detection measures"
  end
  
  if has_hooking_factors?(factors)
    actions << "Enable anti-tampering and runtime protection"
  end
  
  if has_network_factors?(factors)
    actions << "Enforce certificate pinning and secure communications"
  end
  
  actions << "Monitor device for ongoing security threats" if actions.any?
  actions
end

.risk_level_description(score) ⇒ String

Get risk level description based on score

Parameters:

  • score (Integer) —

    Risk score (0-100)

Returns:

  • (String) —

    Risk level description



76
77
78
79
80
81
82
83
84
85
86
87
88
89
 
# File 'lib/ai_root_shield/risk_calculator.rb', line 76

def risk_level_description(score)
  case score
  when 0..20
    "LOW"
  when 21..40
    "MEDIUM"
  when 41..70
    "HIGH"
  when 71..100
    "CRITICAL"
  else
    "UNKNOWN"
  end
end