日本の重大サイバー攻撃と防御の全体解剖（2024–2026）：
病院・港湾・製造サプライチェーン・証券口座7,393億円被害から学ぶ実践対策

#![forbid(unsafe_code)]

/// Bitflags representing high-confidence intrusion indicators across boundary, AD, and storage.
pub const IOC_VPN_ANOMALOUS_CHILD_PROC: u16 = 1 << 0;
pub const IOC_KERBEROS_RC4_TGS_SWEEP: u16   = 1 << 1;
pub const IOC_DCSYNC_NON_DC_REPL: u16       = 1 << 2;
pub const IOC_VSSADMIN_SHADOW_DELETE: u16   = 1 << 3;
pub const IOC_AITM_JA4_UA_MISMATCH: u16     = 1 << 4;
pub const IOC_WEBAUTHN_RPID_MISMATCH: u16   = 1 << 5;

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum DefenseAction {
    AllowNormal,
    StepUpWebAuthnRequired,
    RevokeSessionAndAlertSoc,
    IsolateHostAndHoldZfsSnapshot { triggered_mask: u16 },
}

/// Evaluates telemetry bitmask and constant-time WebAuthn RP ID SHA-256 binding.
#[inline]
pub fn evaluate_defense_action(
    ioc_mask: u16,
    expected_rpid_sha256: &[u8; 32],
    observed_rpid_sha256: &[u8; 32],
) -> DefenseAction {
    // Constant-time 32-byte digest comparison for FIDO2 rpIdHash verification
    let mut diff: u8 = 0;
    let mut i = 0;
    while i < 32 {
        diff |= expected_rpid_sha256[i] ^ observed_rpid_sha256[i];
        i += 1;
    }
    let rpid_mismatch = diff != 0;

    let critical_ransom_mask =
        IOC_VPN_ANOMALOUS_CHILD_PROC | IOC_DCSYNC_NON_DC_REPL | IOC_VSSADMIN_SHADOW_DELETE;

    if (ioc_mask & critical_ransom_mask) != 0 {
        return DefenseAction::IsolateHostAndHoldZfsSnapshot {
            triggered_mask: ioc_mask,
        };
    }
    if rpid_mismatch || (ioc_mask & (IOC_WEBAUTHN_RPID_MISMATCH | IOC_AITM_JA4_UA_MISMATCH)) != 0 {
        return DefenseAction::RevokeSessionAndAlertSoc;
    }
    if (ioc_mask & IOC_KERBEROS_RC4_TGS_SWEEP) != 0 {
        return DefenseAction::StepUpWebAuthnRequired;
    }
    DefenseAction::AllowNormal
}