なぜ高価なEDRを導入しても「英語のアラートが毎日鳴り続けて放置」されるのか？
小規模現場に合う自動隔離と中小企業セキュリティ相談・継続伴走支援

#![forbid(unsafe_code)]

/// Computes Shannon entropy H(X) in bits per byte [0.0, 8.0] for a write buffer.
pub fn compute_shannon_entropy(buf: &[u8]) -> f64 {
    if buf.is_empty() {
        return 0.0;
    }
    let mut counts = [0u32; 256];
    for &b in buf {
        counts[usize::from(b)] += 1;
    }
    let len = buf.len() as f64;
    let mut entropy = 0.0_f64;
    for &c in &counts {
        if c > 0 {
            let p = (c as f64) / len;
            entropy -= p * p.log2();
        }
    }
    entropy
}

/// Computes Bayesian posterior probability P(Attack | Alert) given base rate, TPR, and FPR.
#[inline]
pub fn bayesian_attack_posterior(prior_base_rate: f64, tpr: f64, fpr: f64) -> f64 {
    let p_a = prior_base_rate.clamp(0.0, 1.0);
    let true_pos = tpr * p_a;
    let false_pos = fpr * (1.0 - p_a);
    let denom = true_pos + false_pos;
    if denom <= f64::EPSILON {
        0.0
    } else {
        true_pos / denom
    }
}

#[derive(Debug, Clone)]
pub struct ProcessIoSample {
    pub pid: u32,
    pub touched_canary_decoy: bool,
    pub attempted_shadow_copy_delete: bool,
    pub rapid_overwrite_count: u32,
    pub write_buffer_sample: Vec<u8>,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum ContainmentDecision {
    AllowNormalOperation,
    SuppressLowConfidenceNoise,
    FreezeProcessAndIsolateHost { pid: u32 },
}

/// Deterministic zero-fatigue ransomware containment policy for small-business endpoints.
pub fn evaluate_process_io(sample: &ProcessIoSample) -> ContainmentDecision {
    // 1. Immediate deterministic freeze if Canary decoy is modified or VSS shadow copy deletion attempted
    if sample.touched_canary_decoy || sample.attempted_shadow_copy_delete {
        return ContainmentDecision::FreezeProcessAndIsolateHost { pid: sample.pid };
    }

    // 2. Evaluate write buffer entropy for mass encryption behavior (H(X) > 7.92 bits/byte)
    let entropy = compute_shannon_entropy(&sample.write_buffer_sample);
    if entropy > 7.92 && sample.rapid_overwrite_count >= 5 {
        return ContainmentDecision::FreezeProcessAndIsolateHost { pid: sample.pid };
    }

    // 3. Avoid spamming human operators with low-confidence heuristic noise
    if sample.rapid_overwrite_count > 0 && entropy < 6.80 {
        return ContainmentDecision::SuppressLowConfidenceNoise;
    }

    ContainmentDecision::AllowNormalOperation
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn verifies_base_rate_fallacy_and_canary_freeze() {
        // With 10^-6 prior and 0.1% FPR, raw alert precision is under 0.1%
        let noisy_posterior = bayesian_attack_posterior(1e-6, 0.99, 1e-3);
        assert!(noisy_posterior < 0.001);

        // Canary trigger achieves near-zero FPR (10^-9) -> >99.9% precision
        let high_signal_posterior = bayesian_attack_posterior(1e-6, 0.999, 1e-9);
        assert!(high_signal_posterior > 0.998);

        let sample = ProcessIoSample {
            pid: 4820,
            touched_canary_decoy: true,
            attempted_shadow_copy_delete: false,
            rapid_overwrite_count: 1,
            write_buffer_sample: vec![0xAA; 64],
        };
        assert_eq!(
            evaluate_process_io(&sample),
            ContainmentDecision::FreezeProcessAndIsolateHost { pid: 4820 }
        );
    }
}