Siber Güvenlikte Yapay Zeka Uygulamaları

import pandas as pd
import numpy as np
from sklearn.ensemble import IsolationForest, RandomForestClassifier
from sklearn.preprocessing import StandardScaler
import tensorflow as tf
from tensorflow.keras import layers

class NetworkAnomalyDetector:
    def __init__(self):
        self.scaler = StandardScaler()
        self.isolation_forest = None
        self.lstm_model = None
        self.baseline_statistics = {}

    def extract_network_features(self, packet_data):
        """
        Ağ paketlerinden özellik çıkarma
        """
        features = pd.DataFrame()

        # Temel paket özellikleri
        features['packet_size'] = packet_data['size']
        features['protocol'] = packet_data['protocol'].map({'TCP': 1, 'UDP': 2, 'ICMP': 3})
        features['src_port'] = packet_data['source_port']
        features['dst_port'] = packet_data['destination_port']

        # İstatistiksel özellikler (zaman penceresi: 60 saniye)
        features['packets_per_min'] = packet_data.groupby('source_ip')['timestamp'].transform('count')
        features['avg_packet_size'] = packet_data.groupby('source_ip')['size'].transform('mean')
        features['total_bytes'] = packet_data.groupby('source_ip')['size'].transform('sum')

        # Davranışsal özellikler
        features['unique_destinations'] = packet_data.groupby('source_ip')['destination_ip'].transform('nunique')
        features['port_scan_indicator'] = features['unique_destinations'] / (features['packets_per_min'] + 1)

        # Zaman bazlı özellikler
        packet_data['hour'] = pd.to_datetime(packet_data['timestamp']).dt.hour
        features['is_night_time'] = (packet_data['hour'] >= 22) | (packet_data['hour'] <= 6)

        # Protokol dağılımı
        features['tcp_ratio'] = (packet_data['protocol'] == 'TCP').astype(int)

        # Payload özellikleri
        features['has_payload'] = (packet_data['payload_size'] > 0).astype(int)
        features['payload_entropy'] = packet_data['payload'].apply(self._calculate_entropy)

        return features

    def _calculate_entropy(self, data):
        """
        Shannon entropy (randomness ölçümü - şifreli trafik tespiti için)
        """
        if len(data) == 0:
            return 0

        byte_counts = np.bincount(np.frombuffer(data.encode() if isinstance(data, str) else data, dtype=np.uint8))
        probabilities = byte_counts[byte_counts > 0] / len(data)
        entropy = -np.sum(probabilities * np.log2(probabilities))

        return entropy

    def train_isolation_forest(self, normal_traffic):
        """
        Unsupervised anomaly detection (normal trafik örnekleriyle)
        """
        features = self.extract_network_features(normal_traffic)
        features_scaled = self.scaler.fit_transform(features)

        # Isolation Forest
        self.isolation_forest = IsolationForest(
            contamination=0.01,  # %1 anomali beklentisi
            n_estimators=200,
            max_samples=1000,
            random_state=42
        )

        self.isolation_forest.fit(features_scaled)

        # Baseline istatistikler
        self.baseline_statistics = {
            'avg_packet_size': features['packet_size'].mean(),
            'avg_packets_per_min': features['packets_per_min'].mean(),
            'std_packet_size': features['packet_size'].std(),
            'max_unique_destinations': features['unique_destinations'].quantile(0.95)
        }

        return self

    def detect_anomalies(self, traffic_data):
        """
        Real-time anomali tespiti
        """
        features = self.extract_network_features(traffic_data)
        features_scaled = self.scaler.transform(features)

        # Isolation Forest skoru
        anomaly_scores = self.isolation_forest.decision_function(features_scaled)
        predictions = self.isolation_forest.predict(features_scaled)

        # Anomali detayları
        anomalies = []
        for idx, (score, pred) in enumerate(zip(anomaly_scores, predictions)):
            if pred == -1:  # Anomali
                anomaly_type = self._classify_anomaly_type(features.iloc[idx])

                anomalies.append({
                    'timestamp': traffic_data.iloc[idx]['timestamp'],
                    'source_ip': traffic_data.iloc[idx]['source_ip'],
                    'destination_ip': traffic_data.iloc[idx]['destination_ip'],
                    'anomaly_score': abs(score),
                    'anomaly_type': anomaly_type,
                    'severity': self._calculate_severity(abs(score), anomaly_type),
                    'features': features.iloc[idx].to_dict()
                })

        return anomalies

    def _classify_anomaly_type(self, features):
        """
        Anomali tipi sınıflandırma
        """
        # Port scanning
        if features['port_scan_indicator'] > 0.5:
            return 'Port Scanning'

        # DDoS pattern
        if features['packets_per_min'] > self.baseline_statistics['avg_packets_per_min'] * 10:
            return 'Potential DDoS'

        # Data exfiltration
        if features['total_bytes'] > self.baseline_statistics['avg_packet_size'] * 1000:
            return 'Data Exfiltration Attempt'

        # Unusual protocol usage
        if features['is_night_time'] and features['tcp_ratio'] < 0.2:
            return 'Unusual Protocol Pattern'

        # Encrypted malicious traffic
        if features['payload_entropy'] > 7.5:  # Yüksek entropy = şifreli/sıkıştırılmış
            return 'Suspicious Encrypted Traffic'

        return 'Unknown Anomaly'

    def _calculate_severity(self, score, anomaly_type):
        """
        Tehdit şiddeti hesaplama
        """
        base_severity = min(score * 10, 10)

        # Anomali tipine göre ağırlıklandırma
        severity_weights = {
            'Port Scanning': 0.6,
            'Potential DDoS': 0.9,
            'Data Exfiltration Attempt': 1.0,
            'Suspicious Encrypted Traffic': 0.8,
            'Unknown Anomaly': 0.5
        }

        weight = severity_weights.get(anomaly_type, 0.5)
        final_severity = base_severity * weight

        if final_severity >= 8:
            return 'CRITICAL'
        elif final_severity >= 6:
            return 'HIGH'
        elif final_severity >= 4:
            return 'MEDIUM'
        else:
            return 'LOW'

# LSTM ile Saldırı Tahmini
class AttackPredictor:
    def __init__(self, sequence_length=100):
        self.sequence_length = sequence_length
        self.model = self.build_lstm_model()

    def build_lstm_model(self):
        """
        Zaman serisi bazlı saldırı tahmini
        """
        model = tf.keras.Sequential([
            layers.LSTM(128, return_sequences=True, input_shape=(self.sequence_length, 10)),
            layers.Dropout(0.3),
            layers.LSTM(64, return_sequences=True),
            layers.Dropout(0.2),
            layers.LSTM(32),
            layers.Dense(16, activation='relu'),
            layers.Dense(5, activation='softmax')  # 5 saldırı tipi
        ])

        model.compile(
            optimizer='adam',
            loss='categorical_crossentropy',
            metrics=['accuracy', tf.keras.metrics.Precision(), tf.keras.metrics.Recall()]
        )

        return model

    def prepare_sequences(self, traffic_data):
        """
        LSTM için sequence hazırlama
        """
        # Feature extraction
        # ... (özellik çıkarma kodu)

        # Sequences oluştur
        X, y = [], []
        for i in range(self.sequence_length, len(features)):
            X.append(features[i-self.sequence_length:i])
            y.append(labels[i])

        return np.array(X), np.array(y)

    def predict_attack(self, recent_traffic):
        """
        Yakın gelecekte saldırı tahmini
        """
        sequence = self.prepare_sequences(recent_traffic)

        prediction = self.model.predict(sequence)
        attack_types = ['Normal', 'DDoS', 'Port Scan', 'Malware', 'Data Breach']

        predicted_class = attack_types[np.argmax(prediction)]
        confidence = np.max(prediction) * 100

        return {
            'predicted_attack': predicted_class,
            'confidence': confidence,
            'probabilities': {attack: prob * 100 for attack, prob in zip(attack_types, prediction[0])}
        }

# User Behavior Analytics (UBA)
class UserBehaviorAnalytics:
    def __init__(self):
        self.user_baselines = {}

    def build_user_baseline(self, user_id, historical_activities):
        """
        Kullanıcı normal davranış profili oluşturma
        """
        baseline = {
            'login_times': self._extract_login_patterns(historical_activities),
            'access_patterns': self._extract_access_patterns(historical_activities),
            'data_volume': self._extract_data_patterns(historical_activities),
            'device_fingerprints': historical_activities['devices'].unique().tolist(),
            'ip_addresses': historical_activities['ip'].unique().tolist()
        }

        self.user_baselines[user_id] = baseline
        return baseline

    def detect_insider_threat(self, user_id, current_activity):
        """
        İç tehdit (insider threat) tespiti
        """
        if user_id not in self.user_baselines:
            return {'risk_score': 0, 'reason': 'No baseline available'}

        baseline = self.user_baselines[user_id]
        risk_score = 0
        risk_factors = []

        # Olağandışı login zamanı
        current_hour = pd.to_datetime(current_activity['timestamp']).hour
        if current_hour not in baseline['login_times']:
            risk_score += 20
            risk_factors.append('Unusual login time')

        # Yeni device
        if current_activity['device'] not in baseline['device_fingerprints']:
            risk_score += 30
            risk_factors.append('Unknown device')

        # Olağandışı IP
        if current_activity['ip'] not in baseline['ip_addresses']:
            risk_score += 25
            risk_factors.append('Unusual IP address')

        # Aşırı veri erişimi
        if current_activity['data_accessed'] > baseline['data_volume']['avg'] * 5:
            risk_score += 35
            risk_factors.append('Excessive data access')

        # Hassas veri erişimi
        if 'confidential' in current_activity['files_accessed']:
            risk_score += 40
            risk_factors.append('Accessing sensitive data')

        risk_level = 'CRITICAL' if risk_score > 80 else 'HIGH' if risk_score > 50 else 'MEDIUM' if risk_score > 30 else 'LOW'

        return {
            'user_id': user_id,
            'risk_score': min(risk_score, 100),
            'risk_level': risk_level,
            'risk_factors': risk_factors,
            'recommended_action': self._recommend_action(risk_level)
        }

    def _recommend_action(self, risk_level):
        """
        Risk seviyesine göre aksiyon önerisi
        """
        actions = {
            'CRITICAL': 'Block user immediately & alert SOC team',
            'HIGH': 'Require MFA verification & monitor closely',
            'MEDIUM': 'Flag for review & increase monitoring',
            'LOW': 'Log event for audit'
        }

        return actions.get(risk_level, 'Monitor')

# Kullanım
detector = NetworkAnomalyDetector()

# Normal trafik ile eğit
detector.train_isolation_forest(normal_traffic_data)

# Gerçek zamanlı tespit
anomalies = detector.detect_anomalies(live_traffic)

for anomaly in anomalies:
    print(f"[{anomaly['severity']}] {anomaly['anomaly_type']}")
    print(f"Source: {anomaly['source_ip']} -> Dest: {anomaly['destination_ip']}")
    print(f"Score: {anomaly['anomaly_score']:.3f}")

import hashlib
import pefile
import numpy as np
from sklearn.ensemble import GradientBoostingClassifier
import tensorflow as tf

class MalwareDetector:
    def __init__(self):
        self.static_analyzer = None
        self.dynamic_analyzer = None
        self.deep_learning_model = None

    def analyze_file(self, file_path):
        """
        Dosya analizi ve malware tespiti
        """
        # Static analysis
        static_features = self._static_analysis(file_path)

        # Dynamic analysis (sandbox)
        # dynamic_features = self._dynamic_analysis(file_path)

        # ML prediction
        is_malware, confidence, malware_type = self._predict_malware(static_features)

        result = {
            'file': file_path,
            'is_malware': is_malware,
            'confidence': confidence,
            'malware_type': malware_type if is_malware else 'Benign',
            'threat_level': self._calculate_threat_level(confidence, malware_type),
            'static_features': static_features,
            'hash': {
                'md5': hashlib.md5(open(file_path, 'rb').read()).hexdigest(),
                'sha256': hashlib.sha256(open(file_path, 'rb').read()).hexdigest()
            }
        }

        return result

    def _static_analysis(self, file_path):
        """
        PE dosyası static analizi
        """
        try:
            pe = pefile.PE(file_path)

            features = {
                'size': pe.OPTIONAL_HEADER.SizeOfImage,
                'num_sections': len(pe.sections),
                'num_imports': len(pe.DIRECTORY_ENTRY_IMPORT) if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT') else 0,
                'entropy': self._calculate_file_entropy(file_path),
                'has_debug_info': hasattr(pe, 'DIRECTORY_ENTRY_DEBUG'),
                'is_dll': pe.is_dll(),
                'is_exe': pe.is_exe(),
                'suspicious_sections': self._detect_suspicious_sections(pe),
                'suspicious_imports': self._detect_suspicious_imports(pe),
                'code_to_data_ratio': self._calculate_code_data_ratio(pe),
                'timestamp_anomaly': self._check_timestamp_anomaly(pe)
            }

            return features

        except Exception as e:
            return {'error': str(e)}

    def _calculate_file_entropy(self, file_path):
        """
        Dosya entropy (packed/encrypted dosya tespiti)
        """
        with open(file_path, 'rb') as f:
            data = f.read()

        byte_counts = np.bincount(np.frombuffer(data, dtype=np.uint8))
        probabilities = byte_counts[byte_counts > 0] / len(data)
        entropy = -np.sum(probabilities * np.log2(probabilities))

        return entropy

    def _detect_suspicious_sections(self, pe):
        """
        Şüpheli section tespiti
        """
        suspicious_count = 0

        for section in pe.sections:
            section_name = section.Name.decode().strip('\x00')
            entropy = section.get_entropy()

            # Yüksek entropy = packed/encrypted
            if entropy > 7.0:
                suspicious_count += 1

            # Executable + writable section
            if (section.Characteristics & 0x20000000) and (section.Characteristics & 0x80000000):
                suspicious_count += 1

            # Olağandışı section isimleri
            suspicious_names = ['.text', '.data', '.rdata', '.rsrc']
            if section_name not in suspicious_names and section_name != '':
                suspicious_count += 1

        return suspicious_count

    def _detect_suspicious_imports(self, pe):
        """
        Şüpheli API import tespiti
        """
        if not hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):
            return 0

        suspicious_apis = [
            'VirtualAlloc', 'WriteProcessMemory', 'CreateRemoteThread',  # Process injection
            'SetWindowsHookEx', 'GetAsyncKeyState',  # Keylogger
            'URLDownloadToFile', 'InternetOpen',  # Network activity
            'RegSetValueEx', 'RegCreateKey',  # Registry manipulation
            'CreateToolhelp32Snapshot'  # Process enumeration
        ]

        suspicious_count = 0

        for entry in pe.DIRECTORY_ENTRY_IMPORT:
            for imp in entry.imports:
                if imp.name and imp.name.decode() in suspicious_apis:
                    suspicious_count += 1

        return suspicious_count

    def _predict_malware(self, features):
        """
        ML model ile malware tahmini
        """
        # Feature vector oluştur
        feature_vector = [
            features.get('size', 0),
            features.get('num_sections', 0),
            features.get('num_imports', 0),
            features.get('entropy', 0),
            features.get('suspicious_sections', 0),
            features.get('suspicious_imports', 0),
            features.get('code_to_data_ratio', 0)
        ]

        # Simplified prediction (gerçekte trained model kullanılır)
        entropy = features.get('entropy', 0)
        suspicious_score = features.get('suspicious_sections', 0) + features.get('suspicious_imports', 0)

        is_malware = entropy > 7.2 or suspicious_score > 5
        confidence = min((entropy / 8.0) * 0.5 + (suspicious_score / 10) * 0.5, 1.0) * 100

        # Malware tipi tahmini
        if features.get('suspicious_imports', 0) > 3:
            if 'VirtualAlloc' in str(features):
                malware_type = 'Trojan/Injector'
            elif 'GetAsyncKeyState' in str(features):
                malware_type = 'Keylogger'
            else:
                malware_type = 'Generic Malware'
        else:
            malware_type = 'Potentially Unwanted Program (PUP)'

        return is_malware, confidence, malware_type

    def _calculate_threat_level(self, confidence, malware_type):
        """
        Tehdit seviyesi
        """
        base_level = 'CRITICAL' if confidence > 90 else 'HIGH' if confidence > 70 else 'MEDIUM'

        if 'Ransomware' in malware_type:
            return 'CRITICAL'
        elif 'Trojan' in malware_type or 'Backdoor' in malware_type:
            return 'HIGH'
        else:
            return base_level

# Kullanım
detector = MalwareDetector()
result = detector.analyze_file('suspicious_file.exe')

if result['is_malware']:
    print(f"⚠️ MALWARE DETECTED!")
    print(f"Type: {result['malware_type']}")
    print(f"Confidence: {result['confidence']:.1f}%")
    print(f"Threat Level: {result['threat_level']}")

// Node.js - AI-Powered SOC Automation
const { OpenAI } = require('openai');

class SOARPlatform {
  constructor() {
    this.openai = new OpenAI({
      apiKey: process.env.OPENAI_API_KEY
    });

    this.playbooks = new Map();
  }

  async triageAlert(alert) {
    """
    Alert önceliklendirme ve zenginleştirme
    """
    // Threat intelligence enrichment
    const enrichedAlert = await this.enrichAlert(alert);

    // GPT-4 ile alert analizi
    const analysis = await this.analyzeWithAI(enrichedAlert);

    // Severity skorlama
    const severity = this.calculateSeverity(enrichedAlert, analysis);

    // Otomatik yanıt önerisi
    const responseAction = await this.recommendResponse(enrichedAlert, analysis);

    return {
      alertId: alert.id,
      severity,
      priority: this.calculatePriority(severity, alert.asset_criticality),
      analysis,
      enrichment: enrichedAlert.threat_intel,
      recommendedActions: responseAction,
      autoExecutable: responseAction.confidence > 0.9
    };
  }

  async enrichAlert(alert) {
    """
    Alert zenginleştirme (threat intel, geolocation, reputation)
    """
    const enrichment = {
      ...alert,
      threat_intel: {
        ip_reputation: await this.checkIPReputation(alert.source_ip),
        known_malware: await this.checkMalwareSignature(alert.file_hash),
        geolocation: await this.getGeolocation(alert.source_ip),
        domain_age: await this.checkDomainAge(alert.domain)
      },
      similar_incidents: await this.findSimilarIncidents(alert)
    };

    return enrichment;
  }

  async analyzeWithAI(alert) {
    """
    GPT-4 ile alert analizi
    """
    const prompt = `Security Alert Analizi:

Alert Detayları:
- Tip: ${alert.type}
- Kaynak IP: ${alert.source_ip}
- Hedef: ${alert.destination}
- Zaman: ${alert.timestamp}
- Kullanıcı: ${alert.user}

Zenginleştirilmiş Bilgi:
- IP Reputation: ${alert.threat_intel.ip_reputation.score}/100
- Malware Match: ${alert.threat_intel.known_malware}
- Lokasyon: ${alert.threat_intel.geolocation}

Benzer Geçmiş Olaylar: ${alert.similar_incidents.length} adet

Lütfen değerlendir:
1. Bu bir gerçek tehdit mi yoksa false positive mi?
2. Attack chain'in hangi aşamasında?
3. Potansiyel etki nedir?
4. Önerilen aksiyonlar neler?`;

    const response = await this.openai.chat.completions.create({
      model: 'gpt-4',
      messages: [
        {
          role: 'system',
          content: 'Sen deneyimli bir SOC analistsin. Alert triage ve incident response konusunda uzmansın.'
        },
        {
          role: 'user',
          content: prompt
        }
      ],
      temperature: 0.2
    });

    return response.choices[0].message.content;
  }

  calculateSeverity(alert, aiAnalysis) {
    """
    Multi-factor severity scoring
    """
    let score = 0;

    // IP reputation
    const ipScore = alert.threat_intel.ip_reputation.score;
    score += (100 - ipScore) * 0.3;

    // Asset criticality
    const assetWeight = {
      'critical': 30,
      'high': 20,
      'medium': 10,
      'low': 5
    };
    score += assetWeight[alert.asset_criticality] || 5;

    // Alert type
    const typeWeight = {
      'malware_detected': 30,
      'data_exfiltration': 35,
      'unauthorized_access': 25,
      'policy_violation': 10
    };
    score += typeWeight[alert.type] || 10;

    // AI confidence
    if (aiAnalysis.includes('true positive') || aiAnalysis.includes('genuine threat')) {
      score += 20;
    }

    // Normalize to 0-100
    score = Math.min(score, 100);

    if (score >= 80) return 'CRITICAL';
    if (score >= 60) return 'HIGH';
    if (score >= 40) return 'MEDIUM';
    return 'LOW';
  }

  async recommendResponse(alert, analysis) {
    """
    Otomatik yanıt aksiyonu önerisi
    """
    const actions = [];
    let confidence = 0;

    // Malware detected
    if (alert.type === 'malware_detected') {
      actions.push({
        action: 'isolate_endpoint',
        target: alert.host_name,
        reason: 'Malware containment'
      });
      confidence = 0.95;
    }

    // Suspicious IP
    if (alert.threat_intel.ip_reputation.score < 30) {
      actions.push({
        action: 'block_ip',
        target: alert.source_ip,
        duration: '24h',
        reason: 'Low reputation IP'
      });
      confidence = 0.85;
    }

    // Data exfiltration
    if (alert.type === 'data_exfiltration') {
      actions.push({
        action: 'block_user',
        target: alert.user,
        reason: 'Potential data breach'
      });
      actions.push({
        action: 'alert_dlp_team',
        priority: 'urgent'
      });
      confidence = 0.80;
    }

    return {
      actions,
      confidence,
      requiresApproval: confidence < 0.9
    };
  }

  async executePlaybook(playbookName, alert) {
    """
    Automated incident response playbook
    """
    const playbook = this.playbooks.get(playbookName);

    if (!playbook) {
      throw new Error(`Playbook not found: ${playbookName}`);
    }

    const results = [];

    for (const step of playbook.steps) {
      const result = await this.executeStep(step, alert);
      results.push(result);

      // Hata durumunda durdur
      if (!result.success && step.critical) {
        break;
      }
    }

    return {
      playbookName,
      executedSteps: results.length,
      totalSteps: playbook.steps.length,
      success: results.every(r => r.success),
      results
    };
  }

  async executeStep(step, alert) {
    """
    Playbook step execution
    """
    console.log(`Executing: ${step.action}`);

    switch (step.action) {
      case 'isolate_endpoint':
        return await this.isolateEndpoint(alert.host_name);

      case 'block_ip':
        return await this.blockIPAddress(alert.source_ip, step.duration);

      case 'collect_forensics':
        return await this.collectForensicData(alert.host_name);

      case 'notify_team':
        return await this.sendNotification(step.recipients, alert);

      default:
        return { success: false, error: 'Unknown action' };
    }
  }

  registerPlaybook(name, steps) {
    """
    Custom playbook oluşturma
    """
    this.playbooks.set(name, {
      name,
      steps,
      createdAt: new Date()
    });
  }
}

// Kullanım
const soar = new SOARPlatform();

// Playbook tanımla
soar.registerPlaybook('Malware Response', [
  { action: 'isolate_endpoint', critical: true },
  { action: 'collect_forensics', critical: false },
  { action: 'block_ip', duration: '24h', critical: false },
  { action: 'notify_team', recipients: ['soc@company.com'], critical: true }
]);

// Alert işle
const alert = {
  id: 'AL-2024-001',
  type: 'malware_detected',
  source_ip: '192.168.1.100',
  host_name: 'DESKTOP-USER01',
  file_hash: 'abc123...',
  asset_criticality: 'high'
};

const triage = await soar.triageAlert(alert);

if (triage.autoExecutable) {
  // Otomatik yanıt
  await soar.executePlaybook('Malware Response', alert);
} else {
  // Manuel onay bekle
  console.log('Approval required for:', triage.recommendedActions);
}

module.exports = SOARPlatform;