IDSRuleEngine.cpp

// ============================================================
// Project 5: Intrusion Detection Rule Engine (Snort-like)
// OOP: Rule, Event, Engine, RuleSet classes
// DSA: Pattern matching, Hash Maps, Priority Queue, vectors
// Domain: Cybersecurity
// ============================================================

#include <iostream>
#include <string>
#include <vector>
#include <map>
#include <unordered_map>
#include <queue>
#include <algorithm>
#include <iomanip>
#include <sstream>
#include <ctime>
using namespace std;

// ---------- Severity Levels ----------
enum class Severity { LOW = 1, MEDIUM = 2, HIGH = 3, CRITICAL = 4 };

string severityStr(Severity s) {
    switch(s) {
        case Severity::LOW:      return "LOW";
        case Severity::MEDIUM:   return "MEDIUM";
        case Severity::HIGH:     return "HIGH";
        case Severity::CRITICAL: return "CRITICAL";
    }
    return "";
}

string severityColor(Severity s) {
    switch(s) {
        case Severity::LOW:      return "[LOW]     ";
        case Severity::MEDIUM:   return "[MEDIUM]  ";
        case Severity::HIGH:     return "[HIGH]    ";
        case Severity::CRITICAL: return "[CRITICAL]";
    }
    return "";
}

// ---------- Network Event ----------
struct NetworkEvent {
    int id;
    string srcIP;
    string dstIP;
    int srcPort;
    int dstPort;
    string protocol;
    string payload;
    int packetSize;
    int ttl;
    string timestamp;
    string httpMethod;
    string httpPath;
    int responseCode;

    NetworkEvent(int id, string src, string dst, int sp, int dp,
                 string proto, string pl, int sz = 500, int ttl = 64)
        : id(id), srcIP(src), dstIP(dst), srcPort(sp), dstPort(dp),
          protocol(proto), payload(pl), packetSize(sz), ttl(ttl),
          responseCode(0) {
        time_t t = time(nullptr);
        char buf[20];
        strftime(buf, sizeof(buf), "%H:%M:%S", localtime(&t));
        timestamp = buf;
    }

    void print() const {
        cout << "  Event #" << id << ": " << srcIP << ":" << srcPort
             << " -> " << dstIP << ":" << dstPort
             << " [" << protocol << "] "
             << "payload=" << (payload.length() > 30 ? payload.substr(0,30)+"..." : payload)
             << "\n";
    }
};

// ---------- Detection Alert ----------
struct Alert {
    int severity;
    string ruleName;
    string category;
    string message;
    int eventId;
    string srcIP;

    bool operator<(const Alert& other) const {
        return severity < other.severity;
    }
};

// ---------- Base Rule ----------
class Rule {
protected:
    string name;
    string category;
    Severity severity;
    string description;
    int matchCount = 0;

public:
    Rule(string n, string cat, Severity sev, string desc)
        : name(n), category(cat), severity(sev), description(desc) {}

    virtual bool matches(const NetworkEvent& e) const = 0;
    virtual ~Rule() {}

    string getName() const { return name; }
    string getCategory() const { return category; }
    Severity getSeverity() const { return severity; }
    string getDescription() const { return description; }
    int getMatchCount() const { return matchCount; }
    void incrementMatch() { matchCount++; }
};

// ---------- Signature-Based Rules ----------

// Keyword match in payload
class PayloadRule : public Rule {
    vector<string> keywords;
public:
    PayloadRule(string n, string cat, Severity sev, string desc, vector<string> kw)
        : Rule(n, cat, sev, desc), keywords(kw) {}

    bool matches(const NetworkEvent& e) const override {
        string pl = e.payload;
        transform(pl.begin(), pl.end(), pl.begin(), ::tolower);
        for (auto& kw : keywords) {
            string k = kw;
            transform(k.begin(), k.end(), k.begin(), ::tolower);
            if (pl.find(k) != string::npos) return true;
        }
        return false;
    }
};

// Specific port monitoring
class PortRule : public Rule {
    vector<int> ports;
    bool srcOrDst; // true=dst, false=src
public:
    PortRule(string n, string cat, Severity sev, string desc, vector<int> p, bool dst=true)
        : Rule(n, cat, sev, desc), ports(p), srcOrDst(dst) {}

    bool matches(const NetworkEvent& e) const override {
        int port = srcOrDst ? e.dstPort : e.srcPort;
        return find(ports.begin(), ports.end(), port) != ports.end();
    }
};

// IP Blacklist
class BlacklistRule : public Rule {
    vector<string> blacklist;
public:
    BlacklistRule(string n, string desc, vector<string> ips)
        : Rule(n, "BLACKLIST", Severity::CRITICAL, desc), blacklist(ips) {}

    bool matches(const NetworkEvent& e) const override {
        return find(blacklist.begin(), blacklist.end(), e.srcIP) != blacklist.end();
    }
};

// Packet size anomaly
class PacketSizeRule : public Rule {
    int minSize, maxSize;
public:
    PacketSizeRule(string n, string desc, int mn, int mx)
        : Rule(n, "ANOMALY", Severity::MEDIUM, desc), minSize(mn), maxSize(mx) {}

    bool matches(const NetworkEvent& e) const override {
        return e.packetSize < minSize || e.packetSize > maxSize;
    }
};

// Protocol anomaly
class ProtocolRule : public Rule {
    string expectedProto;
    int monitoredPort;
public:
    ProtocolRule(string n, string desc, string proto, int port)
        : Rule(n, "ANOMALY", Severity::HIGH, desc),
          expectedProto(proto), monitoredPort(port) {}

    bool matches(const NetworkEvent& e) const override {
        return e.dstPort == monitoredPort && e.protocol != expectedProto;
    }
};

// ---------- Rate-Based Rule (stateful) ----------
class RateRule : public Rule {
    unordered_map<string, int>& counter;
    int threshold;
public:
    RateRule(string n, string cat, Severity sev, string desc,
             unordered_map<string, int>& cnt, int thresh)
        : Rule(n, cat, sev, desc), counter(cnt), threshold(thresh) {}

    bool matches(const NetworkEvent& e) const override {
        return counter[e.srcIP] > threshold;
    }
};

// ---------- Rule Engine ----------
class IDSEngine {
private:
    vector<Rule*> rules;
    priority_queue<Alert> alertQueue;
    unordered_map<string, int> connectionCount;
    unordered_map<string, int> portScanCount;
    map<string, int> alertsByCategory;
    int totalEvents = 0;
    int flaggedEvents = 0;

    string getTimestamp() {
        time_t t = time(nullptr);
        char buf[20];
        strftime(buf, sizeof(buf), "%H:%M:%S", localtime(&t));
        return buf;
    }

public:
    IDSEngine() {
        // SQL Injection detection
        rules.push_back(new PayloadRule(
            "SQL_INJECTION", "WEB_ATTACK", Severity::CRITICAL,
            "SQL Injection attempt detected",
            {"' OR '1'='1", "UNION SELECT", "DROP TABLE", "'; --", "1=1", "xp_cmdshell", "EXEC("}
        ));

        // XSS detection
        rules.push_back(new PayloadRule(
            "XSS_ATTACK", "WEB_ATTACK", Severity::HIGH,
            "Cross-Site Scripting (XSS) attempt",
            {"<script>", "javascript:", "onerror=", "onload=", "alert(", "document.cookie"}
        ));

        // Command injection
        rules.push_back(new PayloadRule(
            "CMD_INJECTION", "WEB_ATTACK", Severity::CRITICAL,
            "Command injection attempt",
            {"; rm -rf", "| cat /etc/passwd", "&& wget", "$(curl", "`whoami`", "../../../etc"}
        ));

        // Malware signatures
        rules.push_back(new PayloadRule(
            "MALWARE_SIG", "MALWARE", Severity::CRITICAL,
            "Known malware signature detected",
            {"X5O!P%@AP[4\\PZX54(P^)7CC)7}", "EICAR", "eval(base64_decode", "powershell -enc"}
        ));

        // Suspicious admin ports
        rules.push_back(new PortRule(
            "ADMIN_PORT_ACCESS", "POLICY", Severity::MEDIUM,
            "Access to privileged admin port",
            {22, 23, 3389, 5900, 5985}, true
        ));

        // Database ports
        rules.push_back(new PortRule(
            "DB_PORT_EXPOSED", "POLICY", Severity::HIGH,
            "Direct database port access from external",
            {3306, 5432, 1433, 27017, 6379}, true
        ));

        // Known malicious IPs
        rules.push_back(new BlacklistRule(
            "BLACKLISTED_IP", "Known malicious IP address",
            {"45.33.32.156", "198.51.100.99", "203.0.113.42", "10.0.99.99"}
        ));

        // Packet size anomaly
        rules.push_back(new PacketSizeRule(
            "OVERSIZED_PACKET", "Packet size exceeds normal bounds", 0, 1500
        ));

        // Wrong protocol on port (e.g. UDP on port 80)
        rules.push_back(new ProtocolRule(
            "PROTO_ANOMALY_HTTP", "Non-TCP traffic on HTTP port", "TCP", 80
        ));

        // Brute force (rate-based)
        rules.push_back(new RateRule(
            "BRUTE_FORCE", "AUTH_ATTACK", Severity::HIGH,
            "Possible brute force attack (high connection rate)",
            connectionCount, 5
        ));
    }

    ~IDSEngine() {
        for (auto r : rules) delete r;
    }

    void processEvent(NetworkEvent& e) {
        totalEvents++;
        connectionCount[e.srcIP]++;
        bool wasFlagged = false;

        for (auto* rule : rules) {
            if (rule->matches(e)) {
                rule->incrementMatch();
                alertsByCategory[rule->getCategory()]++;
                int sev = (int)rule->getSeverity();
                alertQueue.push({sev, rule->getName(), rule->getCategory(),
                    rule->getDescription(), e.id, e.srcIP});

                if (!wasFlagged) {
                    flaggedEvents++;
                    wasFlagged = true;
                }

                cout << "  " << severityColor(rule->getSeverity())
                     << " " << setw(20) << rule->getName()
                     << " | " << e.srcIP << ":" << e.srcPort
                     << " -> " << e.dstIP << ":" << e.dstPort << "\n";
            }
        }
        if (!wasFlagged) {
            cout << "  [CLEAN]    " << "                     "
                 << " | " << e.srcIP << " -> " << e.dstIP
                 << ":" << e.dstPort << "\n";
        }
    }

    void printAlerts() {
        cout << "\n========================================\n";
        cout << "         ALERT QUEUE (by severity)\n";
        cout << "========================================\n";

        priority_queue<Alert> copy = alertQueue;
        while (!copy.empty()) {
            Alert a = copy.top(); copy.pop();
            Severity s = (Severity)a.severity;
            cout << "  " << severityColor(s)
                 << " " << setw(20) << a.ruleName
                 << " | Event #" << a.eventId
                 << " | " << a.srcIP
                 << "\n    >> " << a.message << "\n";
        }
    }

    void printStats() {
        cout << "\n========================================\n";
        cout << "           ENGINE STATISTICS\n";
        cout << "========================================\n";
        cout << "  Total Events Processed : " << totalEvents << "\n";
        cout << "  Flagged Events         : " << flaggedEvents << "\n";
        cout << "  Alert Rate             : "
             << fixed << setprecision(1)
             << (totalEvents ? (double)flaggedEvents/totalEvents*100 : 0.0) << "%\n";

        cout << "\n  Alerts by Category:\n";
        for (auto& p : alertsByCategory)
            cout << "    " << setw(15) << p.first << " : " << p.second << " alerts\n";

        cout << "\n  Top Offending IPs:\n";
        vector<pair<string,int>> sorted(connectionCount.begin(), connectionCount.end());
        sort(sorted.begin(), sorted.end(), [](auto& a, auto& b){ return a.second > b.second; });
        for (int i = 0; i < min(5, (int)sorted.size()); i++)
            cout << "    " << setw(16) << sorted[i].first << " : " << sorted[i].second << " events\n";

        cout << "\n  Rule Hit Counts:\n";
        for (auto* r : rules)
            if (r->getMatchCount() > 0)
                cout << "    " << setw(25) << r->getName()
                     << " : " << r->getMatchCount() << " matches\n";
    }
};

// ---------- Main ----------
int main() {
    cout << "========================================\n";
    cout << "   Intrusion Detection Rule Engine\n";
    cout << "========================================\n\n";

    IDSEngine engine;

    cout << "[*] Processing network events...\n\n";
    cout << string(75, '-') << "\n";
    cout << "  Status      " << "  Rule                 "
         << "  | Connection Details\n";
    cout << string(75, '-') << "\n";

    // Normal traffic
    NetworkEvent e1(1, "192.168.1.10", "192.168.1.1", 54321, 80, "TCP",
                    "GET /index.html HTTP/1.1 Host: example.com");
    engine.processEvent(e1);

    // SQL Injection attempt
    NetworkEvent e2(2, "203.0.113.7", "192.168.1.50", 9876, 80, "TCP",
                    "GET /login?user=admin' OR '1'='1&pass=x HTTP/1.1");
    engine.processEvent(e2);

    // XSS attempt
    NetworkEvent e3(3, "172.16.0.99", "192.168.1.50", 43210, 80, "TCP",
                    "POST /comment body=<script>alert(document.cookie)</script>");
    engine.processEvent(e3);

    // Command injection
    NetworkEvent e4(4, "198.51.100.99", "192.168.1.50", 11111, 80, "TCP",
                    "GET /ping?host=127.0.0.1; rm -rf / --no-preserve-root");
    engine.processEvent(e4);

    // Blacklisted IP
    NetworkEvent e5(5, "45.33.32.156", "192.168.1.1", 54322, 443, "TCP",
                    "GET /admin HTTP/1.1");
    engine.processEvent(e5);

    // SSH brute force
    for (int i = 6; i <= 12; i++) {
        NetworkEvent e(i, "10.0.99.99", "192.168.1.1", 50000+i, 22, "TCP",
                       "SSH auth attempt " + to_string(i));
        engine.processEvent(e);
    }

    // Malware signature
    NetworkEvent e13(13, "192.168.1.77", "10.10.10.10", 6666, 4444, "TCP",
                     "X5O!P%@AP[4\\PZX54(P^)7CC)7} EICAR test");
    engine.processEvent(e13);

    // DB port access
    NetworkEvent e14(14, "203.0.113.10", "192.168.1.20", 9000, 3306, "TCP",
                     "mysql connect root");
    engine.processEvent(e14);

    // Protocol anomaly (UDP on port 80)
    NetworkEvent e15(15, "172.16.0.5", "192.168.1.1", 12345, 80, "UDP",
                     "suspicious udp payload");
    engine.processEvent(e15);

    // Oversized packet
    NetworkEvent e16(16, "192.168.1.88", "8.8.8.8", 54400, 53, "UDP",
                     "large dns query", 2000);
    engine.processEvent(e16);

    // Normal HTTPS
    NetworkEvent e17(17, "192.168.1.5", "93.184.216.34", 49152, 443, "TCP",
                     "TLS ClientHello");
    engine.processEvent(e17);

    engine.printAlerts();
    engine.printStats();

    return 0;
}