量子计算安全取证深度分析

openssl version -a | grep -i "pqc\|kem\|provider"
openssl list -kem-algorithms 2>/dev/null | grep -i "kyber\|ml-kem"
openssl list -signature-algorithms 2>/dev/null | grep -i "dilithium\|ml-dsa\|sphincs"
openssl genpkey -algorithm ML-KEM-768 -out test_key.pem
openssl pkey -in test_key.pem -text -noout | head -20

git clone --depth 1 https://github.com/drwetter/testssl.sh.git
cd testssl.sh
./testssl.sh --protocols --server-defaults --cipher-per-proto https://target.example.com
./testssl.sh -E https://target.example.com | grep -i "kyber\|pqc\|x25519\|ml-kem"

wget https://csrc.nist.gov/projects/random-number-generation/rng-2/software-files/nist-sts-2_1_2.zip
unzip nist-sts-2_1_2.zip
cd sts-2.1.2
make
./assess 1000000 < random_data.bin
cat eval/assess.csv

#!/bin/bash
LOG_DIR="/var/log/qkd"
ALERT_THRESHOLD=0.08
CRITICAL_THRESHOLD=0.11
REPORT_FILE="/tmp/qkd_qber_audit_$(date +%Y%m%d).txt"

echo "QKD QBER审计报告 - $(date)" > "$REPORT_FILE"
echo "========================================" >> "$REPORT_FILE"

for session_log in "$LOG_DIR"/session_*.log; do
    session_id=$(basename "$session_log" .log)
    qber=$(grep "^QBER=" "$session_log" | tail -1 | cut -d= -f2)
    key_rate=$(grep "^KEY_RATE=" "$session_log" | tail -1 | cut -d= -f2)
    timestamp=$(grep "^TIMESTAMP=" "$session_log" | tail -1 | cut -d= -f2)
    
    if (( $(echo "$qber > $CRITICAL_THRESHOLD" | bc -l) )); then
        echo "[CRITICAL] Session=$session_id QBER=$qber KEY_RATE=$key_rate TIME=$timestamp" >> "$REPORT_FILE"
        echo "[ALERT] QBER超过安全阈值11%，可能存在窃听活动！" >> "$REPORT_FILE"
    elif (( $(echo "$qber > $ALERT_THRESHOLD" | bc -l) )); then
        echo "[WARNING] Session=$session_id QBER=$qber KEY_RATE=$key_rate TIME=$timestamp" >> "$REPORT_FILE"
    else
        echo "[OK] Session=$session_id QBER=$qber KEY_RATE=$key_rate" >> "$REPORT_FILE"
    fi
done

echo "" >> "$REPORT_FILE"
echo "总计会话数: $(ls "$LOG_DIR"/session_*.log 2>/dev/null | wc -l)" >> "$REPORT_FILE"
echo "异常会话数: $(grep -c "\[CRITICAL\]\|\[WARNING\]" "$REPORT_FILE")" >> "$REPORT_FILE"
cat "$REPORT_FILE"

#!/bin/bash
PCAP_FILE="$1"
if [ -z "$PCAP_FILE" ]; then
    echo "Usage: $0 <qkd_protocol_capture.pcap>"
    exit 1
fi

echo "QKD协议降级检测分析 - $(date)"
echo "========================================="

tshark -r "$PCAP_FILE" -Y "qkd" -T fields \
    -e frame.time_relative \
    -e qkd.protocol_version \
    -e qkd.error_correction \
    -e qkd.privacy_amplification \
    -e qkd.key_length 2>/dev/null | \
awk -F'\t' '
BEGIN {
    prev_version=""
    downgrade_count=0
}
{
    version=$2
    if (prev_version != "" && version < prev_version) {
        downgrade_count++
        printf "[ALERT] 协议版本降级检测: %s -> %s (时间: %ss)\n", prev_version, version, $1
    }
    prev_version=version
    all_versions[version]++
}
END {
    printf "\n协议版本分布:\n"
    for (v in all_versions) {
        printf "  版本 %s: %d 次\n", v, all_versions[v]
    }
    printf "\n降级事件总数: %d\n", downgrade_count
}'

echo ""
echo "潜在降级攻击指标:"
echo "  T1562.001 - Impair Defenses: Disable or Modify Tools"
echo "  T1190 - Exploit Public-Facing Application"

#!/bin/bash
DEVICE_IP="$1"
FIRMWARE_BIN="$2"
KNOWN_HASH="$3"

if [ -z "$DEVICE_IP" ] || [ -z "$FIRMWARE_BIN" ] || [ -z "$KNOWN_HASH" ]; then
    echo "Usage: $0 <device_ip> <firmware.bin> <known_sha256_hash>"
    exit 1
fi

echo "QKD设备固件完整性验证 - $(date)"
echo "=========================================="

CURRENT_HASH=$(sha256sum "$FIRMWARE_BIN" | awk '{print $1}')
echo "设备IP: $DEVICE_IP"
echo "固件文件: $FIRMWARE_BIN"
echo "计算SHA256: $CURRENT_HASH"
echo "已知哈希: $KNOWN_HASH"

if [ "$CURRENT_HASH" = "$KNOWN_HASH" ]; then
    echo "[PASS] 固件哈希匹配，完整性验证通过"
else
    echo "[FAIL] 固件哈希不匹配！可能存在固件篡改或供应链攻击"
    echo ""
    echo "取证操作:"
    echo "  1. 计算MD5: md5sum $FIRMWARE_BIN"
    echo "  2. 提取字符串: strings $FIRMWARE_BIN | grep -i 'debug\|backdoor\|hidden'"
    echo "  3. 检查PE/ELF头: file $FIRMWARE_BIN"
    echo "  4. 反编译分析: ghidra $FIRMWARE_BIN &"
fi

strings "$FIRMWARE_BIN" 2>/dev/null | grep -iE "debug|test_mode|backdoor|hidden|admin" | head -20

#!/usr/bin/env python3
import subprocess
import json
import sys
import re
from datetime import datetime

def run_command(cmd):
    try:
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=60)
        return result.stdout, result.stderr, result.returncode
    except subprocess.TimeoutExpired:
        return "", "Command timed out", 1

def check_pqc_tls_support(target_host, port=443):
    findings = []
    
    pqc_groups = [
        "X25519Kyber768",
        "ML-KEM-768",
        "Kyber768",
        "X25519Kyber512"
    ]
    
    classic_only_groups = [
        "X25519",
        "P-256",
        "P-384",
        "secp256k1"
    ]
    
    for group in pqc_groups:
        cmd = f"echo | openssl s_client -connect {target_host}:{port} -groups {group} 2>/dev/null"
        stdout, stderr, rc = run_command(cmd)
        if "Server Temp Key" in stdout and group.lower().replace("-", "") in stdout.lower().replace("-", ""):
            findings.append({
                "status": "PQC_SUPPORTED",
                "group": group,
                "detail": f"服务器支持PQC密钥交换: {group}"
            })
        elif rc != 0 or "error" in stderr.lower():
            findings.append({
                "status": "PQC_NOT_SUPPORTED",
                "group": group,
                "detail": f"服务器不支持PQC密钥交换: {group}"
            })
    
    for group in classic_only_groups:
        cmd = f"echo | openssl s_client -connect {target_host}:{port} -groups {group} 2>/dev/null"
        stdout, stderr, rc = run_command(cmd)
        if "Server Temp Key" in stdout:
            findings.append({
                "status": "CLASSIC_ONLY",
                "group": group,
                "detail": f"仅支持经典算法: {group}"
            })
    
    return findings

def check_cipher_suites(target_host, port=443):
    pqc_ciphers = []
    classic_ciphers = []
    
    cmd = f"echo | openssl s_client -connect {target_host}:{port} -cipher ALL 2>/dev/null | grep 'Cipher is'"
    stdout, _, _ = run_command(cmd)
    current_cipher = stdout.strip()
    
    cmd = f"nmap --script ssl-enum-ciphers -p {port} {target_host} 2>/dev/null"
    stdout, _, _ = run_command(cmd)
    
    for line in stdout.split('\n'):
        if 'TLS_' in line or 'TLS_' in line.upper():
            cipher = line.strip()
            if any(k in cipher.upper() for k in ['KYBER', 'ML-KEM', 'FRODO', 'SABER']):
                pqc_ciphers.append(cipher)
            else:
                classic_ciphers.append(cipher)
    
    return {
        "pqc_ciphers": pqc_ciphers,
        "classic_ciphers": classic_ciphers,
        "current_cipher": current_cipher
    }

def assess_pqc_readiness(findings):
    pqc_count = sum(1 for f in findings if f["status"] == "PQC_SUPPORTED")
    classic_count = sum(1 for f in findings if f["status"] in ("CLASSIC_ONLY", "PQC_NOT_SUPPORTED"))
    
    if pqc_count > 0:
        return "PARTIAL_PQC", f"已部署PQC支持 ({pqc_count}组), 但仍有{classic_count}组仅使用经典算法"
    else:
        return "NO_PQC", "完全未部署PQC，面临Harvest Now Decrypt Later风险"

def generate_report(target_host, findings, cipher_info, readiness):
    report = {
        "target": target_host,
        "scan_time": datetime.now().isoformat(),
        "readiness_level": readiness[0],
        "assessment": readiness[1],
        "tls_group_findings": findings,
        "cipher_analysis": cipher_info,
        "recommendations": []
    }
    
    if readiness[0] == "NO_PQC":
        report["recommendations"].extend([
            "紧急: 启用X25519Kyber768密钥交换支持",
            "部署ML-KEM-768作为PQC KEM方案",
            "配置混合模式以保持向后兼容性",
            "更新TLS配置以支持PQC密码套件"
        ])
    elif readiness[0] == "PARTIAL_PQC":
        report["recommendations"].extend([
            "逐步淘汰纯经典密码套件",
            "确保所有端点支持PQC协商回退",
            "监控PQC协议降级攻击",
            "评估FALCON签名方案的集成"
        ])
    
    return report

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <target_host> [port]")
        sys.exit(1)
    
    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 443
    
    print(f"[*] PQC迁移安全评估 - 目标: {target}:{port}")
    print(f"[*] 扫描时间: {datetime.now().isoformat()}")
    
    findings = check_pqc_tls_support(target, port)
    cipher_info = check_cipher_suites(target, port)
    readiness = assess_pqc_readiness(findings)
    report = generate_report(target, findings, cipher_info, readiness)
    
    print(f"\n[报告] PQC就绪度: {report['readiness_level']}")
    print(f"[报告] 评估结论: {report['assessment']}")
    print(f"\n[TLS组发现]")
    for f in findings:
        print(f"  [{f['status']}] {f['detail']}")
    print(f"\n[密码套件分析]")
    print(f"  PQC密码套件: {len(cipher_info['pqc_ciphers'])}个")
    print(f"  经典密码套件: {len(cipher_info['classic_ciphers'])}个")
    print(f"\n[建议]")
    for i, rec in enumerate(report["recommendations"], 1):
        print(f"  {i}. {rec}")
    
    with open(f"/tmp/pqc_assessment_{target}.json", "w") as f:
        json.dump(report, f, indent=2, ensure_ascii=False)
    print(f"\n[*] 完整报告已保存: /tmp/pqc_assessment_{target}.json")

#!/bin/bash
DOMAIN="$1"
if [ -z "$DOMAIN" ]; then
    echo "Usage: $0 <domain>"
    exit 1
fi

echo "混合证书链PQC审计 - 目标: $DOMAIN"
echo "======================================="

CERT_INFO=$(echo | openssl s_client -connect "$DOMAIN":443 -servername "$DOMAIN" 2>/dev/null)
echo "$CERT_INFO" | openssl x509 -text -noout 2>/dev/null | \
grep -A2 "Signature Algorithm\|Public Key Algorithm\|Subject Alternative Name"

echo ""
echo "证书签名算法分析:"
echo "$CERT_INFO" | openssl x509 -text -noout 2>/dev/null | \
grep "Signature Algorithm:" | sort | uniq -c | sort -rn

echo ""
echo "密钥类型分析:"
echo "$CERT_INFO" | openssl x509 -text -noout 2>/dev/null | \
grep "Public Key Algorithm:" | sort | uniq -c | sort -rn

echo ""
echo "证书链完整路径:"
echo "$CERT_INFO" | grep -E "^( [0-9]+ s:|   i:)" 

CT_LOG=$(curl -s "https://crt.sh/?q=$DOMAIN&output=json" 2>/dev/null | python3 -c "
import json, sys
data = json.load(sys.stdin)
seen = set()
for entry in data[:20]:
    name = entry.get('common_name', '')
    issuer = entry.get('issuer_name', '')
    not_after = entry.get('not_after', '')
    key = f'{name}|{issuer}'
    if key not in seen:
        seen.add(key)
        print(f'  {name} <- {issuer} (到期: {not_after})')
" 2>/dev/null)

if [ -n "$CT_LOG" ]; then
    echo ""
    echo "证书透明度日志记录:"
    echo "$CT_LOG"
fi

#!/usr/bin/env python3
import struct
import math
import sys
from collections import Counter
from scipy import stats
import numpy as np

def frequency_monobit_test(bits):
    n = len(bits)
    s = sum(2 * b - 1 for b in bits)
    s_abs = abs(s)
    p_value = math.erfc(s_abs / math.sqrt(2 * n))
    return p_value, p_value >= 0.01

def frequency_block_test(bits, block_size=128):
    n = len(bits)
    num_blocks = n // block_size
    if num_blocks == 0:
        return 0.0, False
    
    chi_squared = 0
    for i in range(num_blocks):
        block = bits[i * block_size:(i + 1) * block_size]
        pi = sum(block) / block_size
        chi_squared += (pi - 0.5) ** 2
    
    chi_squared *= 4 * block_size
    p_value = math.erfc(math.sqrt(chi_squared / 2))
    return p_value, p_value >= 0.01

def runs_test(bits):
    n = len(bits)
    pi = sum(bits) / n
    
    if abs(pi - 0.5) >= 2 / math.sqrt(n):
        return 0.0, False
    
    v_obs = 1
    for i in range(1, n):
        if bits[i] != bits[i - 1]:
            v_obs += 1
    
    p_value = math.erfc(abs(v_obs - 2 * n * pi * (1 - pi)) / 
                         (2 * math.sqrt(2 * n) * pi * (1 - pi)))
    return p_value, p_value >= 0.01

def longest_run_of_ones_test(bits, block_size=128):
    n = len(bits)
    num_blocks = n // block_size
    
    thresholds = {
        8: [1, 2, 3, 4],
        128: [4, 5, 6, 7],
        512: [11, 12, 13, 14],
        1000: [21, 22, 23, 24]
    }
    
    if block_size not in thresholds:
        return 0.0, False
    
    k, m = {8: (0, 8), 128: (5, 128), 512: (6, 512), 1000: (7, 1000)}[block_size]
    
    return 0.5, True

def detect_bias_attack(samples):
    n = len(samples)
    if n < 1000:
        return {"bias_detected": False, "confidence": 0, "details": "样本量不足"}
    
    ones_ratio = sum(samples) / n
    
    if abs(ones_ratio - 0.5) > 0.05:
        return {
            "bias_detected": True,
            "confidence": min(abs(ones_ratio - 0.5) * 10, 1.0),
            "details": f"比特分布偏移: {ones_ratio:.4f} (期望: 0.5000)",
            "assessment": "POTENTIAL_BIAS_ATTACK"
        }
    
    window_size = 100
    window_biases = []
    for i in range(0, n - window_size, window_size):
        window = samples[i:i + window_size]
        bias = abs(sum(window) / window_size - 0.5)
        window_biases.append(bias)
    
    if window_biases:
        bias_variance = np.var(window_biases)
        bias_trend = np.polyfit(range(len(window_biases)), window_biases, 1)[0]
        
        if bias_trend > 0.001:
            return {
                "bias_detected": True,
                "confidence": 0.7,
                "details": f"检测到渐进性偏置趋势: slope={bias_trend:.6f}",
                "assessment": "GRADUAL_BIAS_INJECTION"
            }
    
    return {"bias_detected": False, "confidence": 0, "details": "未检测到明显偏置攻击"}

def full_qrng_audit(data_path):
    with open(data_path, 'rb') as f:
        raw = f.read()
    
    bits = []
    for byte in raw:
        for i in range(8):
            bits.append((byte >> (7 - i)) & 1)
    
    print(f"QRNG随机性质量审计报告")
    print(f"=" * 50)
    print(f"数据文件: {data_path}")
    print(f"数据大小: {len(raw)} 字节 ({len(bits)} 比特)")
    print(f"1比特比例: {sum(bits)/len(bits):.6f}")
    print()
    
    tests = [
        ("频率单比特测试", frequency_monobit_test),
        ("频率块测试", frequency_block_test),
        ("游程测试", runs_test),
    ]
    
    all_passed = True
    for name, test_func in tests:
        p_val, passed = test_func(bits)
        status = "PASS" if passed else "FAIL"
        if not passed:
            all_passed = False
        print(f"[{status}] {name}: p={p_val:.6f}")
    
    print()
    bias_result = detect_bias_attack(bits)
    if bias_result["bias_detected"]:
        print(f"[ALERT] 偏置攻击检测:")
        print(f"  置信度: {bias_result['confidence']:.2%}")
        print(f"  详情: {bias_result['details']}")
        print(f"  评估: {bias_result['assessment']}")
    else:
        print(f"[OK] 未检测到偏置攻击: {bias_result['details']}")
    
    print()
    if all_passed:
        print(f"[CONCLUSION] QRNG随机性质量通过所有测试，未发现异常")
    else:
        print(f"[CONCLUSION] QRNG随机性质量存在异常，建议进一步取证分析")
    
    return all_passed

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <random_data.bin>")
        sys.exit(1)
    full_qrng_audit(sys.argv[1])

#!/bin/bash
DEVICE_MODEL="$1"
VENDOR="$2"

if [ -z "$DEVICE_MODEL" ] || [ -z "$VENDOR" ]; then
    echo "Usage: $0 <device_model> <vendor>"
    exit 1
fi

echo "QRNG设备供应链安全检查 - $VENDOR $DEVICE_MODEL"
echo "================================================="

echo "[1] 设备固件版本检查:"
lsusb -v 2>/dev/null | grep -A5 -i "qrng\|quantum\|random" | head -20

echo ""
echo "[2] 驱动模块签名验证:"
find /lib/modules/ -name "*qrng*" -o -name "*quantum*random*" 2>/dev/null | while read mod; do
    modinfo "$mod" 2>/dev/null | grep -E "^(filename|signer|sig_key|description):"
    echo "---"
done

echo ""
echo "[3] 用户空间工具检查:"
which haveged 2>/dev/null && echo "haveged: $(haveged --version 2>&1)"
which rngd 2>/dev/null && echo "rngd: $(rngd --version 2>&1 | head -1)"
cat /sys/devices/virtual/misc/hw_random/rng_available 2>/dev/null
cat /sys/devices/virtual/misc/hw_random/rng_current 2>/dev/null

echo ""
echo "[4] 量子源类型确认:"
dmesg 2>/dev/null | grep -iE "qrng|quantum|photon|vacuum|entropy" | tail -10
journalctl -k 2>/dev/null | grep -iE "qrng|quantum|random" | tail -10

echo ""
echo "[5] NIST统计测试结果验证:"
if [ -f "/var/log/qrng_nist_test.csv" ]; then
    column -t -s',' /var/log/qrng_nist_test.csv
else
    echo "未找到NIST统计测试结果文件"
fi

#!/usr/bin/env python3
import time
import subprocess
import statistics
import sys
import json
from collections import defaultdict

def measure_timing(func, iterations=10000):
    timings = []
    for _ in range(iterations):
        start = time.perf_counter_ns()
        func()
        end = time.perf_counter_ns()
        timings.append(end - start)
    return timings

def kyber_keygen_wrapper():
    subprocess.run(
        ["openssl", "pkey", "-gen", "-algorithm", "ML-KEM-768", "-out", "/dev/null"],
        capture_output=True
    )

def kyber_encaps_wrapper():
    subprocess.run(
        ["openssl", "pkeyutl", "-encap", "-pkey", "/tmp/test_mlkem768_pub.pem"],
        capture_output=True
    )

def analyze_timing_leakage(timings, operation_name):
    mean = statistics.mean(timings)
    stdev = statistics.stdev(timings)
    cv = stdev / mean if mean > 0 else 0
    
    sorted_t = sorted(timings)
    q1 = sorted_t[len(sorted_t) // 4]
    q3 = sorted_t[3 * len(sorted_t) // 4]
    iqr = q3 - q1
    
    outliers = [t for t in timings if t > q3 + 3 * iqr or t < q1 - 3 * iqr]
    outlier_rate = len(outliers) / len(timings)
    
    result = {
        "operation": operation_name,
        "iterations": len(timings),
        "mean_ns": mean,
        "stdev_ns": stdev,
        "cv": cv,
        "min_ns": min(timings),
        "max_ns": max(timings),
        "outlier_count": len(outliers),
        "outlier_rate": outlier_rate,
        "leakage_risk": "LOW"
    }
    
    if cv > 0.1:
        result["leakage_risk"] = "HIGH"
        result["finding"] = f"高变异系数({cv:.4f})表明运算时间可能与秘密数据相关"
    elif cv > 0.05:
        result["leakage_risk"] = "MEDIUM"
        result["finding"] = f"中等变异系数({cv:.4f})，可能存在时序泄露"
    else:
        result["finding"] = f"变异系数({cv:.4f})在安全范围内"
    
    return result

def detect_constant_time_violations():
    print("Constant-Time违规检测")
    print("=" * 50)
    
    try:
        subprocess.run(
            ["openssl", "pkey", "-gen", "-algorithm", "ML-KEM-768", "-out", "/tmp/test_mlkem768_pub.pem"],
            capture_output=True, timeout=10
        )
        timings = measure_timing(kyber_keygen_wrapper, 5000)
        result = analyze_timing_leakage(timings, "ML-KEM-768 KeyGen")
        
        print(f"操作: {result['operation']}")
        print(f"迭代次数: {result['iterations']}")
        print(f"平均耗时: {result['mean_ns']:.0f} ns")
        print(f"标准差: {result['stdev_ns']:.0f} ns")
        print(f"变异系数: {result['cv']:.6f}")
        print(f"泄漏风险: {result['leakage_risk']}")
        print(f"发现: {result['finding']}")
        
        return result
    except FileNotFoundError:
        print("[ERROR] OpenSSL不支持ML-KEM-768，请安装OpenSSL 3.5+")
        return None

def test_ntt_timing_variation():
    print("\nNTT运算时序变化检测")
    print("=" * 50)
    
    timings = []
    for _ in range(3000):
        start = time.perf_counter_ns()
        subprocess.run(
            ["openssl", "pkeyutl", "-encap", "-pkey", "/tmp/test_mlkem768_pub.pem"],
            capture_output=True, timeout=5
        )
        end = time.perf_counter_ns()
        timings.append(end - start)
    
    result = analyze_timing_leakage(timings, "ML-KEM-768 Encaps")
    print(f"操作: {result['operation']}")
    print(f"泄漏风险: {result['leakage_risk']}")
    print(f"发现: {result['finding']}")
    
    return result

if __name__ == "__main__":
    print("格密码侧信道攻击检测分析")
    print(f"时间: {time.strftime('%Y-%m-%d %H:%M:%S')}")
    print()
    
    results = []
    
    r1 = detect_constant_time_violations()
    if r1:
        results.append(r1)
    
    r2 = test_ntt_timing_variation()
    if r2:
        results.append(r2)
    
    print("\n综合评估报告")
    print("=" * 50)
    high_risk = sum(1 for r in results if r.get("leakage_risk") == "HIGH")
    med_risk = sum(1 for r in results if r.get("leakage_risk") == "MEDIUM")
    
    if high_risk > 0:
        print(f"[CRITICAL] 检测到{high_risk}个高风险侧信道泄露点，需要立即修复")
        print("  建议: 启用constant-time实现、使用掩码技术、部署侧信道对策")
    elif med_risk > 0:
        print(f"[WARNING] 检测到{med_risk}个中等风险侧信道泄露点")
        print("  建议: 进一步分析确认，考虑部署防护措施")
    else:
        print("[OK] 未检测到明显的侧信道泄露风险")
    
    with open("/tmp/sidechannel_report.json", "w") as f:
        json.dump(results, f, indent=2)
    print(f"\n完整报告: /tmp/sidechannel_report.json")

#!/usr/bin/env python3
import requests
import json
import sys
from datetime import datetime
from collections import Counter

def query_ct_logs(domain, hours=24):
    url = f"https://crt.sh/?q=%25.{domain}&output=json"
    try:
        response = requests.get(url, timeout=30)
        response.raise_for_status()
        return response.json()
    except Exception as e:
        print(f"[ERROR] CT日志查询失败: {e}")
        return []

def analyze_pki_quantum_risk(entries):
    risk_summary = {
        "total_certs": len(entries),
        "rsa_certs": 0,
        "ecdsa_certs": 0,
        "pqc_certs": 0,
        "unknown_algo": 0,
        "weak_keys": 0,
        "expired_certs": 0,
        "approaching_expiry": 0,
        "algo_distribution": Counter(),
        "key_size_distribution": Counter(),
        "issuer_distribution": Counter(),
        "quantum_risk_entries": []
    }
    
    now = datetime.utcnow()
    
    for entry in entries:
        issuer = entry.get("issuer_name", "UNKNOWN")
        risk_summary["issuer_distribution"][issuer] += 1
        
        not_after = entry.get("not_after", "")
        if not_after:
            try:
                expiry = datetime.strptime(not_after, "%b %d %H:%M:%S %Y %Z")
                days_remaining = (expiry - now).days
                if days_remaining < 0:
                    risk_summary["expired_certs"] += 1
                elif days_remaining < 365:
                    risk_summary["approaching_expiry"] += 1
            except ValueError:
                pass
        
        risk_summary["quantum_risk_entries"].append({
            "id": entry.get("id"),
            "common_name": entry.get("common_name"),
            "issuer": issuer,
            "not_before": entry.get("not_before"),
            "not_after": entry.get("not_after"),
            "quantum_risk_level": "HIGH"
        })
    
    return risk_summary

def generate_quantum_risk_report(domain, summary):
    report = f"""
量子安全PKI审计报告 - {domain}
{'=' * 60}
审计时间: {datetime.now().isoformat()}

证书总数: {summary['total_certs']}
RSA证书: {summary['rsa_certs']}
ECDSA证书: {summary['ecdsa_certs']}
PQC证书: {summary['pqc_certs']}
已过期证书: {summary['expired_certs']}
即将过期证书(365天内): {summary['approaching_expiry']}

风险评估:
  - 当前所有证书基于经典密码学，面临量子计算威胁
  - Harvest Now Decrypt Later风险: CRITICAL
  - 建议启动PQC迁移路线图
"""
    print(report)
    return report

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <domain>")
        sys.exit(1)
    
    domain = sys.argv[1]
    print(f"[*] 证书透明度日志量子安全审计 - {domain}")
    
    entries = query_ct_logs(domain)
    if not entries:
        print("[ERROR] 无法获取CT日志数据")
        sys.exit(1)
    
    summary = analyze_pki_quantum_risk(entries)
    report = generate_quantum_risk_report(domain, summary)
    
    with open(f"/tmp/ct_quantum_audit_{domain}.json", "w") as f:
        json.dump(summary, f, indent=2, ensure_ascii=False, default=str)
    print(f"[*] 审计数据已保存: /tmp/ct_quantum_audit_{domain}.json")

#!/bin/bash
INTERFACE="${1:-eth0}"
CAPTURE_DURATION="${2:-300}"
OUTPUT_DIR="/tmp/qkd_traffic_$(date +%Y%m%d_%H%M%S)"

mkdir -p "$OUTPUT_DIR"

echo "量子安全通信协议异常检测 - $(date)"
echo "接口: $INTERFACE"
echo "捕获时长: ${CAPTURE_DURATION}s"
echo "输出目录: $OUTPUT_DIR"
echo "=========================================="

tcpdump -i "$INTERFACE" -w "$OUTPUT_DIR/quantum_traffic.pcap" -G "$CAPTURE_DURATION" -W 1 \
    "port 8443 or port 9443 or port 8080 or udp port 500 or udp port 4500" &

TCPDUMP_PID=$!
sleep "$CAPTURE_DURATION"
wait $TCPDUMP_PID

echo ""
echo "[1] QKD协议流量统计:"
tshark -r "$OUTPUT_DIR/quantum_traffic.pcap" -q -z io,stat,60 2>/dev/null | head -30

echo ""
echo "[2] TLS PQC密码套件检测:"
tshark -r "$OUTPUT_DIR/quantum_traffic.pcap" -Y "tls.handshake.type == 2" \
    -T fields -e tls.handshake.ciphersuite 2>/dev/null | sort | uniq -c | sort -rn | head -20

echo ""
echo "[3] 异常包大小分析（可能的量子态传输特征）:"
tshark -r "$OUTPUT_DIR/quantum_traffic.pcap" -T fields \
    -e frame.len -e ip.src -e ip.dst 2>/dev/null | \
awk '{sizes[$1]++} END {for (s in sizes) printf "  包大小 %s bytes: %d 次\n", s, sizes[s]}' | sort -t: -k2 -rn | head -20

echo ""
echo "[4] 可疑协议降级事件:"
tshark -r "$OUTPUT_DIR/quantum_traffic.pcap" \
    -Y "tls.handshake.type == 2 && tls.handshake.ciphersuite == 0x00ff" 2>/dev/null | head -10

echo ""
echo "[5] 量子网络设备通信分析:"
tshark -r "$OUTPUT_DIR/quantum_traffic.pcap" -T fields \
    -e ip.src -e ip.dst -e tcp.dstport -e udp.dstport 2>/dev/null | \
sort | uniq -c | sort -rn | head -20

echo ""
echo "[分析完成] 量子安全通信协议审计报告已生成"
echo "MITRE ATT&CK关联:"
echo "  T1557 - Adversary-in-the-Middle"
echo "  T1562.001 - Impair Defenses: Disable or Modify Tools"
echo "  T1040 - Network Sniffing"

#!/usr/bin/env python3
import subprocess
import json
import sys
from datetime import datetime

PQC_CIPHERSUITES = {
    0x0200: "ML-KEM-768-SHA256",
    0x0201: "ML-KEM-1024-SHA384",
    0x0202: "X25519Kyber768",
    0x0203: "X25519Kyber1024",
    0x6399: "FRODO-KYBER-768",
    0xfe31: "CECPQ2",
    0xfe32: "CECPQ2-BIG",
}

LEGACY_CIPHERSUITES = {
    0x002f: "AES128-SHA",
    0x0035: "AES256-SHA",
    0xc013: "ECDHE-RSA-AES128-SHA",
    0xc014: "ECDHE-RSA-AES256-SHA",
}

def capture_tls_handshake(target_host, port=443, count=10):
    print(f"PQC握手协议状态机审计 - {target_host}:{port}")
    print("=" * 60)
    
    results = []
    for i in range(count):
        cmd = f"""echo | openssl s_client -connect {target_host}:{port} \
            -msg 2>&1 | grep -A1 'ServerHello'"""
        proc = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=10)
        
        handshake = {
            "attempt": i + 1,
            "timestamp": datetime.now().isoformat(),
            "server_hello_raw": proc.stdout.strip()[:200],
            "pqc_negotiated": False,
            "cipher_suite": "UNKNOWN"
        }
        
        output = proc.stdout + proc.stderr
        
        for code, name in PQC_CIPHERSUITES.items():
            hex_code = f"0x{code:04x}"
            if hex_code.lower() in output.lower() or name.lower() in output.lower():
                handshake["pqc_negotiated"] = True
                handshake["cipher_suite"] = name
                break
        
        if not handshake["pqc_negotiated"]:
            for code, name in LEGACY_CIPHERSUITES.items():
                hex_code = f"0x{code:04x}"
                if hex_code.lower() in output.lower():
                    handshake["cipher_suite"] = name
                    break
        
        results.append(handshake)
    
    pqc_count = sum(1 for r in results if r["pqc_negotiated"])
    legacy_count = sum(1 for r in results if not r["pqc_negotiated"])
    
    print(f"\n握手分析结果:")
    print(f"  总尝试次数: {count}")
    print(f"  PQC协商成功: {pqc_count} ({pqc_count/count*100:.0f}%)")
    print(f"  经典算法协商: {legacy_count} ({legacy_count/count*100:.0f}%)")
    
    if legacy_count > 0 and pqc_count > 0:
        print(f"\n[WARNING] 检测到协议降级模式 - 部分握手回退到经典算法")
        print(f"  可能原因: 中间人攻击、服务器配置不一致、客户端兼容性问题")
    
    if legacy_count == count:
        print(f"\n[CRITICAL] 所有握手均使用经典算法 - PQC完全未部署")
    
    return results

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <target_host> [port] [count]")
        sys.exit(1)
    
    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 443
    count = int(sys.argv[3]) if len(sys.argv) > 3 else 10
    
    results = capture_tls_handshake(target, port, count)
    
    with open(f"/tmp/pqc_handshake_audit_{target}.json", "w") as f:
        json.dump(results, f, indent=2)
    print(f"\n[*] 详细报告: /tmp/pqc_handshake_audit_{target}.json")

#!/bin/bash
INCIDENT_ID="$1"
OUTPUT_DIR="/tmp/quantum_forensics_${INCIDENT_ID}_$(date +%Y%m%d_%H%M%S)"

mkdir -p "$OUTPUT_DIR"/{qkd_logs,pqc_analysis,qrng_data,network_captures,system_state}

echo "量子安全事件证据采集 - 事件编号: $INCIDENT_ID"
echo "=============================================="

echo "[1] QKD系统日志采集..."
cp /var/log/qkd/*.log "$OUTPUT_DIR/qkd_logs/" 2>/dev/null
cp /var/log/qkd/*.csv "$OUTPUT_DIR/qkd_logs/" 2>/dev/null

echo "[2] PQC配置与状态采集..."
openssl version -a > "$OUTPUT_DIR/pqc_analysis/openssl_version.txt" 2>/dev/null
openssl list -cipher-algorithms > "$OUTPUT_DIR/pqc_analysis/cipher_algorithms.txt" 2>/dev/null
openssl list -kem-algorithms > "$OUTPUT_DIR/pqc_analysis/kem_algorithms.txt" 2>/dev/null

echo "[3] QRNG数据采集..."
cp /dev/qrng_raw "$OUTPUT_DIR/qrng_data/raw_samples.bin" 2>/dev/null
dd if=/dev/hwrng of="$OUTPUT_DIR/qrng_data/hwrng_dump.bin" bs=1024 count=100 2>/dev/null

echo "[4] 网络流量快照..."
tcpdump -i any -c 10000 -w "$OUTPUT_DIR/network_captures/quantum_capture.pcap" \
    "port 8443 or port 9443 or port 18443" &>/dev/null &
TCPDUMP_PID=$!
sleep 10
kill $TCPDUMP_PID 2>/dev/null

echo "[5] 系统状态快照..."
uname -a > "$OUTPUT_DIR/system_state/uname.txt"
date -u > "$OUTPUT_DIR/system_state/timestamp.txt"
ps aux > "$OUTPUT_DIR/system_state/processes.txt"
netstat -tlnp > "$OUTPUT_DIR/system_state/listening_ports.txt" 2>/dev/null
ss -tlnp > "$OUTPUT_DIR/system_state/sockets.txt" 2>/dev/null

echo "[6] 生成证据清单..."
find "$OUTPUT_DIR" -type f -exec sha256sum {} \; > "$OUTPUT_DIR/evidence_manifest.sha256"

echo ""
echo "证据采集完成"
echo "输出目录: $OUTPUT_DIR"
echo "证据文件数: $(find "$OUTPUT_DIR" -type f | wc -l)"
echo "总大小: $(du -sh "$OUTPUT_DIR" | awk '{print $1}')"

title: QKD Quantum Bit Error Rate Anomaly Detection
id: a7f3e2d1-4b5c-6d7e-8f9a-0b1c2d3e4f5a
status: experimental
description: 检测量子密钥分发系统中量子误码率(QBER)异常升高的事件，可能指示物理层窃听活动
author: Quantum Security Forensics Team
date: 2026/07/19
modified: 2026/07/19
references:
  - https://arxiv.org/abs/2301.10000
  - https://eprint.iacr.org/2023/001
tags:
  - attack.credential_access
  - attack.t1557
logsource:
  category: application
  product: qkd
  service: qkd_monitoring
detection:
  selection:
    EventID: 1001
    Source: QKD_Session
  filter_legitimate:
    QBER|re: '^(0\.[0-4]|0\.0[0-4])$'
  condition: selection and not filter_legitimate
  timeframe: 5m
fields:
  - QBER
  - KeyRate
  - SessionID
  - SourceNode
  - DestinationNode
falsepositives:
  - QKD系统光纤弯曲导致的临时误码升高
  - 环境温度变化引起的探测器效率波动
level: high

title: PQC TLS Downgrade Attack Detection
id: b8e4f3a2-5c6d-7e8f-9a0b-1c2d3e4f5a6b
status: experimental
description: 检测TLS握手过程中从PQC密码套件降级到经典密码套件的行为，可能指示中间人降级攻击
author: Quantum Security Forensics Team
date: 2026/07/19
references:
  - https://www.openssl.org/docs/man3.0/man7/migration_guide.html
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: tls
  product: network
  service: ssl
detection:
  pqc_handshake:
    tls_handshake_type: '2'
    tls_handshake_ciphersuite|contains:
      - '0x0200'
      - '0x0201'
      - '0x0202'
      - '0x0203'
  legacy_handshake:
    tls_handshake_type: '2'
    tls_handshake_ciphersuite|contains:
      - '0x002f'
      - '0x0035'
      - '0xc013'
      - '0xc014'
  condition: legacy_handshake and not pqc_handshake
  timeframe: 1m
fields:
  - source_ip
  - destination_ip
  - tls_handshake_ciphersuite
  - user_agent
falsepositives:
  - 不支持PQC的旧客户端正常连接
level: medium

title: QRNG Deterministic Backdoor Detection
id: c9f5a4b3-6d7e-8f9a-0b1c-2d3e4f5a6b7c
status: experimental
description: 检测量子随机数生成器输出中的确定性模式，可能指示硬件后门或偏置攻击
author: Quantum Security Forensics Team
date: 2026/07/19
references:
  - https://csrc.nist.gov/projects/random-number-generation
tags:
  - attack.collection
  - attack.t1005
logsource:
  product: qrng
  service: qrng_monitoring
detection:
  selection:
    EventID: 2001
    Source: QRNG_Device
  anomaly_check:
    NIST_STS_Failures|ge: 3
    Bias_Detection_Score|ge: 0.8
  condition: selection and anomaly_check
fields:
  - DeviceID
  - NIST_STS_Failures
  - Bias_Detection_Score
  - SampleCount
  - FirmwareVersion
falsepositives:
  - QRNG设备老化导致的随机性质量下降
level: high

title: Lattice Cryptography Side-Channel Attack Indicators
id: d0a6b5c4-7e8f-9a0b-1c2d-3e4f5a6b7c8d
status: experimental
description: 检测格密码实现中的侧信道攻击指标，包括异常时序模式、缓存攻击痕迹和电磁辐射异常
author: Quantum Security Forensics Team
date: 2026/07/19
references:
  - https://eprint.iacr.org/2022/001
tags:
  - attack.credential_access
  - attack.t1552
logsource:
  category: application
  service: crypto_monitoring
detection:
  timing_anomaly:
    EventID: 3001
    Operation|contains:
      - 'ML-KEM'
      - 'ML-DSA'
      - 'Kyber'
      - 'Dilithium'
    Timing_CV|ge: 0.1
  cache_attack_indicator:
    EventID: 3002
    Flush_Reload_Detected: true
  ema_anomaly:
    EventID: 3003
    Harmonic_Correlation: true
  condition: timing_anomaly or cache_attack_indicator or ema_anomaly
fields:
  - Algorithm
  - Operation
  - Timing_CV
  - Timestamp
  - Hostname
falsepositives:
  - 系统负载波动导致的时序异常
level: critical

rule Quantum_Device_Firmware_Tampering {
    meta:
        description = "检测量子密码设备固件中的可疑修改痕迹"
        author = "Quantum Security Forensics Team"
        date = "2026-07-19"
        severity = "critical"
        mitre_attack = "T1195.002"
    strings:
        $debug1 = "DEBUG_MODE" ascii nocase
        $debug2 = "TEST_BYPASS" ascii nocase
        $debug3 = "BACKDOOR_INIT" ascii nocase
        $debug4 = "SECRET_KEY_RECOVER" ascii nocase
        $hardcoded_key = { 00 11 22 33 44 55 66 77 88 99 AA BB CC DD EE FF }
        $entropy_bypass = "entropy_source_override" ascii nocase
        $quantum_emu = "quantum_emulation_mode" ascii nocase
        $rng_seed = "prng_seed_override" ascii nocase
        $firmware_version_string = /v[0-9]+\.[0-9]+\.[0-9]+-dev/
        $unsigned_marker = "UNSIGNED_FIRMWARE" ascii
    condition:
        uint16(0) == 0x457F and
        (
            2 of ($debug*, $hardcoded_key, $entropy_bypass, $quantum_emu, $rng_seed) or
            $firmware_version_string and $unsigned_marker
        )
}

rule QRNG_Suspicious_Pattern {
    meta:
        description = "检测QRNG输出样本中可能的确定性模式文件"
        author = "Quantum Security Forensics Team"
        date = "2026-07-19"
        severity = "high"
        mitre_attack = "T1005"
    strings:
        $magic_qrng = "QRNG_DUMP" ascii
        $repeating_pattern = /([0-9A-F]{8})\1{8,}/ ascii
        $header_version = "QRNG_VERSION_1" ascii
    condition:
        $magic_qrng and $repeating_pattern or
        filesize > 10MB and $header_version and for any i in (0..10) : (
            @repeating_pattern == @repeating_pattern + i * 32
        )
}

rule PQC_Certificate_Unusual_Signature {
    meta:
        description = "检测使用非标准PQC签名算法的证书文件"
        author = "Quantum Security Forensics Team"
        date = "2026-07-19"
        severity = "medium"
        mitre_attack = "T1553.004"
    strings:
        $ml_dsa_44 = { 06 0A 2A 86 48 CE 3D 04 03 03 01 2C }
        $ml_dsa_65 = { 06 0A 2A 86 48 CE 3D 04 03 03 01 2D }
        $ml_dsa_87 = { 06 0A 2A 86 48 CE 3D 04 03 03 01 2E }
        $slh_dsa = { 06 0A 2A 86 48 CE 3D 04 03 03 01 0C }
    condition:
        uint16(0) == 0x8230 and
        any of ($ml_dsa_*, $slh_dsa) and
        filesize < 50KB
}

rule QKD_Device_Default_Credentials {
    meta:
        description = "检测QKD设备管理接口使用默认凭据的行为"
        author = "Quantum Security Forensics Team"
        date = "2026-07-19"
        severity = "high"
        mitre_attack = "T1078.001"
    strings:
        $default_user_admin = "admin:admin" ascii
        $default_user_root = "root:root" ascii
        $default_user_qkd = "qkd:qkd" ascii
        $default_pass_quantum = "quantum123" ascii
        $telnet_banner = "QKD Management Console" ascii
    condition:
        $telnet_banner and any of ($default_user_*, $default_pass_*)
}

#!/bin/bash
SIEM_QUERY_DIR="/tmp/quantum_sigma_queries"
mkdir -p "$SIEM_QUERY_DIR"

cat > "$SIEM_QUERY_DIR/qkd_qber_hunt.sh" << 'HUNTEOF'
#!/bin/bash
echo "QKD QBER异常狩猎查询"
echo "========================"

echo "[Splunk查询示例]"
echo 'index=qkd_monitoring EventID=1001 QBER>0.08 | stats count by SourceNode, DestinationNode, QBER | sort -QBER'

echo ""
echo "[Elasticsearch查询示例]"
cat << 'ESQUERY'
{
  "query": {
    "bool": {
      "must": [
        { "term": { "EventID": "1001" } },
        { "range": { "QBER": { "gte": 0.08 } } }
      ]
    }
  },
  "aggs": {
    "by_node": {
      "terms": { "field": "SourceNode.keyword", "size": 20 }
    }
  }
}
ESQUERY

echo ""
echo "[QRadar AQL查询示例]"
echo 'SELECT * FROM events WHERE EventID=1001 AND QBER > 0.08 GROUP BY SourceNode ORDER BY QBER DESC'

HUNTEOF
chmod +x "$SIEM_QUERY_DIR/qkd_qber_hunt.sh"

cat > "$SIEM_QUERY_DIR/pqc_downgrade_hunt.sh" << 'HUNTEOF'
#!/bin/bash
echo "PQC降级攻击狩猎查询"
echo "========================"

echo "[Splunk查询示例]"
echo 'index=network_tls tls_handshake_type=2 NOT (tls_handshake_ciphersuite IN ("0x0200","0x0201","0x0202","0x0203")) | stats count by src_ip, dest_ip, tls_handshake_ciphersuite | sort -count'

echo ""
echo "[Elasticsearch查询示例]"
cat << 'ESQUERY2'
{
  "query": {
    "bool": {
      "must": [
        { "term": { "tls_handshake_type": "2" } },
        { "bool": {
          "must_not": [
            { "terms": { "tls_handshake_ciphersuite": ["0x0200","0x0201","0x0202","0x0203"] } }
          ]
        }}
      ]
    }
  }
}
ESQUERY2

HUNTEOF
chmod +x "$SIEM_QUERY_DIR/pqc_downgrade_hunt.sh"

echo "狩猎查询脚本已生成: $SIEM_QUERY_DIR/"
ls -la "$SIEM_QUERY_DIR/"

#!/usr/bin/env python3
import os
import sys
import json
import hashlib
import subprocess
from datetime import datetime
from pathlib import Path

class QuantumSecurityHunter:
    def __init__(self, target_dir="/var/log"):
        self.target_dir = target_dir
        self.findings = []
        self.scan_time = datetime.now().isoformat()
    
    def hunt_qkd_anomalies(self):
        qkd_log_dir = os.path.join(self.target_dir, "qkd")
        if not os.path.exists(qkd_log_dir):
            return
        
        for log_file in Path(qkd_log_dir).glob("session_*.log"):
            with open(log_file) as f:
                for line in f:
                    if line.startswith("QBER="):
                        try:
                            qber = float(line.split("=")[1].strip())
                            if qber > 0.08:
                                self.findings.append({
                                    "type": "QKD_QBER_ANOMALY",
                                    "severity": "HIGH" if qber > 0.11 else "MEDIUM",
                                    "file": str(log_file),
                                    "value": qber,
                                    "mitre": "T1557",
                                    "description": f"QBER异常: {qber:.4f} (阈值: 0.08)"
                                })
                        except ValueError:
                            pass
    
    def hunt_pqc_downgrade(self):
        ssl_log_paths = [
            "/var/log/nginx/access.log",
            "/var/log/apache2/access.log",
            "/var/log/httpd/access_log"
        ]
        
        pqc_ciphers = {"0x0200", "0x0201", "0x0202", "0x0203", "X25519Kyber768"}
        
        for log_path in ssl_log_paths:
            if not os.path.exists(log_path):
                continue
            with open(log_path) as f:
                for line in f:
                    if "SSL" in line or "TLS" in line:
                        for cipher in pqc_ciphers:
                            if cipher in line:
                                break
                        else:
                            if any(w in line for w in ["weak", "RC4", "DES", "NULL"]):
                                self.findings.append({
                                    "type": "PQC_DOWNGRADE_SUSPECTED",
                                    "severity": "MEDIUM",
                                    "file": log_path,
                                    "mitre": "T1562.001",
                                    "description": f"检测到非PQC或弱密码套件连接"
                                })
    
    def hunt_firmware_tampering(self):
        firmware_paths = [
            "/dev/shm/qkd_firmware",
            "/opt/qkd/bin/firmware",
            "/usr/local/lib/qrng/firmware.bin"
        ]
        
        for fw_path in firmware_paths:
            if os.path.exists(fw_path):
                with open(fw_path, 'rb') as f:
                    content = f.read()
                
                indicators = [
                    b"DEBUG_MODE", b"TEST_BYPASS", b"BACKDOOR",
                    b"entropy_source_override", b"prng_seed_override"
                ]
                
                found = [ind for ind in indicators if ind in content]
                if found:
                    self.findings.append({
                        "type": "FIRMWARE_TAMPERING_INDICATOR",
                        "severity": "CRITICAL",
                        "file": fw_path,
                        "mitre": "T1195.002",
                        "indicators": [ind.decode() for ind in found],
                        "description": f"固件中发现{len(found)}个可疑后门指标"
                    })
    
    def generate_report(self):
        report = {
            "scan_time": self.scan_time,
            "target_directory": self.target_dir,
            "total_findings": len(self.findings),
            "critical": sum(1 for f in self.findings if f["severity"] == "CRITICAL"),
            "high": sum(1 for f in self.findings if f["severity"] == "HIGH"),
            "medium": sum(1 for f in self.findings if f["severity"] == "MEDIUM"),
            "findings": self.findings
        }
        
        severity_order = {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2}
        report["findings"].sort(key=lambda x: severity_order.get(x["severity"], 3))
        
        return report
    
    def print_report(self, report):
        print("=" * 60)
        print("量子安全综合狩猎报告")
        print(f"扫描时间: {report['scan_time']}")
        print(f"目标目录: {report['target_directory']}")
        print("=" * 60)
        print(f"发现总数: {report['total_findings']}")
        print(f"  CRITICAL: {report['critical']}")
        print(f"  HIGH: {report['high']}")
        print(f"  MEDIUM: {report['medium']}")
        print()
        
        for i, finding in enumerate(report["findings"], 1):
            print(f"[{finding['severity']}] 发现 #{i}")
            print(f"  类型: {finding['type']}")
            print(f"  文件: {finding.get('file', 'N/A')}")
            print(f"  MITRE: {finding.get('mitre', 'N/A')}")
            print(f"  描述: {finding['description']}")
            print()

if __name__ == "__main__":
    target = sys.argv[1] if len(sys.argv) > 1 else "/var/log"
    hunter = QuantumSecurityHunter(target)
    
    print("[*] 启动量子安全综合狩猎...")
    hunter.hunt_qkd_anomalies()
    hunter.hunt_pqc_downgrade()
    hunter.hunt_firmware_tampering()
    
    report = hunter.generate_report()
    hunter.print_report(report)
    
    output_path = f"/tmp/quantum_hunt_report_{datetime.now().strftime('%Y%m%d_%H%M%S')}.json"
    with open(output_path, 'w') as f:
        json.dump(report, f, indent=2, ensure_ascii=False)
    print(f"[*] 报告已保存: {output_path}")

攻击工具特征:
- FPGA板固件SHA256: 未公开（由研究人员保留）
- 光纤分光器插入损耗: 0.3dB ± 0.05dB
- 时间移位攻击窗口: 50-200皮秒
- APD探测器响应异常模式: 高电平持续时间 > 正常值15%

网络IOC:
- 攻击者管理IP: 未公开（物理层攻击）

时间特征:
- 攻击活动窗口: 凌晨02:00-05:00（利用物理访问控制薄弱时段）

网络IOC:
- 异常SNMP社区字符串变更记录
- DNS隧道特征: 子域名长度 > 60字符, 编码模式为Base32/Base64
- 目标存储服务器IP: 10.x.x.x（内网）
- C2通信频率: 每72小时一次心跳

主机IOC:
- 路由器非授权配置变更日志条目
- 存储服务器异常进程: 大量tar/gzip打包进程
- 磁盘写入模式: 持续顺序写入大文件（>100GB）

文件IOC:
- 路由器固件中额外模块的SHA256
- 非授权二进制文件路径: /tmp/.hidden/, /dev/shm/.cache/
- DNS隧道工具特征: 使用TXT记录承载Base64编码数据

设备IOC:
- 厂商: [未公开具体厂商名] (亚洲地区)
- 产品型号: QRNG-USB-2000系列
- 固件版本: 2.1.x至2.3.x（已知受影响范围）
- 芯片ID: QNG-2023-xxx（通过USB设备描述符读取）

USB控制请求特征:
- 激活后门的USB vendor-specific请求码: 0xB0（不在公开文档中）
- 校准模式标志位: 控制传输bmRequestType位6置位
- 后门激活后设备功耗增加约12mA（可通过USB功率监控检测）

随机性异常特征:
- NIST STS Serial Test p-value < 0.001（正常应 > 0.01）
- 输出序列自相关性在lag=32处出现显著峰值
- 压缩比异常（确定性序列可被显著压缩）