import numpy as np
import pandas as pd
from sklearn.ensemble import IsolationForest, RandomForestClassifier
from sklearn.preprocessing import StandardScaler, LabelEncoder
from sklearn.model_selection import train_test_split
from sklearn.metrics import classification_report, roc_auc_score, precision_recall_curve
from xgboost import XGBClassifier
from sklearn.decomposition import PCA
import warnings
warnings.filterwarnings('ignore')

def load_and_engineer_features(log_path):
    df = pd.read_csv(log_path)
    features = pd.DataFrame()
    features['src_ip_freq'] = df.groupby('src_ip')['src_ip'].transform('count')
    features['dst_port_entropy'] = df.groupby('src_ip')['dst_port'].transform(
        lambda x: -np.sum(x.value_counts(normalize=True) * np.log2(x.value_counts(normalize=True) + 1e-10))
    )
    features['hour'] = pd.to_datetime(df['timestamp']).dt.hour
    features['is_business_hour'] = features['hour'].apply(lambda h: 1 if 9 <= h <= 18 else 0)
    features['session_duration'] = df.groupby('session_id')['timestamp'].transform(
        lambda x: (pd.to_datetime(x.max()) - pd.to_datetime(x.min())).total_seconds()
    )
    features['byte_ratio'] = df['bytes_sent'] / (df['bytes_received'] + 1)
    features['unique_dst_count'] = df.groupby('src_ip')['dst_ip'].transform('nunique')
    features['failed_auth_count'] = df.groupby('src_ip')['auth_result'].transform(
        lambda x: (x == 'failure').rolling(window=10, min_periods=1).sum()
    )
    features['protocol_encoded'] = LabelEncoder().fit_transform(df['protocol'].fillna('unknown'))
    features['is_new_dst'] = df.groupby('src_ip')['dst_ip'].transform(
        lambda x: (~x.duplicated()).astype(int)
    )
    return features.fillna(0)

def train_isolation_forest(X_train, contamination=0.05):
    scaler = StandardScaler()
    X_scaled = scaler.fit_transform(X_train)
    iso_forest = IsolationForest(
        n_estimators=200,
        contamination=contamination,
        max_features=0.8,
        random_state=42,
        n_jobs=-1
    )
    iso_forest.fit(X_scaled)
    return iso_forest, scaler

def train_xgboost_classifier(X_train, y_train):
    scaler = StandardScaler()
    X_scaled = scaler.fit_transform(X_train)
    model = XGBClassifier(
        n_estimators=300,
        max_depth=8,
        learning_rate=0.05,
        subsample=0.8,
        colsample_bytree=0.8,
        scale_pos_weight=len(y_train[y_train==0]) / len(y_train[y_train==1]),
        eval_metric='aucpr',
        random_state=42,
        use_label_encoder=False
    )
    model.fit(X_scaled, y_train)
    return model, scaler

def evaluate_model(model, scaler, X_test, y_test, model_type='classifier'):
    X_scaled = scaler.transform(X_test)
    if model_type == 'classifier':
        y_pred = model.predict(X_scaled)
        y_proba = model.predict_proba(X_scaled)[:, 1]
    else:
        y_pred = model.predict(X_scaled)
        y_pred = np.where(y_pred == -1, 1, 0)
        y_proba = -model.score_samples(X_scaled)
    print(classification_report(y_test, y_pred, target_names=['Normal', 'Malicious']))
    auc = roc_auc_score(y_test, y_proba)
    print(f"AUC-ROC: {auc:.4f}")
    precision, recall, thresholds = precision_recall_curve(y_test, y_proba)
    f1_scores = 2 * (precision * recall) / (precision + recall + 1e-10)
    optimal_idx = np.argmax(f1_scores)
    optimal_threshold = thresholds[optimal_idx] if optimal_idx < len(thresholds) else 0.5
    print(f"Optimal Threshold: {optimal_threshold:.4f}")
    print(f"Best F1-Score: {f1_scores[optimal_idx]:.4f}")
    return auc, optimal_threshold

def apply_pca_reduction(X_train, X_test, n_components=0.95):
    pca = PCA(n_components=n_components, random_state=42)
    X_train_pca = pca.fit_transform(X_train)
    X_test_pca = pca.transform(X_test)
    print(f"Original features: {X_train.shape[1]}, After PCA: {X_train_pca.shape[1]}")
    print(f"Explained variance ratio: {pca.explained_variance_ratio_.sum():.4f}")
    return X_train_pca, X_test_pca, pca

if __name__ == '__main__':
    features = load_and_engineer_features('security_logs.csv')
    X_train, X_test, y_train, y_test = train_test_split(
        features.drop('label', axis=1, errors='ignore'),
        features.get('label', pd.Series(0, index=features.index)),
        test_size=0.2, random_state=42, stratify=features.get('label', pd.Series([0]*len(features)))
    )
    iso_model, iso_scaler = train_isolation_forest(X_train)
    xgb_model, xgb_scaler = train_xgboost_classifier(X_train, y_train)
    print("=== Isolation Forest Results ===")
    evaluate_model(iso_model, iso_scaler, X_test, y_test, model_type='anomaly')
    print("=== XGBoost Results ===")
    evaluate_model(xgb_model, xgb_scaler, X_test, y_test, model_type='classifier')
    X_train_pca, X_test_pca, pca = apply_pca_reduction(X_train, X_test)
    print(f"\nPCA variance preserved: {pca.explained_variance_ratio_.sum():.2%}")

import numpy as np
import pandas as pd
from sklearn.preprocessing import StandardScaler
from sklearn.ensemble import IsolationForest
from scipy import stats
from datetime import datetime, timedelta
from collections import defaultdict

class UEBAEngine:
    def __init__(self, baseline_window_days=30, anomaly_threshold=2.5):
        self.baseline_window = baseline_window_days
        self.threshold = anomaly_threshold
        self.user_baselines = {}
        self.scalers = defaultdict(StandardScaler)
        self.anomaly_detectors = {}
        self.risk_weights = {
            'time_anomaly': 0.25,
            'location_anomaly': 0.20,
            'resource_anomaly': 0.25,
            'volume_anomaly': 0.15,
            'frequency_anomaly': 0.15
        }

    def build_baseline(self, user_id, historical_events):
        events_df = pd.DataFrame(historical_events)
        baseline = {}
        events_df['hour'] = pd.to_datetime(events_df['timestamp']).dt.hour
        events_df['dayofweek'] = pd.to_datetime(events_df['timestamp']).dt.dayofweek
        baseline['hour_dist'] = events_df['hour'].value_counts(normalize=True).to_dict()
        baseline['avg_session_duration'] = events_df.groupby('session_id')['timestamp'].agg(
            lambda x: (pd.to_datetime(x.max()) - pd.to_datetime(x.min())).total_seconds()
        ).mean()
        baseline['std_session_duration'] = events_df.groupby('session_id')['timestamp'].agg(
            lambda x: (pd.to_datetime(x.max()) - pd.to_datetime(x.min())).total_seconds()
        ).std()
        baseline['avg_daily_events'] = events_df.groupby(
            pd.to_datetime(events_df['timestamp']).dt.date
        ).size().mean()
        baseline['std_daily_events'] = events_df.groupby(
            pd.to_datetime(events_df['timestamp']).dt.date
        ).size().std()
        baseline['common_resources'] = events_df['resource'].value_counts(normalize=True).head(20).to_dict()
        baseline['common_ips'] = events_df['src_ip'].value_counts(normalize=True).head(10).to_dict()
        baseline['unique_resources_per_day'] = events_df.groupby(
            pd.to_datetime(events_df['timestamp']).dt.date
        )['resource'].nunique().mean()
        self.user_baselines[user_id] = baseline
        return baseline

    def detect_time_anomaly(self, user_id, event):
        if user_id not in self.user_baselines:
            return 0.0
        baseline = self.user_baselines[user_id]
        event_hour = pd.to_datetime(event['timestamp']).hour
        hour_prob = baseline['hour_dist'].get(event_hour, 0.001)
        if hour_prob < 0.01:
            return 1.0
        elif hour_prob < 0.05:
            return 0.7
        elif hour_prob < 0.10:
            return 0.4
        return 0.0

    def detect_resource_anomaly(self, user_id, event):
        if user_id not in self.user_baselines:
            return 0.0
        baseline = self.user_baselines[user_id]
        resource = event.get('resource', '')
        common_resources = baseline['common_resources']
        if resource in common_resources:
            return max(0, 1.0 - common_resources[resource] * 10)
        return 0.9

    def detect_volume_anomaly(self, user_id, recent_events_count):
        if user_id not in self.user_baselines:
            return 0.0
        baseline = self.user_baselines[user_id]
        z_score = (recent_events_count - baseline['avg_daily_events']) / (baseline['std_daily_events'] + 1e-10)
        if z_score > self.threshold:
            return min(1.0, z_score / (self.threshold * 3))
        return 0.0

    def calculate_risk_score(self, user_id, event, recent_events_count=0):
        anomalies = {
            'time_anomaly': self.detect_time_anomaly(user_id, event),
            'location_anomaly': 0.0,
            'resource_anomaly': self.detect_resource_anomaly(user_id, event),
            'volume_anomaly': self.detect_volume_anomaly(user_id, recent_events_count),
            'frequency_anomaly': 0.0
        }
        risk_score = sum(
            anomalies[dim] * weight
            for dim, weight in self.risk_weights.items()
        )
        risk_level = 'LOW'
        if risk_score > 0.7:
            risk_level = 'CRITICAL'
        elif risk_score > 0.5:
            risk_level = 'HIGH'
        elif risk_score > 0.3:
            risk_level = 'MEDIUM'
        return {
            'user_id': user_id,
            'risk_score': round(risk_score, 4),
            'risk_level': risk_level,
            'anomalies': anomalies,
            'timestamp': event.get('timestamp', datetime.now().isoformat()),
            'triggered_dimensions': [k for k, v in anomalies.items() if v > 0.3]
        }

    def analyze_session(self, user_id, session_events):
        results = []
        event_count = len(session_events)
        for event in session_events:
            result = self.calculate_risk_score(user_id, event, event_count)
            results.append(result)
        avg_risk = np.mean([r['risk_score'] for r in results])
        max_risk = max([r['risk_score'] for r in results])
        triggered_dims = set()
        for r in results:
            triggered_dims.update(r['triggered_dimensions'])
        return {
            'user_id': user_id,
            'session_risk_score': round(max_risk, 4),
            'avg_risk_score': round(avg_risk, 4),
            'triggered_dimensions': list(triggered_dims),
            'event_results': results,
            'requires_investigation': max_risk > 0.5 or len(triggered_dims) >= 2
        }

if __name__ == '__main__':
    engine = UEBAEngine(baseline_window_days=30, anomaly_threshold=2.5)
    sample_baseline_events = [
        {'timestamp': f'2026-06-{d:02d} {h:02d}:30:00', 'resource': '/docs/report',
         'src_ip': '192.168.1.100', 'session_id': f'sess_{d}'}
        for d in range(1, 29) for h in range(9, 18)
    ]
    engine.build_baseline('user_001', sample_baseline_events)
    suspicious_event = {
        'timestamp': '2026-07-08 03:15:00',
        'resource': '/admin/db_export',
        'src_ip': '10.0.99.50',
        'session_id': 'sess_anomaly'
    }
    result = engine.calculate_risk_score('user_001', suspicious_event)
    print(f"Risk Score: {result['risk_score']}")
    print(f"Risk Level: {result['risk_level']}")
    print(f"Triggered: {result['triggered_dimensions']}")

title: PowerShell Remote Script Download and Execution
id: a3b7c9d1-4e5f-6789-abcd-ef0123456789
status: experimental
description: Detects PowerShell commands that download and execute remote scripts, commonly used in initial access and execution stages
references:
  - https://attack.mitre.org/techniques/T1059/001/
  - https://attack.mitre.org/techniques/T1105/
author: BlueTeam Analytics
date: 2026/07/08
tags:
  - attack.execution
  - attack.t1059.001
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_invoke_webrequest:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'Invoke-Expression'
      - 'IEX'
      - 'DownloadString'
      - 'DownloadFile'
      - 'Net.WebClient'
  selection_encoded_command:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - '-enc'
      - '-EncodedCommand'
      - '-e '
  selection_bypass_execution:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Bypass'
      - 'Hidden'
      - '-nop'
      - '-NonInteractive'
      - 'WindowStyle Hidden'
  filter_legitimate:
    CommandLine|contains:
      - 'WindowsUpdate'
      - 'Microsoft.PowerShell.Management'
      - 'PSModule'
  condition: (selection_invoke_webrequest or selection_encoded_command or selection_bypass_execution) and not filter_legitimate
falsepositives:
  - Legitimate software updates using PowerShell
  - IT automation scripts
level: high

#!/bin/bash

LOG_DIR="/var/log/security"
REPORT_DIR="/var/log/security/reports"
DATE=$(date +%Y%m%d_%H%M%S)
REPORT_FILE="${REPORT_DIR}/analysis_report_${DATE}.html"
THRESHOLD_FAILED_AUTH=5
THRESHOLD_CONNECTIONS=1000
ALERT_EMAIL="soc@company.com"

mkdir -p "${REPORT_DIR}"

echo "<html><head><title>Security Analysis Report - ${DATE}</title></head><body>" > "${REPORT_FILE}"
echo "<h1>Automated Security Analysis Report</h1>" >> "${REPORT_FILE}"
echo "<p>Generated: $(date)</p>" >> "${REPORT_FILE}"

echo "<h2>1. Failed Authentication Analysis</h2>" >> "${REPORT_FILE}"
echo "<table border='1'><tr><th>Source IP</th><th>Failed Attempts</th><th>Target Accounts</th><th>Risk Level</th></tr>" >> "${REPORT_FILE}"
grep -i "failed\|invalid" /var/log/auth.log 2>/dev/null | \
    awk '{print $11}' | sort | uniq -c | sort -rn | head -20 | while read count ip; do
    if [ "$count" -ge "${THRESHOLD_FAILED_AUTH}" ]; then
        accounts=$(grep -i "failed\|invalid" /var/log/auth.log 2>/dev/null | grep "$ip" | awk '{print $9}' | sort -u | tr '\n' ', ')
        risk="HIGH"
        if [ "$count" -ge 20 ]; then
            risk="CRITICAL"
        fi
        echo "<tr><td>${ip}</td><td>${count}</td><td>${accounts}</td><td>${risk}</td></tr>" >> "${REPORT_FILE}"
    fi
done
echo "</table>" >> "${REPORT_FILE}"

echo "<h2>2. High Volume Connection Analysis</h2>" >> "${REPORT_FILE}"
echo "<table border='1'><tr><th>Source IP</th><th>Connection Count</th><th>Unique Destinations</th><th>Risk Level</th></tr>" >> "${REPORT_FILE}"
if [ -f /var/log/nginx/access.log ]; then
    awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -20 | while read count ip; do
        if [ "$count" -ge "${THRESHOLD_CONNECTIONS}" ]; then
            unique_dst=$(grep "$ip" /var/log/nginx/access.log | awk '{print $7}' | sort -u | wc -l)
            risk="MEDIUM"
            if [ "$unique_dst" -ge 50 ]; then
                risk="HIGH"
            fi
            echo "<tr><td>${ip}</td><td>${count}</td><td>${unique_dst}</td><td>${risk}</td></tr>" >> "${REPORT_FILE}"
        fi
    done
fi
echo "</table>" >> "${REPORT_FILE}"

echo "<h2>3. Suspicious Process Execution</h2>" >> "${REPORT_FILE}"
echo "<table border='1'><tr><th>Timestamp</th><th>User</th><th>Process</th><th>Parent</th><th>Risk</th></tr>" >> "${REPORT_FILE}"
if [ -f /var/log/audit/audit.log ]; then
    grep "EXECVE" /var/log/audit/audit.log 2>/dev/null | \
        grep -E "curl|wget|nc|ncat|python|perl|ruby|bash -i|/dev/tcp|base64|eval" | \
        tail -50 | while IFS= read -r line; do
        timestamp=$(echo "$line" | grep -oP 'msg=audit\(\K[^)]+')
        user=$(echo "$line" | grep -oP 'uid=\K[0-9]+')
        echo "<tr><td>${timestamp}</td><td>UID:${user}</td><td>Suspicious Process</td><td>See audit log</td><td>HIGH</td></tr>" >> "${REPORT_FILE}"
    done
fi
echo "</table>" >> "${REPORT_FILE}"

echo "<h2>4. Firewall Denied Connections Summary</h2>" >> "${REPORT_FILE}"
if [ -f /var/log/messages ]; then
    denied_count=$(grep -c "DENY\|DROP\|REJECT" /var/log/messages 2>/dev/null || echo "0")
    unique_sources=$(grep "DENY\|DROP\|REJECT" /var/log/messages 2>/dev/null | awk '{print $5}' | sort -u | wc -l || echo "0")
    echo "<p>Total denied connections: ${denied_count}</p>" >> "${REPORT_FILE}"
    echo "<p>Unique source IPs: ${unique_sources}</p>" >> "${REPORT_FILE}"
fi

echo "<h2>5. Summary and Recommendations</h2>" >> "${REPORT_FILE}"
echo "<ul>" >> "${REPORT_FILE}"
echo "<li>Review all HIGH/CRITICAL risk entries above</li>" >> "${REPORT_FILE}"
echo "<li>Investigate repeated failed authentication sources</li>" >> "${REPORT_FILE}"
echo "<li>Verify high-volume connection sources against whitelist</li>" >> "${REPORT_FILE}"
echo "<li>Monitor suspicious process executions for lateral movement</li>" >> "${REPORT_FILE}"
echo "</ul>" >> "${REPORT_FILE}"
echo "</body></html>" >> "${REPORT_FILE}"

echo "Analysis report generated: ${REPORT_FILE}"
if command -v mail &> /dev/null; then
    echo "Security analysis report ready for review" | mail -s "Security Report - ${DATE}" -a "${REPORT_FILE}" "${ALERT_EMAIL}" 2>/dev/null
fi

import numpy as np
import pandas as pd
from sklearn.ensemble import IsolationForest
from sklearn.preprocessing import StandardScaler, MinMaxScaler
from sklearn.metrics import classification_report, confusion_matrix
from collections import deque
import json
import time

class NetworkAnomalyDetector:
    def __init__(self, window_size=100, contamination=0.05):
        self.window_size = window_size
        self.contamination = contamination
        self.scaler = StandardScaler()
        self.model = IsolationForest(
            n_estimators=200,
            max_samples='auto',
            contamination=self.contamination,
            max_features=1.0,
            bootstrap=False,
            random_state=42,
            n_jobs=-1
        )
        self.feature_buffer = deque(maxlen=window_size)
        self.baseline_stats = {}
        self.is_trained = False
        self.alert_threshold = 0.7
        self.alert_history = []

    def extract_features(self, flow_data):
        features = {}
        features['duration'] = flow_data.get('duration', 0)
        features['bytes_sent'] = flow_data.get('bytes_sent', 0)
        features['bytes_received'] = flow_data.get('bytes_received', 0)
        features['packet_count'] = flow_data.get('packet_count', 0)
        features['avg_packet_size'] = (
            (features['bytes_sent'] + features['bytes_received']) /
            (features['packet_count'] + 1)
        )
        features['byte_ratio'] = features['bytes_sent'] / (features['bytes_received'] + 1)
        features['packets_per_second'] = features['packet_count'] / (features['duration'] + 0.001)
        features['bytes_per_second'] = (features['bytes_sent'] + features['bytes_received']) / (features['duration'] + 0.001)
        features['dst_port'] = flow_data.get('dst_port', 0)
        features['is_well_known_port'] = 1 if features['dst_port'] < 1024 else 0
        features['protocol_tcp'] = 1 if flow_data.get('protocol', '') == 'TCP' else 0
        features['protocol_udp'] = 1 if flow_data.get('protocol', '') == 'UDP' else 0
        features['syn_count'] = flow_data.get('syn_count', 0)
        features['fin_count'] = flow_data.get('fin_count', 0)
        features['rst_count'] = flow_data.get('rst_count', 0)
        features['syn_fin_ratio'] = features['syn_count'] / (features['fin_count'] + 1)
        features['payload_entropy'] = flow_data.get('payload_entropy', 0)
        features['inter_arrival_mean'] = flow_data.get('inter_arrival_mean', 0)
        features['inter_arrival_std'] = flow_data.get('inter_arrival_std', 0)
        return features

    def train(self, training_flows):
        feature_list = [self.extract_features(flow) for flow in training_flows]
        feature_df = pd.DataFrame(feature_list)
        X_scaled = self.scaler.fit_transform(feature_df)
        self.model.fit(X_scaled)
        self.baseline_stats = {
            'mean': feature_df.mean().to_dict(),
            'std': feature_df.std().to_dict(),
            'median': feature_df.median().to_dict(),
            'q25': feature_df.quantile(0.25).to_dict(),
            'q75': feature_df.quantile(0.75).to_dict()
        }
        self.is_trained = True
        print(f"Model trained on {len(training_flows)} flows")
        print(f"Baseline stats computed for {len(self.baseline_stats['mean'])} features")

    def detect(self, flow_data):
        if not self.is_trained:
            raise RuntimeError("Model not trained. Call train() first.")
        features = self.extract_features(flow_data)
        feature_df = pd.DataFrame([features])
        X_scaled = self.scaler.transform(feature_df)
        prediction = self.model.predict(X_scaled)[0]
        anomaly_score = -self.model.score_samples(X_scaled)[0]
        is_anomaly = prediction == -1
        risk_level = 'NORMAL'
        if anomaly_score > 0.8:
            risk_level = 'CRITICAL'
        elif anomaly_score > 0.6:
            risk_level = 'HIGH'
        elif anomaly_score > 0.4:
            risk_level = 'MEDIUM'
        elif anomaly_score > self.alert_threshold:
            risk_level = 'LOW'
        result = {
            'timestamp': time.time(),
            'is_anomaly': is_anomaly,
            'anomaly_score': round(float(anomaly_score), 4),
            'risk_level': risk_level,
            'features': features,
            'src_ip': flow_data.get('src_ip', 'unknown'),
            'dst_ip': flow_data.get('dst_ip', 'unknown'),
            'dst_port': flow_data.get('dst_port', 0)
        }
        if is_anomaly:
            self.alert_history.append(result)
        return result

    def detect_batch(self, flows):
        results = []
        for flow in flows:
            result = self.detect(flow)
            results.append(result)
        total = len(results)
        anomalies = sum(1 for r in results if r['is_anomaly'])
        return {
            'total_flows': total,
            'anomalies_detected': anomalies,
            'anomaly_ratio': round(anomalies / total, 4) if total > 0 else 0,
            'results': results
        }

    def get_alert_summary(self, time_window=3600):
        current_time = time.time()
        recent_alerts = [
            a for a in self.alert_history
            if current_time - a['timestamp'] < time_window
        ]
        if not recent_alerts:
            return {'total_alerts': 0, 'message': 'No recent alerts'}
        risk_distribution = {}
        top_sources = {}
        top_destinations = {}
        for alert in recent_alerts:
            level = alert['risk_level']
            risk_distribution[level] = risk_distribution.get(level, 0) + 1
            src = alert['src_ip']
            top_sources[src] = top_sources.get(src, 0) + 1
            dst = alert['dst_ip']
            top_destinations[dst] = top_destinations.get(dst, 0) + 1
        sorted_sources = sorted(top_sources.items(), key=lambda x: x[1], reverse=True)[:10]
        sorted_destinations = sorted(top_destinations.items(), key=lambda x: x[1], reverse=True)[:10]
        return {
            'time_window_seconds': time_window,
            'total_alerts': len(recent_alerts),
            'risk_distribution': risk_distribution,
            'top_source_ips': sorted_sources,
            'top_destination_ips': sorted_destinations,
            'avg_anomaly_score': round(np.mean([a['anomaly_score'] for a in recent_alerts]), 4)
        }

if __name__ == '__main__':
    detector = NetworkAnomalyDetector(window_size=100, contamination=0.05)
    training_flows = [
        {
            'duration': np.random.uniform(1, 60),
            'bytes_sent': np.random.randint(100, 10000),
            'bytes_received': np.random.randint(100, 50000),
            'packet_count': np.random.randint(5, 200),
            'dst_port': np.random.choice([80, 443, 53, 22, 3389]),
            'protocol': 'TCP',
            'syn_count': np.random.randint(0, 3),
            'fin_count': np.random.randint(0, 5),
            'rst_count': np.random.randint(0, 2),
            'payload_entropy': np.random.uniform(3, 7),
            'inter_arrival_mean': np.random.uniform(0.01, 1),
            'inter_arrival_std': np.random.uniform(0.001, 0.5),
            'src_ip': f'192.168.1.{np.random.randint(1, 200)}',
            'dst_ip': f'10.0.{np.random.randint(0, 5)}.{np.random.randint(1, 254)}'
        }
        for _ in range(5000)
    ]
    detector.train(training_flows)
    normal_flow = {
        'duration': 30, 'bytes_sent': 5000, 'bytes_received': 15000,
        'packet_count': 50, 'dst_port': 443, 'protocol': 'TCP',
        'syn_count': 1, 'fin_count': 2, 'rst_count': 0,
        'payload_entropy': 5.2, 'inter_arrival_mean': 0.1,
        'inter_arrival_std': 0.05, 'src_ip': '192.168.1.100',
        'dst_ip': '10.0.1.50'
    }
    suspicious_flow = {
        'duration': 300, 'bytes_sent': 5000000, 'bytes_received': 500,
        'packet_count': 5000, 'dst_port': 4444, 'protocol': 'TCP',
        'syn_count': 50, 'fin_count': 2, 'rst_count': 15,
        'payload_entropy': 7.9, 'inter_arrival_mean': 0.001,
        'inter_arrival_std': 0.0005, 'src_ip': '192.168.1.100',
        'dst_ip': '185.220.100.252'
    }
    print("=== Normal Flow Detection ===")
    normal_result = detector.detect(normal_flow)
    print(f"Anomaly Score: {normal_result['anomaly_score']}")
    print(f"Risk Level: {normal_result['risk_level']}")
    print(f"Is Anomaly: {normal_result['is_anomaly']}")
    print("\n=== Suspicious Flow Detection ===")
    suspicious_result = detector.detect(suspicious_flow)
    print(f"Anomaly Score: {suspicious_result['anomaly_score']}")
    print(f"Risk Level: {suspicious_result['risk_level']}")
    print(f"Is Anomaly: {suspicious_result['is_anomaly']}")
    summary = detector.get_alert_summary(time_window=3600)
    print(f"\nAlert Summary: {json.dumps(summary, indent=2, default=str)}")