feat: add anomaly detection engine for behavioral security analytics - #60
Open
cto-new[bot] wants to merge 1 commit into
Open
feat: add anomaly detection engine for behavioral security analytics#60cto-new[bot] wants to merge 1 commit into
cto-new[bot] wants to merge 1 commit into
Conversation
…ehavioral security analysis Add comprehensive anomaly engine for security analytics, enabling automated behavioral anomaly detection across device, IP, and login activity. Implements data aggregation, configurable detection rules, baseline learning, and backend persistence. Adds REST API endpoints and real-time background pipeline. - Aggregates device/IP/conversation activities with sliding-window analysis - Implements multiple detectors: quota spike, login anomaly, request ratio, device/IP switching (all with baseline-driven thresholds) - Adds SecurityAnomaly table, baseline storage, and efficient deduplication - Configurable via Option table / env; user/admin endpoints for list/query - Engine runs as non-blocking goroutine and is concurrency safe Migration: new tables (security_anomalies, anomaly_baselines); run migration on deploy. Configuration may need tuning for production rollout.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR introduces an advanced security analytics anomaly detection engine that aggregates device/IP activity and applies configurable rules to detect suspicious behavioral anomalies in user log data.
Details
Warning: Task VM test is not passing, cto.new will perform much better if you fix the setup