《互联网产品的 AI 架构·平台化与治理》9.2 红队与滥用检测

// file: src/gov/red-team-gov.ts
// tier: L2
// verify: node --test test/gov/security-gov.test.ts

import type { RiskCategory } from "./security-gov.ts";

/** 红队计划与滥用信号：用例按风险类别覆盖，通过率按用例权重计算。 */
export type Cadence = "monthly" | "quarterly" | "semiannual";
export type CaseExpectation = "block" | "detect";
export type CaseOutcome = "blocked" | "detected" | "bypassed" | "not-run";
export type CaseSeverity = "critical" | "high" | "medium";

export interface RedTeamCase {
  id: string; category: RiskCategory; severity: CaseSeverity;
  weight: number; expectation: CaseExpectation;
}
export interface RedTeamPlan {
  id: string; scope: readonly RiskCategory[]; cadence: Cadence; caseSetVersion: string;
  minPassRate: number; maxCriticalFailures: number; lastRun: string;
}
export interface CaseResult { caseId: string; outcome: CaseOutcome }
export interface RedTeamReport {
  planId: string; executed: number; passed: number; passRateBps: number;
  criticalFailures: number; uncovered: RiskCategory[];
  gate: "pass" | "fail"; reasons: string[]; nextRun: string; overdueDays: number;
}

const CADENCE_DAYS: Record<Cadence, number> = { monthly: 30, quarterly: 90, semiannual: 180 };

function addDays(date: string, days: number): string {
  return new Date(Date.parse(`${date}T00:00:00Z`) + days * 86_400_000)
    .toISOString().slice(0, 10);
}

/** 门禁同时看覆盖率、完整性、加权通过率、严重失败数与计划逾期，reasons 保留全部原因。 */
export function evaluateRedTeam(
  plan: RedTeamPlan, cases: readonly RedTeamCase[],
  results: readonly CaseResult[], today: string,
): RedTeamReport {
  const byId = new Map(cases.map((item) => [item.id, item]));
  const executedIds = new Set<string>();
  let passed = 0; let passedWeight = 0; let executedWeight = 0; let criticalFailures = 0;
  for (const result of results) {
    if (result.outcome === "not-run") continue;
    const item = byId.get(result.caseId);
    if (item === undefined || executedIds.has(item.id)) continue;
    executedIds.add(item.id);
    executedWeight += item.weight;
    const ok = item.expectation === "block"
      ? result.outcome === "blocked" : result.outcome === "detected";
    if (ok) {
      passed += 1;
      passedWeight += item.weight;
    } else if (item.severity === "critical") {
      criticalFailures += 1;
    }
  }
  const executed = executedIds.size;
  const passRateBps = executedWeight === 0
    ? 0 : Math.round((passedWeight / executedWeight) * 10_000);
  const uncovered = plan.scope.filter(
    (category) => !cases.some((item) => item.category === category),
  );
  const nextRun = addDays(plan.lastRun, CADENCE_DAYS[plan.cadence]);
  const overdueDays = Math.max(0, Math.round(
    (Date.parse(`${today}T00:00:00Z`) - Date.parse(`${nextRun}T00:00:00Z`)) / 86_400_000,
  ));
  const reasons: string[] = [];
  if (uncovered.length > 0) reasons.push(`uncovered:${uncovered.join(",")}`);
  if (executed < cases.length) reasons.push(`incomplete:${executed}/${cases.length}`);
  if (passRateBps < Math.round(plan.minPassRate * 10_000)) reasons.push(`pass-rate:${passRateBps}`);
  if (criticalFailures > plan.maxCriticalFailures) {
    reasons.push(`critical-failures:${criticalFailures}`);
  }
  if (overdueDays > 0) reasons.push(`overdue:${overdueDays}`);
  return {
    planId: plan.id, executed, passed, passRateBps, criticalFailures, uncovered,
    gate: reasons.length === 0 ? "pass" : "fail", reasons, nextRun, overdueDays,
  };
}

export type AbuseSignal =
  | "rate-spike" | "repeated-block" | "credential-sharing"
  | "probe-pattern" | "cost-anomaly";
export type AbuseAction = "monitor" | "throttle" | "suspend";

export interface AbuseRule { threshold: number; weight: number; action: AbuseAction }
export interface AbusePolicy {
  rules: Record<AbuseSignal, AbuseRule>; throttleAt: number; suspendAt: number;
}
export interface AbuseSample { tenantId: string; signal: AbuseSignal; observed: number }
export interface AbuseDecision {
  tenantId: string; triggered: AbuseSignal[]; score: number; action: AbuseAction | "none";
}

/** 每个信号独立比较阈值，命中后累加权重；动作取累计分对应的最高档。 */
export function evaluateAbuse(
  policy: AbusePolicy, samples: readonly AbuseSample[],
): AbuseDecision[] {
  const grouped = new Map<string, AbuseSample[]>();
  for (const sample of samples) {
    const list = grouped.get(sample.tenantId) ?? [];
    list.push(sample);
    grouped.set(sample.tenantId, list);
  }
  const decisions: AbuseDecision[] = [];
  for (const [tenantId, list] of grouped) {
    const triggered: AbuseSignal[] = [];
    let score = 0;
    for (const signal of Object.keys(policy.rules) as AbuseSignal[]) {
      const rule = policy.rules[signal];
      if (!list.some((item) => item.signal === signal && item.observed >= rule.threshold)) continue;
      triggered.push(signal);
      score += rule.weight;
    }
    const action: AbuseAction | "none" = score >= policy.suspendAt
      ? "suspend" : score >= policy.throttleAt ? "throttle" : score > 0 ? "monitor" : "none";
    decisions.push({ tenantId, triggered, score, action });
  }
  return decisions.sort((a, b) => b.score - a.score
    || (a.tenantId < b.tenantId ? -1 : a.tenantId > b.tenantId ? 1 : 0));
}

// file: src/gov/incident-gov.ts
// tier: L2
// verify: node --test test/gov/security-gov.test.ts

/** 安全事件响应：分级、时限、止血清单与对外披露口径。 */
export type IncidentSeverity = "sev1" | "sev2" | "sev3" | "sev4";
export type IncidentKind =
  | "prompt-injection" | "tool-misuse" | "data-exfiltration" | "unauthorized-action";

export interface Incident {
  id: string; kind: IncidentKind; severity: IncidentSeverity;
  /** 带时区的 ISO 8601 时间戳。 */
  detectedAt: string;
  acknowledgedAt?: string; containedAt?: string; forensicsStartedAt?: string;
  customerData: boolean; crossBorder: boolean; exploited: boolean;
}
export interface ResponseDeadlines { acknowledge: string; contain: string; forensics: string }
export interface DisclosureDecision {
  required: boolean; reasons: string[];
  customerDeadline?: string; regulatorDeadline?: string; publicDeadline?: string;
}
export interface IncidentAssessment {
  id: string; severity: IncidentSeverity; deadlines: ResponseDeadlines;
  breached: string[]; pending: string[]; containedInMinutes?: number;
  disclosure: DisclosureDecision;
}

type Sla = { acknowledgeMinutes: number; containMinutes: number; forensicsMinutes: number };
export const RESPONSE_SLA: Record<IncidentSeverity, Sla> = {
  sev1: { acknowledgeMinutes: 15, containMinutes: 60, forensicsMinutes: 120 },
  sev2: { acknowledgeMinutes: 30, containMinutes: 240, forensicsMinutes: 480 },
  sev3: { acknowledgeMinutes: 240, containMinutes: 1_440, forensicsMinutes: 4_320 },
  sev4: { acknowledgeMinutes: 1_440, containMinutes: 10_080, forensicsMinutes: 10_080 },
};

function addMinutes(timestamp: string, minutes: number): string {
  return new Date(Date.parse(timestamp) + minutes * 60_000).toISOString();
}

/** 分级只看事实：是否涉及客户数据、是否跨境、是否已被利用。 */
export function classifyIncident(
  kind: IncidentKind,
  facts: { customerData: boolean; crossBorder: boolean; exploited: boolean },
): IncidentSeverity {
  if (kind === "data-exfiltration" && (facts.customerData || facts.crossBorder)) return "sev1";
  if (kind === "unauthorized-action" && facts.exploited) return "sev1";
  if (facts.exploited || facts.customerData || facts.crossBorder) return "sev2";
  if (kind === "data-exfiltration" || kind === "tool-misuse") return "sev2";
  if (kind === "prompt-injection" || kind === "unauthorized-action") return "sev3";
  return "sev4";
}

export function responseDeadlines(
  severity: IncidentSeverity, detectedAt: string,
): ResponseDeadlines {
  const sla = RESPONSE_SLA[severity];
  return {
    acknowledge: addMinutes(detectedAt, sla.acknowledgeMinutes),
    contain: addMinutes(detectedAt, sla.containMinutes),
    forensics: addMinutes(detectedAt, sla.forensicsMinutes),
  };
}

/**
 * 披露判定：严重级别、客户数据、跨境、已利用四个条件任一成立即需披露。
 * 时间线是示例口径，不是法规结论；实际以法务与监管要求为准。
 */
export function decideDisclosure(incident: Incident): DisclosureDecision {
  const reasons: string[] = [];
  if (incident.severity === "sev1" || incident.severity === "sev2") reasons.push("severity");
  if (incident.customerData) reasons.push("customer-data");
  if (incident.crossBorder) reasons.push("cross-border");
  if (incident.exploited) reasons.push("exploited");
  if (reasons.length === 0) return { required: false, reasons };
  const customerHours = incident.severity === "sev1" ? 24 : incident.severity === "sev2" ? 48 : 120;
  const publicHours = incident.severity === "sev1" ? 72 : incident.severity === "sev2" ? 168 : 336;
  const decision: DisclosureDecision = {
    required: true, reasons,
    publicDeadline: addMinutes(incident.detectedAt, publicHours * 60),
  };
  if (incident.customerData) {
    decision.customerDeadline = addMinutes(incident.detectedAt, customerHours * 60);
  }
  if (incident.customerData || incident.crossBorder) {
    decision.regulatorDeadline = addMinutes(incident.detectedAt, 72 * 60);
  }
  return decision;
}

export function assessIncident(incident: Incident, now: string): IncidentAssessment {
  const deadlines = responseDeadlines(incident.severity, incident.detectedAt);
  const phases = [
    { name: "acknowledge", deadline: deadlines.acknowledge, done: incident.acknowledgedAt },
    { name: "contain", deadline: deadlines.contain, done: incident.containedAt },
    { name: "forensics", deadline: deadlines.forensics, done: incident.forensicsStartedAt },
  ];
  const breached: string[] = [];
  const pending: string[] = [];
  for (const phase of phases) {
    if (phase.done !== undefined) {
      if (Date.parse(phase.done) > Date.parse(phase.deadline)) breached.push(phase.name);
    } else if (Date.parse(now) > Date.parse(phase.deadline)) {
      breached.push(phase.name);
    } else {
      pending.push(phase.name);
    }
  }
  return {
    id: incident.id,
    severity: incident.severity,
    deadlines,
    breached,
    pending,
    containedInMinutes: incident.containedAt === undefined ? undefined
      : Math.round((Date.parse(incident.containedAt) - Date.parse(incident.detectedAt)) / 60_000),
    disclosure: decideDisclosure(incident),
  };
}