SaaS 行业观察：AI 驱动的安全防护与威胁检测

class ZeroTrustArchitecture:
    def __init__(self):
        self.identity_provider = IdentityProvider()
        self.policy_engine = PolicyEngine()
        self.risk_engine = RiskEngine()
        self.audit_logger = AuditLogger()
    
    def evaluate_access_request(self, request):
        """
        评估每个访问请求，不信任任何实体
        """
        # 1. 验证身份
        identity = self.identity_provider.verify_identity(
            request.credentials,
            request.device,
            request.context
        )
        
        if not identity.verified:
            return AccessDecision(
                allowed=False,
                reason='identity_not_verified'
            )
        
        # 2. 评估风险
        risk_score = self.risk_engine.calculate_risk(
            identity=identity,
            resource=request.resource,
            action=request.action,
            context=request.context
        )
        
        # 3. 应用策略
        policy_decision = self.policy_engine.evaluate(
            identity=identity,
            resource=request.resource,
            action=request.action,
            risk_score=risk_score
        )
        
        # 4. 记录审计日志
        self.audit_logger.log_access_request(
            request=request,
            identity=identity,
            risk_score=risk_score,
            decision=policy_decision
        )
        
        return policy_decision
    
    def continuous_verification(self, session):
        """
        持续验证会话的安全性
        """
        while session.active:
            # 定期检查
            current_risk = self.risk_engine.calculate_session_risk(session)
            
            if current_risk > session.initial_risk + 0.3:
                # 风险显著增加，要求重新验证
                session.require_reauthentication()
            
            if current_risk > 0.8:
                # 高风险，终止会话
                session.terminate(reason='high_risk')
            
            time.sleep(60)  # 每分钟检查一次

class Microsegmentation:
    def __init__(self):
        self.segments = {}
        self.policies = {}
    
    def create_segment(self, segment_name, resources, security_level):
        """
        创建微分段
        """
        segment = {
            'name': segment_name,
            'resources': resources,
            'security_level': security_level,
            'access_rules': [],
            'monitoring': True
        }
        
        self.segments[segment_name] = segment
        return segment
    
    def define_access_policy(self, source_segment, target_segment, conditions):
        """
        定义分段间的访问策略
        """
        policy = {
            'source': source_segment,
            'target': target_segment,
            'conditions': conditions,
            'allowed': True,
            'logging': True
        }
        
        policy_key = f"{source_segment}->{target_segment}"
        self.policies[policy_key] = policy
        
        return policy
    
    def enforce_segmentation(self, request):
        """
        执行分段策略
        """
        source_segment = self.identify_segment(request.source)
        target_segment = self.identify_segment(request.target)
        
        policy_key = f"{source_segment}->{target_segment}"
        
        if policy_key in self.policies:
            policy = self.policies[policy_key]
            
            # 检查条件
            if self.evaluate_conditions(policy['conditions'], request):
                return AccessDecision(allowed=True, policy=policy)
            else:
                return AccessDecision(allowed=False, reason='conditions_not_met')
        else:
            # 默认拒绝
            return AccessDecision(allowed=False, reason='no_policy')

class AnomalyDetectionEngine:
    def __init__(self):
        self.models = {
            'user_behavior': UserBehaviorModel(),
            'network_traffic': NetworkTrafficModel(),
            'access_patterns': AccessPatternModel(),
            'data_access': DataAccessModel()
        }
        
        self.baseline_profiles = {}
        self.alert_thresholds = {
            'low': 0.7,
            'medium': 0.85,
            'high': 0.95
        }
    
    def detect_anomalies(self, event):
        """
        检测事件中的异常
        """
        anomalies = []
        
        # 用户行为异常
        user_anomaly = self.models['user_behavior'].score(event)
        if user_anomaly > self.alert_thresholds['medium']:
            anomalies.append({
                'type': 'user_behavior',
                'score': user_anomaly,
                'details': self.models['user_behavior'].explain(event)
            })
        
        # 网络流量异常
        network_anomaly = self.models['network_traffic'].score(event)
        if network_anomaly > self.alert_thresholds['medium']:
            anomalies.append({
                'type': 'network_traffic',
                'score': network_anomaly,
                'details': self.models['network_traffic'].explain(event)
            })
        
        # 访问模式异常
        access_anomaly = self.models['access_patterns'].score(event)
        if access_anomaly > self.alert_thresholds['medium']:
            anomalies.append({
                'type': 'access_pattern',
                'score': access_anomaly,
                'details': self.models['access_patterns'].explain(event)
            })
        
        # 数据访问异常
        data_anomaly = self.models['data_access'].score(event)
        if data_anomaly > self.alert_thresholds['medium']:
            anomalies.append({
                'type': 'data_access',
                'score': data_anomaly,
                'details': self.models['data_access'].explain(event)
            })
        
        return anomalies
    
    def update_baseline(self, user_id, event):
        """
        更新用户基线行为
        """
        if user_id not in self.baseline_profiles:
            self.baseline_profiles[user_id] = BaselineProfile()
        
        self.baseline_profiles[user_id].update(event)
    
    def train_models(self, training_data):
        """
        训练异常检测模型
        """
        for model_name, model in self.models.items():
            model_data = self.extract_model_data(training_data, model_name)
            model.train(model_data)

class ThreatIntelligenceSystem:
    def __init__(self):
        self.feeds = [
            'industry_threat_feed',
            'government_alerts',
            'security_vendor_feeds',
            'open_source_intelligence'
        ]
        
        self.ioc_database = IOCDatabase()
        self.correlation_engine = CorrelationEngine()
    
    def ingest_threat_intelligence(self):
        """
        摄入威胁情报
        """
        for feed in self.feeds:
            indicators = self.fetch_from_feed(feed)
            
            for indicator in indicators:
                # 验证和丰富指标
                enriched_indicator = self.enrich_indicator(indicator)
                
                # 存储到数据库
                self.ioc_database.store(enriched_indicator)
                
                # 检查是否与当前活动相关
                correlations = self.correlation_engine.check_correlations(
                    enriched_indicator
                )
                
                if correlations:
                    self.generate_alert(enriched_indicator, correlations)
    
    def check_against_iocs(self, event):
        """
        检查事件是否匹配已知威胁指标
        """
        matches = []
        
        # 检查 IP 地址
        if event.source_ip in self.ioc_database.malicious_ips:
            matches.append({
                'type': 'malicious_ip',
                'ioc': event.source_ip,
                'threat_info': self.ioc_database.get_ip_info(event.source_ip)
            })
        
        # 检查域名
        if hasattr(event, 'domain'):
            if event.domain in self.ioc_database.malicious_domains:
                matches.append({
                    'type': 'malicious_domain',
                    'ioc': event.domain,
                    'threat_info': self.ioc_database.get_domain_info(event.domain)
                })
        
        # 检查文件哈希
        if hasattr(event, 'file_hash'):
            if event.file_hash in self.ioc_database.malicious_hashes:
                matches.append({
                    'type': 'malicious_file',
                    'ioc': event.file_hash,
                    'threat_info': self.ioc_database.get_hash_info(event.file_hash)
                })
        
        return matches

class SOARSystem:
    def __init__(self):
        self.playbooks = {}
        self.action_library = ActionLibrary()
        self.incident_queue = IncidentQueue()
    
    def register_playbook(self, playbook_name, playbook):
        """
        注册响应剧本
        """
        self.playbooks[playbook_name] = playbook
    
    def handle_incident(self, incident):
        """
        处理安全事件
        """
        # 分类事件
        incident_type = self.classify_incident(incident)
        
        # 选择剧本
        playbook_name = self.select_playbook(incident_type)
        playbook = self.playbooks.get(playbook_name)
        
        if not playbook:
            # 没有预定义剧本，升级到人工
            self.escalate_to_human(incident)
            return
        
        # 执行剧本
        execution_result = self.execute_playbook(playbook, incident)
        
        # 记录结果
        self.log_execution(incident, playbook_name, execution_result)
        
        return execution_result
    
    def execute_playbook(self, playbook, incident):
        """
        执行响应剧本
        """
        context = {
            'incident': incident,
            'actions_taken': [],
            'results': [],
            'decisions': []
        }
        
        for step in playbook.steps:
            # 评估条件
            if step.condition and not self.evaluate_condition(step.condition, context):
                continue
            
            # 执行动作
            action = self.action_library.get_action(step.action)
            result = action.execute(context)
            
            # 更新上下文
            context['actions_taken'].append(step.action)
            context['results'].append(result)
            
            # 处理决策点
            if step.decision_point:
                decision = self.make_decision(step.decision_point, context)
                context['decisions'].append(decision)
                
                if decision == 'escalate':
                    self.escalate_to_human(incident, context)
                    break
            
            # 检查是否应该停止
            if self.should_stop_playbook(context):
                break
        
        return context
    
    def classify_incident(self, incident):
        """
        分类安全事件
        """
        features = self.extract_features(incident)
        
        # 使用 ML 模型分类
        incident_type = self.classification_model.predict(features)
        
        # 基于规则的补充分类
        if incident.severity == 'critical':
            incident_type = f"critical_{incident_type}"
        
        return incident_type

class ActionLibrary:
    def __init__(self):
        self.actions = {
            'block_ip': BlockIPAction(),
            'disable_account': DisableAccountAction(),
            'isolate_system': IsolateSystemAction(),
            'collect_forensics': CollectForensicsAction(),
            'notify_team': NotifyTeamAction(),
            'create_ticket': CreateTicketAction(),
            'quarantine_file': QuarantineFileAction(),
            'reset_credentials': ResetCredentialsAction(),
            'enable_mfa': EnableMFAAction(),
            'backup_data': BackupDataAction()
        }
    
    def get_action(self, action_name):
        """
        获取动作
        """
        return self.actions.get(action_name)
    
    def register_action(self, action_name, action):
        """
        注册新动作
        """
        self.actions[action_name] = action


class BlockIPAction:
    def execute(self, context):
        """
        阻止 IP 地址
        """
        incident = context['incident']
        ip_address = incident.source_ip
        
        # 添加到防火墙黑名单
        firewall = FirewallClient()
        firewall.add_to_blacklist(ip_address, reason=incident.id)
        
        # 添加到 WAF
        waf = WAFClient()
        waf.block_ip(ip_address)
        
        # 记录动作
        return {
            'action': 'block_ip',
            'ip_address': ip_address,
            'success': True,
            'timestamp': datetime.now()
        }


class DisableAccountAction:
    def execute(self, context):
        """
        禁用账户
        """
        incident = context['incident']
        account_id = incident.account_id
        
        # 禁用账户
        identity_provider = IdentityProviderClient()
        identity_provider.disable_account(account_id)
        
        # 终止所有活动会话
        session_manager = SessionManagerClient()
        session_manager.terminate_user_sessions(account_id)
        
        # 撤销所有 API 令牌
        api_manager = APIManagerClient()
        api_manager.revoke_user_tokens(account_id)
        
        # 发送通知
        notification_service = NotificationServiceClient()
        notification_service.notify_account_disabled(account_id)
        
        return {
            'action': 'disable_account',
            'account_id': account_id,
            'success': True,
            'timestamp': datetime.now()
        }


class IsolateSystemAction:
    def execute(self, context):
        """
        隔离系统
        """
        incident = context['incident']
        system_id = incident.system_id
        
        # 网络隔离
        network_controller = NetworkControllerClient()
        network_controller.isolate_system(system_id)
        
        # 快照当前状态
        snapshot_service = SnapshotServiceClient()
        snapshot_id = snapshot_service.create_snapshot(system_id)
        
        # 收集内存转储
        forensics_service = ForensicsServiceClient()
        forensics_service.collect_memory_dump(system_id)
        
        return {
            'action': 'isolate_system',
            'system_id': system_id,
            'snapshot_id': snapshot_id,
            'success': True,
            'timestamp': datetime.now()
        }

class UserEntityBehaviorAnalytics:
    def __init__(self):
        self.user_profiles = {}
        self.entity_profiles = {}
        self.peer_groups = {}
        
        self.models = {
            'login_behavior': LoginBehaviorModel(),
            'data_access': DataAccessModel(),
            'resource_usage': ResourceUsageModel(),
            'network_activity': NetworkActivityModel()
        }
    
    def build_user_profile(self, user_id, historical_data):
        """
        构建用户行为档案
        """
        profile = {
            'user_id': user_id,
            'typical_login_times': self.analyze_login_times(historical_data),
            'typical_locations': self.analyze_locations(historical_data),
            'typical_devices': self.analyze_devices(historical_data),
            'typical_access_patterns': self.analyze_access_patterns(historical_data),
            'peer_group': self.assign_peer_group(user_id),
            'risk_baseline': self.calculate_risk_baseline(historical_data)
        }
        
        self.user_profiles[user_id] = profile
        return profile
    
    def detect_behavioral_anomalies(self, user_id, current_activity):
        """
        检测行为异常
        """
        profile = self.user_profiles.get(user_id)
        if not profile:
            return []
        
        anomalies = []
        
        # 登录时间异常
        login_time = current_activity.timestamp.hour
        if login_time not in profile['typical_login_times']:
            anomalies.append({
                'type': 'unusual_login_time',
                'severity': 'medium',
                'details': f'用户在异常时间登录: {login_time}:00'
            })
        
        # 地理位置异常
        location = current_activity.location
        if location not in profile['typical_locations']:
            anomalies.append({
                'type': 'unusual_location',
                'severity': 'high',
                'details': f'用户从异常位置登录: {location}'
            })
        
        # 设备异常
        device = current_activity.device
        if device not in profile['typical_devices']:
            anomalies.append({
                'type': 'unusual_device',
                'severity': 'medium',
                'details': f'用户使用新设备: {device}'
            })
        
        # 数据访问异常
        data_access_score = self.models['data_access'].score(
            current_activity, 
            profile
        )
        if data_access_score > 0.8:
            anomalies.append({
                'type': 'unusual_data_access',
                'severity': 'high',
                'details': '异常的数据访问模式',
                'score': data_access_score
            })
        
        # 与同组用户比较
        peer_comparison = self.compare_to_peers(user_id, current_activity)
        if peer_comparison['deviation'] > 2.0:  # 2 个标准差
            anomalies.append({
                'type': 'peer_deviation',
                'severity': 'medium',
                'details': f'行为与同组用户显著不同: {peer_comparison["deviation"]:.2f} 标准差'
            })
        
        return anomalies
    
    def compare_to_peers(self, user_id, activity):
        """
        与同组用户比较
        """
        profile = self.user_profiles[user_id]
        peer_group = profile['peer_group']
        
        # 获取同组用户的活动
        peer_activities = self.get_peer_activities(peer_group, activity.type)
        
        # 计算统计指标
        peer_mean = np.mean([self.calculate_activity_score(a) for a in peer_activities])
        peer_std = np.std([self.calculate_activity_score(a) for a in peer_activities])
        
        # 计算当前用户的偏差
        user_score = self.calculate_activity_score(activity)
        deviation = (user_score - peer_mean) / peer_std if peer_std > 0 else 0
        
        return {
            'user_score': user_score,
            'peer_mean': peer_mean,
            'peer_std': peer_std,
            'deviation': deviation
        }

class MLThreatDetection:
    def __init__(self):
        self.models = {
            'supervised': self.load_supervised_models(),
            'unsupervised': self.load_unsupervised_models(),
            'deep_learning': self.load_deep_learning_models()
        }
        
        self.feature_extractors = FeatureExtractors()
    
    def load_supervised_models(self):
        """
        加载监督学习模型
        """
        return {
            'malware_detection': MalwareDetectionModel(),
            'phishing_detection': PhishingDetectionModel(),
            'intrusion_detection': IntrusionDetectionModel(),
            'fraud_detection': FraudDetectionModel()
        }
    
    def load_unsupervised_models(self):
        """
        加载无监督学习模型
        """
        return {
            'anomaly_detection': IsolationForest(n_estimators=100),
            'clustering': DBSCAN(eps=0.5, min_samples=5),
            'autoencoder': Autoencoder(latent_dim=64)
        }
    
    def load_deep_learning_models(self):
        """
        加载深度学习模型
        """
        return {
            'sequence_model': LSTMThreatDetector(),
            'graph_model': GCNThreatDetector(),
            'attention_model': TransformerThreatDetector()
        }
    
    def detect_threats(self, event):
        """
        使用多种 ML 模型检测威胁
        """
        # 提取特征
        features = self.feature_extractors.extract(event)
        
        # 监督模型预测
        supervised_predictions = {}
        for model_name, model in self.models['supervised'].items():
            prediction = model.predict(features)
            probability = model.predict_proba(features)
            supervised_predictions[model_name] = {
                'prediction': prediction,
                'probability': probability
            }
        
        # 无监督模型异常检测
        anomaly_score = self.models['unsupervised']['anomaly_detection'].score_samples(
            features.reshape(1, -1)
        )[0]
        
        # 深度学习模型
        sequence_score = self.models['deep_learning']['sequence_model'].predict(
            event.sequence
        )
        
        # 集成所有预测
        threat_score = self.ensemble_predictions(
            supervised_predictions,
            anomaly_score,
            sequence_score
        )
        
        # 生成解释
        explanation = self.generate_explanation(
            event,
            supervised_predictions,
            anomaly_score,
            sequence_score
        )
        
        return {
            'threat_score': threat_score,
            'is_threat': threat_score > 0.7,
            'predictions': supervised_predictions,
            'anomaly_score': anomaly_score,
            'sequence_score': sequence_score,
            'explanation': explanation
        }
    
    def ensemble_predictions(self, supervised, anomaly_score, sequence_score):
        """
        集成多个模型的预测
        """
        weights = {
            'supervised': 0.5,
            'anomaly': 0.3,
            'sequence': 0.2
        }
        
        # 监督模型的平均概率
        supervised_avg = np.mean([
            pred['probability'][1] for pred in supervised.values()
        ])
        
        # 异常分数转换为概率
        anomaly_prob = 1 - anomaly_score  # Isolation Forest 返回异常分数
        
        # 序列模型分数
        sequence_prob = sequence_score
        
        # 加权平均
        ensemble_score = (
            weights['supervised'] * supervised_avg +
            weights['anomaly'] * anomaly_prob +
            weights['sequence'] * sequence_prob
        )
        
        return ensemble_score
    
    def generate_explanation(self, event, supervised, anomaly_score, sequence_score):
        """
        生成威胁检测的解释
        """
        explanation = []
        
        # 找出最重要的因素
        for model_name, pred in supervised.items():
            if pred['probability'][1] > 0.7:
                features = self.models['supervised'][model_name].get_important_features(
                    event
                )
                explanation.append({
                    'model': model_name,
                    'confidence': pred['probability'][1],
                    'important_features': features
                })
        
        # 异常检测解释
        if anomaly_score < -0.5:
            explanation.append({
                'model': 'anomaly_detection',
                'confidence': 1 - anomaly_score,
                'reason': '行为与正常模式显著不同'
            })
        
        return explanation

class GraphNeuralNetworkDetector:
    def __init__(self):
        self.graph_builder = GraphBuilder()
        self.gnn_model = GCNThreatModel()
        self.node_embeddings = {}
    
    def build_threat_graph(self, events):
        """
        构建威胁图
        """
        graph = {
            'nodes': [],
            'edges': []
        }
        
        # 添加实体节点
        for event in events:
            # 用户节点
            if event.user_id not in [n['id'] for n in graph['nodes']]:
                graph['nodes'].append({
                    'id': event.user_id,
                    'type': 'user',
                    'features': self.extract_user_features(event.user_id)
                })
            
            # IP 节点
            if event.source_ip not in [n['id'] for n in graph['nodes']]:
                graph['nodes'].append({
                    'id': event.source_ip,
                    'type': 'ip',
                    'features': self.extract_ip_features(event.source_ip)
                })
            
            # 资源节点
            if event.resource_id not in [n['id'] for n in graph['nodes']]:
                graph['nodes'].append({
                    'id': event.resource_id,
                    'type': 'resource',
                    'features': self.extract_resource_features(event.resource_id)
                })
            
            # 添加边
            graph['edges'].append({
                'source': event.user_id,
                'target': event.resource_id,
                'type': 'access',
                'features': self.extract_edge_features(event)
            })
            
            graph['edges'].append({
                'source': event.user_id,
                'target': event.source_ip,
                'type': 'login_from',
                'features': {'timestamp': event.timestamp}
            })
        
        return graph
    
    def detect_threat_communities(self, graph):
        """
        检测威胁社区
        """
        # 使用 GNN 学习节点嵌入
        embeddings = self.gnn_model.learn_embeddings(graph)
        
        # 社区检测
        communities = self.detect_communities(embeddings)
        
        # 识别可疑社区
        suspicious_communities = []
        for community in communities:
            risk_score = self.calculate_community_risk(community, graph)
            if risk_score > 0.7:
                suspicious_communities.append({
                    'community': community,
                    'risk_score': risk_score,
                    'members': [node['id'] for node in community]
                })
        
        return suspicious_communities
    
    def detect_lateral_movement(self, graph):
        """
        检测横向移动
        """
        # 寻找异常的访问路径
        paths = self.find_suspicious_paths(graph)
        
        lateral_movements = []
        for path in paths:
            # 检查路径特征
            if self.is_lateral_movement(path):
                lateral_movements.append({
                    'path': path,
                    'confidence': self.calculate_lateral_movement_confidence(path),
                    'indicators': self.identify_lateral_movement_indicators(path)
                })
        
        return lateral_movements

class IntelligentAlertManagement:
    def __init__(self):
        self.alert_correlation = AlertCorrelationEngine()
        self.alert_prioritization = AlertPrioritizationModel()
        self.false_positive_detector = FalsePositiveDetector()
        self.alert_enrichment = AlertEnrichmentService()
    
    def process_alert(self, alert):
        """
        处理安全告警
        """
        # 1. 丰富告警信息
        enriched_alert = self.alert_enrichment.enrich(alert)
        
        # 2. 检测误报
        if self.false_positive_detector.is_false_positive(enriched_alert):
            self.log_false_positive(enriched_alert)
            return None
        
        # 3. 关联相关告警
        correlated_alerts = self.alert_correlation.correlate(enriched_alert)
        
        # 4. 优先级排序
        priority = self.alert_prioritization.calculate_priority(
            enriched_alert,
            correlated_alerts
        )
        
        # 5. 分配给分析师
        if priority >= 7:  # 高优先级
            self.assign_to_senior_analyst(enriched_alert, priority)
        elif priority >= 4:  # 中优先级
            self.assign_to_analyst(enriched_alert, priority)
        else:  # 低优先级
            self.add_to_queue(enriched_alert, priority)
        
        return {
            'alert': enriched_alert,
            'priority': priority,
            'correlated_alerts': correlated_alerts
        }
    
    def correlate_alerts(self, alerts):
        """
        关联相关告警
        """
        # 基于时间窗口
        time_correlated = self.correlate_by_time(alerts, window_minutes=30)
        
        # 基于实体
        entity_correlated = self.correlate_by_entity(alerts)
        
        # 基于攻击模式
        pattern_correlated = self.correlate_by_attack_pattern(alerts)
        
        # 合并关联
        all_correlations = self.merge_correlations(
            time_correlated,
            entity_correlated,
            pattern_correlated
        )
        
        return all_correlations

class AutomatedForensics:
    def __init__(self):
        self.evidence_collectors = {
            'logs': LogCollector(),
            'network': NetworkCollector(),
            'memory': MemoryCollector(),
            'disk': DiskCollector()
        }
        
        self.analysis_tools = {
            'timeline': TimelineAnalyzer(),
            'correlation': CorrelationAnalyzer(),
            'malware': MalwareAnalyzer(),
            'behavior': BehaviorAnalyzer()
        }
    
    def conduct_forensics(self, incident):
        """
        进行自动化取证
        """
        # 1. 收集证据
        evidence = self.collect_evidence(incident)
        
        # 2. 分析证据
        analysis_results = self.analyze_evidence(evidence)
        
        # 3. 重建时间线
        timeline = self.reconstruct_timeline(evidence)
        
        # 4. 识别攻击者行为
        attacker_behavior = self.identify_attacker_behavior(
            evidence,
            analysis_results
        )
        
        # 5. 生成报告
        report = self.generate_forensic_report(
            incident,
            evidence,
            analysis_results,
            timeline,
            attacker_behavior
        )
        
        return report
    
    def collect_evidence(self, incident):
        """
        收集证据
        """
        evidence = {}
        
        # 日志证据
        evidence['logs'] = self.evidence_collectors['logs'].collect(
            incident.affected_systems,
            time_range=incident.time_range
        )
        
        # 网络证据
        evidence['network'] = self.evidence_collectors['network'].collect(
            incident.network_segments,
            time_range=incident.time_range
        )
        
        # 内存证据
        if incident.requires_memory_analysis:
            evidence['memory'] = self.evidence_collectors['memory'].collect(
                incident.affected_systems
            )
        
        # 磁盘证据
        if incident.requires_disk_analysis:
            evidence['disk'] = self.evidence_collectors['disk'].collect(
                incident.affected_systems
            )
        
        return evidence
    
    def reconstruct_timeline(self, evidence):
        """
        重建事件时间线
        """
        events = []
        
        # 从日志中提取事件
        for log_event in evidence['logs']:
            events.append({
                'timestamp': log_event.timestamp,
                'type': 'log',
                'source': log_event.source,
                'details': log_event.details
            })
        
        # 从网络数据中提取事件
        for network_event in evidence['network']:
            events.append({
                'timestamp': network_event.timestamp,
                'type': 'network',
                'source': network_event.source_ip,
                'target': network_event.destination_ip,
                'details': network_event.details
            })
        
        # 按时间排序
        events.sort(key=lambda x: x['timestamp'])
        
        # 识别关键事件
        key_events = self.identify_key_events(events)
        
        return {
            'full_timeline': events,
            'key_events': key_events,
            'duration': self.calculate_duration(events),
            'attack_phases': self.identify_attack_phases(events)
        }

class SecureDevelopmentLifecycle:
    def __init__(self):
        self.phases = [
            'requirements',
            'design',
            'implementation',
            'testing',
            'deployment',
            'maintenance'
        ]
        
        self.security_activities = {
            'requirements': [
                '定义安全需求',
                '识别合规要求',
                '进行威胁建模'
            ],
            'design': [
                '安全架构审查',
                '攻击面分析',
                '安全设计模式'
            ],
            'implementation': [
                '安全编码标准',
                '代码审查',
                '静态分析'
            ],
            'testing': [
                '动态分析',
                '渗透测试',
                '模糊测试'
            ],
            'deployment': [
                '安全配置审查',
                '部署前扫描',
                '安全基线验证'
            ],
            'maintenance': [
                '持续监控',
                '漏洞管理',
                '安全更新'
            ]
        }
    
    def enforce_sdl(self, project):
        """
        执行安全开发生命周期
        """
        for phase in self.phases:
            # 检查安全活动是否完成
            activities = self.security_activities[phase]
            completed = self.check_activities_completion(project, phase, activities)
            
            if not all(completed.values()):
                # 阻止进入下一阶段
                incomplete = [act for act, done in completed.items() if not done]
                raise SDLViolation(
                    f"Phase {phase} incomplete. Missing: {incomplete}"
                )
            
            # 记录完成情况
            self.log_phase_completion(project, phase, completed)

class VulnerabilityManagement:
    def __init__(self):
        self.scanners = {
            'static': StaticAnalysisScanner(),
            'dynamic': DynamicAnalysisScanner(),
            'dependency': DependencyScanner(),
            'container': ContainerScanner()
        }
        
        self.vulnerability_database = VulnerabilityDatabase()
        self.risk_calculator = RiskCalculator()
    
    def scan_for_vulnerabilities(self, application):
        """
        扫描漏洞
        """
        vulnerabilities = []
        
        # 静态分析
        static_vulns = self.scanners['static'].scan(application.code)
        vulnerabilities.extend(static_vulns)
        
        # 动态分析
        dynamic_vulns = self.scanners['dynamic'].scan(application.url)
        vulnerabilities.extend(dynamic_vulns)
        
        # 依赖项扫描
        dependency_vulns = self.scanners['dependency'].scan(application.dependencies)
        vulnerabilities.extend(dependency_vulns)
        
        # 容器扫描
        if application.uses_containers:
            container_vulns = self.scanners['container'].scan(application.containers)
            vulnerabilities.extend(container_vulns)
        
        # 计算风险
        for vuln in vulnerabilities:
            vuln.risk_score = self.risk_calculator.calculate_risk(vuln)
        
        # 按风险排序
        vulnerabilities.sort(key=lambda v: v.risk_score, reverse=True)
        
        return vulnerabilities
    
    def prioritize_remediation(self, vulnerabilities):
        """
        优先修复漏洞
        """
        prioritized = []
        
        for vuln in vulnerabilities:
            priority = self.calculate_remediation_priority(vuln)
            
            prioritized.append({
                'vulnerability': vuln,
                'priority': priority,
                'estimated_effort': self.estimate_effort(vuln),
                'recommended_action': self.recommend_action(vuln),
                'deadline': self.calculate_deadline(priority)
            })
        
        return prioritized