stellar-cyber-mcp-agents/dist/agents/malware-agent.d.ts

Model Context Protocol (MCP) server for Stellar Cyber security operations with specialized multi-agent analysis capabilities

import { BaseAgent } from '../core/base-agent.js';
import { AgentMetadata, AgentRegistry, AgentCommunicationChannel, AgentLogger, AgentMetrics, AgentHealth, AgentRequest, AgentContext } from '../types/agent.js';
export interface MalwareAnalysisConfig {
    apiUrl: string;
    apiToken: string;
    analysisTimeout?: number;
    maxConcurrentAnalysis?: number;
    sandboxEnabled?: boolean;
    virusTotalApiKey?: string;
    yaraRulesPath?: string;
}
export interface MalwareAnalysisResult {
    id: string;
    caseId: string;
    timestamp: string;
    summary: {
        totalArtifacts: number;
        maliciousArtifacts: number;
        suspiciousArtifacts: number;
        cleanArtifacts: number;
        riskLevel: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
        overallVerdict: 'MALICIOUS' | 'SUSPICIOUS' | 'CLEAN' | 'UNKNOWN';
    };
    artifacts: MalwareArtifact[];
    detections: MalwareDetection[];
    families: MalwareFamily[];
    behaviors: MalwareBehavior[];
    recommendations: string[];
    iocs: string[];
    mitre: {
        tactics: string[];
        techniques: string[];
    };
}
export interface MalwareArtifact {
    id: string;
    name: string;
    type: 'file' | 'hash' | 'url' | 'domain' | 'ip' | 'email';
    value: string;
    size?: number;
    mimeType?: string;
    hashes: {
        md5?: string;
        sha1?: string;
        sha256?: string;
    };
    analysis: MalwareArtifactAnalysis;
    detectedAt: string;
    source: string;
}
export interface MalwareArtifactAnalysis {
    verdict: 'MALICIOUS' | 'SUSPICIOUS' | 'CLEAN' | 'UNKNOWN';
    confidence: number;
    engines: EngineResult[];
    signatures: string[];
    behaviors: string[];
    family?: string;
    variant?: string;
    capabilities: string[];
    persistence: PersistenceMechanism[];
    networkActivity: NetworkActivity[];
    fileOperations: FileOperation[];
    registryOperations: RegistryOperation[];
    processOperations: ProcessOperation[];
}
export interface EngineResult {
    engine: string;
    version: string;
    result: string;
    confidence: number;
    categories: string[];
    timestamp: string;
}
export interface MalwareDetection {
    id: string;
    name: string;
    type: 'signature' | 'heuristic' | 'behavioral' | 'ml' | 'yara';
    description: string;
    severity: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
    confidence: number;
    artifacts: string[];
    evidence: string[];
    rule?: string;
    engine: string;
    timestamp: string;
}
export interface MalwareFamily {
    id: string;
    name: string;
    aliases: string[];
    description: string;
    type: string;
    platforms: string[];
    capabilities: string[];
    firstSeen: string;
    lastSeen: string;
    prevalence: number;
    artifacts: string[];
    iocs: string[];
    references: string[];
}
export interface MalwareBehavior {
    id: string;
    category: string;
    action: string;
    description: string;
    severity: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
    artifacts: string[];
    indicators: string[];
    mitre: {
        tactic: string;
        technique: string;
        subtechnique?: string;
    };
    timestamp: string;
}
export interface PersistenceMechanism {
    type: string;
    location: string;
    value: string;
    description: string;
    mitreId: string;
}
export interface NetworkActivity {
    type: 'dns' | 'http' | 'tcp' | 'udp' | 'icmp';
    protocol: string;
    destination: string;
    port?: number;
    data?: string;
    purpose: string;
    suspicious: boolean;
}
export interface FileOperation {
    operation: 'create' | 'modify' | 'delete' | 'copy' | 'move' | 'read' | 'write';
    path: string;
    details: string;
    suspicious: boolean;
}
export interface RegistryOperation {
    operation: 'create' | 'modify' | 'delete' | 'read';
    key: string;
    value?: string;
    data?: string;
    purpose: string;
    suspicious: boolean;
}
export interface ProcessOperation {
    operation: 'create' | 'inject' | 'hollow' | 'migrate' | 'terminate';
    process: string;
    pid?: number;
    parentPid?: number;
    commandLine?: string;
    suspicious: boolean;
}
export interface SandboxAnalysis {
    id: string;
    artifactId: string;
    environment: string;
    duration: number;
    status: 'COMPLETED' | 'FAILED' | 'TIMEOUT' | 'ERROR';
    verdict: 'MALICIOUS' | 'SUSPICIOUS' | 'CLEAN' | 'UNKNOWN';
    confidence: number;
    behaviors: MalwareBehavior[];
    networkTraffic: NetworkActivity[];
    fileChanges: FileOperation[];
    registryChanges: RegistryOperation[];
    processActivity: ProcessOperation[];
    screenshots: string[];
    logs: string[];
}
export interface YaraMatchResult {
    rule: string;
    tags: string[];
    meta: Record<string, any>;
    strings: Array<{
        identifier: string;
        instances: Array<{
            offset: number;
            length: number;
            plaintext: string;
        }>;
    }>;
}
export declare class MalwareAnalysisAgent extends BaseAgent {
    private config;
    private activeAnalyses;
    private analysisCache;
    private yaraRules;
    private knownFamilies;
    private accessToken;
    private tokenExpiresAt;
    private refreshPromise;
    constructor(metadata: AgentMetadata, registry: AgentRegistry, channel: AgentCommunicationChannel, logger: AgentLogger, metrics: AgentMetrics, config: MalwareAnalysisConfig);
    protected onInitialize(): Promise<void>;
    protected onStart(): Promise<void>;
    protected onStop(): Promise<void>;
    protected onDestroy(): Promise<void>;
    protected onHealthCheck(): Promise<AgentHealth>;
    protected handleRequest(request: AgentRequest, context: AgentContext): Promise<any>;
    private analyzeMalware;
    private performMalwareAnalysis;
    private analyzeArtifact;
    private performStaticAnalysis;
    private performYaraScanning;
    private performVirusTotalLookup;
    private performSandboxAnalysisInternal;
    private calculateFinalVerdict;
    private calculateOverallConfidence;
    private calculateMalwareSummary;
    private generateMalwareRecommendations;
    private mapToMITRE;
    private refreshToken;
    private performTokenRefresh;
    private getAccessToken;
    private makeRequest;
    private loadYaraRules;
    private loadMalwareFamilies;
    private getKnownMalwareHashes;
    private simulateYaraMatch;
    private simulateVirusTotalLookup;
    private simulateSandboxAnalysis;
    private mapConfidenceToSeverity;
    private scanWithYara;
    private performSandboxAnalysis;
    private identifyMalwareFamily;
    private extractBehaviors;
    private generateIOCs;
    private getFamilyInfo;
    private performBulkAnalysis;
    private getAnalysisReport;
    private extractBehaviorsFromArtifact;
    private generateIOCsFromArtifact;
    private startRuleUpdates;
    private updateRules;
    private cancelActiveAnalyses;
}
export declare function createMalwareAnalysisAgentMetadata(): AgentMetadata;
//# sourceMappingURL=malware-agent.d.ts.map