In memory storage backend for rate limiting. Thread safe through asyncio locks. Suitable for single instance deployments, development, a

Main rate limiter class for FastAPI applications. Usage: limiter = RateLimiter() @app.get("/api/data") @limiter.lim

A single detection rule combining regex, validation, and context

Where a finding was detected

Evaluates events against detection rules

Caesar cipher implementation with configurable shift key and alphabet support

Builds BPF filter expressions for efficient kernel-level packet filtering

Result of a rate limit check operation

A single rate limit rule defining requests allowed per time window

Root configuration model for the DLP scanner

Symmetric autoencoder for HTTP request anomaly detection. Architecture (35-dim input): Encoder: 35 → 24 → 12 → 6 (bottleneck)

Extract and normalize client IP addresses Handles IPv6 /64 prefix normalization since users control entire /64 prefixes (~18 quintillion

A piece of extracted text with its source location

Represents a single keyboard event

Raised when the vault file is unreadable or has unexpected fields

Combines multiple fingerprinting methods based on configuration Preset levels determine which extractors are used: - strict: All methods

IQR-based feature scaler persisted as JSON (not pickle). Wraps sklearn RobustScaler for outlier-robust normalization. Used only for auto

Extract authentication identifiers from requests Supports JWT tokens, API keys in headers/query params, and session-based authentication

Excel metadata handler for Excel files. Handles extraction and removal of document properties from Excel workbooks including author, tit

ONNX-based inference engine for the 3-model ML ensemble. Loads autoencoder, random forest, and isolation forest ONNX sessions from a mod

Runtime configuration for keylogger behavior

PowerPoint metadata handler for presentation files. Handles extraction and removal of document properties from PowerPoint presentations

Main rate limiter settings with environment variable support

Fixed window counter algorithm Simple implementation but suffers from boundary burst problem: clients can make 2x the limit by timing re

Extract fingerprint data from HTTP headers Header ordering is browser-specific and not user-configurable, making it useful for fingerpri

PDF metadata handler for PDF files. Handles extraction and removal of document information from PDF files including author, creator, tit

Raised when a program is not found

Sliding window counter algorithm The recommended default for production rate limiting. Achieves ~99.997% accuracy with O(1) memory per c

Word document metadata handler for .docx files. Handles extraction and removal of document properties from Word documents including auth

Tracks and reassembles network flows from packets

Aggregated results from a complete scan run

Token bucket algorithm Allows controlled bursting up to bucket capacity while enforcing average rate limits. Tokens refill at a constant

End-to-end training pipeline that splits data, trains all 3 models, exports to ONNX, validates the ensemble, and logs to MLflow

Raised when database operation fails

Metadata for a single detection rule

A fully scored and classified detection result

One possible identification of a hash string `frozen=True` makes the dataclass immutable — once created, its fields cannot change. `slot

Metadata handler for image files (JPEG, PNG). Implements the MetadataHandler interface using format-specific processors to read, wipe, a

Raised when no metadata is found in a file.

SARIF 2.1.0 output for CI/CD integration

Raised when a report is not found

Schema for creating a new test result (used by scanners)

Raised when attempting to process an unsupported file format.

Context manager wrapping MLflow experiment runs with automatic system metadata logging

A regex based detection rule applied to the request URI

Detects DNS-based data exfiltration patterns

A single DNS query entry

Analyzes text for English language patterns using letter frequency distribution

A single security-header check `frozen=True` makes the dataclass immutable — once created, its fields cannot change. `slots=True` makes

Structured JSON report with metadata and summary

Result from a defense layer check

Raised when user tries to modify a program they don't own

SQLAlchemy Enum type that stores VALUES and handles unknown values gracefully https://blog.wrouesnel.com/posts/sqlalchemy-enums-careful-what

Raised when storage backend operations fail

State for sliding window counter algorithm

Aggregated statistics from a packet capture session

Central registry that loads, filters, and runs all detectors

File writer with automatic size-based rotation

Raised for JWT token specific errors

Public user profile data

Batched HTTP delivery of events to a remote endpoint

Raised when a request lacks valid credentials

An indicator of potential data exfiltration

Collected fingerprint data from a request

Protocol envelope wrapping all WebSocket communications

Raised when an error occurs during metadata processing.

Parsed network packet with extracted metadata

Structured representation of a single nginx access log line.

Detects sensitive data using regex patterns with optional checksum validation

Cold-start rule-based detection engine inspired by ModSecurity CRS. Scores requests using pattern matching, signature detection, and beha

Storage backend configuration

CSV export for compliance team consumption

Represents a single DNS record

A raw match from a detector before scoring

Traffic statistics for a single network endpoint

HTTP 420 response - the signature rate limit response

Fingerprinting configuration

Outcome of running one HeaderRule against the response headers Fields ------ rule The rule we evaluated. Carrying it inside

Raised when input data is invalid

Four-stage async pipeline that transforms raw log lines into scored threat candidates Stages: raw_queue -> [parse] -> parsed_que

Structured rate limit key components

Raised when a requested resource does not exist

Rate limiter scoped to specific endpoints or route groups Usage: api_limiter = ScopedRateLimiter( prefix="/api/v1",

Raised when a user is not found

Single HTTP request parsed from CSIC 2010 dataset format

Configuration for a packet capture session

Raised when a resource already exists or conflicts

Result of a DNS lookup

Scans database tables for sensitive data in text columns

Scans files in a directory tree for sensitive data

Raised when an error occurs during metadata reading.

Information extracted from a single captured packet

Orchestrates the full scan pipeline

State for token bucket algorithm

Input validation errors

Storage entry for sliding window counter.

Tracks active beacon WebSocket connections backed by SQLite persistence

Global circuit breaker state