Advanced threat intelligence integration and fusion engine
| 80 | |
| 81 | |
| 82 | class ThreatIntelligenceFusion: |
| 83 | """Advanced threat intelligence integration and fusion engine""" |
| 84 | |
| 85 | def __init__(self, shared_data): |
| 86 | self.shared_data = shared_data |
| 87 | self.logger = Logger(name="ThreatIntelligence", level=logging.INFO) |
| 88 | |
| 89 | # Intelligence storage |
| 90 | self.threat_data_dir = self._resolve_threat_dir() |
| 91 | self._rebuild_file_paths() |
| 92 | |
| 93 | # Configuration |
| 94 | self.threat_sources: Dict[str, ThreatIntelligenceSource] = {} |
| 95 | self.threat_cache: Dict[str, Dict] = {} |
| 96 | self.enriched_findings: Dict[str, EnrichedFinding] = {} |
| 97 | |
| 98 | # ML and analysis components |
| 99 | self.risk_calculator = DynamicRiskCalculator() |
| 100 | self.attribution_engine = ThreatAttributionEngine() |
| 101 | self.prediction_engine = ThreatPredictionEngine() |
| 102 | self.campaign_tracker = CampaignTracker() |
| 103 | |
| 104 | # Background processing |
| 105 | self.intelligence_thread = None |
| 106 | self.should_stop = False |
| 107 | |
| 108 | # Initialize the system |
| 109 | self.setup_intelligence_system() |
| 110 | |
| 111 | def _resolve_threat_dir(self) -> str: |
| 112 | candidate = getattr(self.shared_data, 'network_threat_dir', None) |
| 113 | if candidate: |
| 114 | return candidate |
| 115 | return os.path.join(self.shared_data.datadir, 'threat_intelligence') |
| 116 | |
| 117 | def _rebuild_file_paths(self): |
| 118 | self.sources_config_file = os.path.join(self.threat_data_dir, 'sources_config.json') |
| 119 | self.threat_cache_file = os.path.join(self.threat_data_dir, 'threat_cache.json') |
| 120 | self.enriched_findings_file = os.path.join(self.threat_data_dir, 'enriched_findings.json') |
| 121 | |
| 122 | def set_storage_root(self, threat_dir: str): |
| 123 | """Switch threat intelligence storage when network changes.""" |
| 124 | if not threat_dir or threat_dir == self.threat_data_dir: |
| 125 | return |
| 126 | self.persist_state() |
| 127 | self.threat_data_dir = threat_dir |
| 128 | self._rebuild_file_paths() |
| 129 | os.makedirs(self.threat_data_dir, exist_ok=True) |
| 130 | self.ensure_json_files_exist() |
| 131 | self.load_configuration() |
| 132 | self.load_threat_cache() |
| 133 | self.load_enriched_findings() |
| 134 | self.logger.info(f"Threat intelligence storage switched to: {self.threat_data_dir}") |
| 135 | |
| 136 | def persist_state(self): |
| 137 | """Persist caches before switching networks.""" |
| 138 | try: |
| 139 | self.save_threat_cache() |