Backend IDS Integration — Intrusion Detection for Backend Systems

// Host-based intrusion detection
class HostIDS {
  constructor() {
    this.baselines = new Map();
    this.anomalyThreshold = 3;  // Standard deviations
  }

  async establishBaseline() {
    // CPU, memory, network, file access patterns
    this.baselines.set('cpu', await this.sampleMetric('cpu'));
    this.baselines.set('memory', await this.sampleMetric('memory'));
    this.baselines.set('fileAccess', await this.sampleMetric('fileAccess'));
    this.baselines.set('networkConnections', await this.sampleMetric('networkConnections'));
  }

  async sampleMetric(metric) {
    const samples = [];
    for (let i = 0; i < 10; i++) {
      samples.push(await this.getMetric(metric));
      await delay(1000);
    }
    const mean = samples.reduce((a, b) => a + b, 0) / samples.length;
    const variance = samples.reduce((a, b) => a + Math.pow(b - mean, 2), 0) / samples.length;
    return { mean, stdDev: Math.sqrt(variance) };
  }

  async checkAnomalies() {
    const anomalies = [];

    for (const [metric, baseline] of this.baselines) {
      const current = await this.getMetric(metric);
      const deviation = Math.abs(current - baseline.mean) / baseline.stdDev;

      if (deviation > this.anomalyThreshold) {
        anomalies.push({
          metric,
          current,
          expected: baseline.mean,
          deviation: deviation.toFixed(2),
          timestamp: new Date().toISOString()
        });
      }
    }

    return anomalies;
  }

  async getMetric(metric) {
    switch (metric) {
      case 'cpu': return os.loadavg()[0];
      case 'memory': return process.memoryUsage().heapUsed / 1024 / 1024;
      case 'networkConnections': {
        // Count active connections
        const connections = await exec('ss -tun | tail -n +2 | wc -l');
        return parseInt(connections.stdout);
      }
      default: return 0;
    }
  }
}

// Network-based IDS integration
app.use(async (req, res, next) => {
  // Check against known threat intel
  const ipReputation = await threatIntel.checkIP(req.ip);
  if (ipReputation.malicious) {
    logger.warn('Known malicious IP detected', { ip: req.ip, threat: ipReputation });
    return res.status(403).json({ error: 'Access denied' });
  }

  // Rate anomaly detection
  const requestRate = await rateTracker.getRate(req.ip);
  if (requestRate > baselineRate * 3) {
    logger.warn('Abnormal request rate detected', { ip: req.ip, rate: requestRate });
  }

  next();
});