Backend Security Monitoring — Real-Time Security Monitoring for Backends

// Security monitoring engine
class SecurityMonitor {
  constructor() {
    this.rules = [];
    this.eventStore = [];
    this.alertThreshold = 5;  // Alerts per minute
    this.alertCount = 0;
    this.alertResetInterval = 60000;
    this.setupAlertThrottle();
  }

  addRule(rule) {
    this.rules.push({
      name: rule.name,
      evaluate: rule.evaluate,
      severity: rule.severity || 'medium',
      action: rule.action || 'log'
    });
  }

  async processEvent(event) {
    this.eventStore.push({ ...event, timestamp: Date.now() });

    for (const rule of this.rules) {
      if (rule.evaluate(event, this.eventStore)) {
        await this.handleMatch(rule, event);
      }
    }

    // Cleanup old events
    this.eventStore = this.eventStore.filter(e => Date.now() - e.timestamp < 3600000);
  }

  async handleMatch(rule, event) {
    const alert = {
      rule: rule.name,
      severity: rule.severity,
      event,
      timestamp: new Date().toISOString(),
      correlationId: event.correlationId
    };

    logger.warn(`Security rule matched: ${rule.name}`, alert);

    if (rule.action === 'block') {
      await this.blockSource(event);
    }

    if (rule.severity === 'high' || rule.severity === 'critical') {
      if (this.alertCount < this.alertThreshold) {
        await alertService.send(alert);
        this.alertCount++;
      }
    }
  }

  setupAlertThrottle() {
    setInterval(() => { this.alertCount = 0; }, this.alertResetInterval);
  }

  async blockSource(event) {
    const ip = event.ip;
    await redis.setex(`blocked:${ip}`, 3600, 'true');
    // Update WAF rules
    await wafApi.addBlockRule(ip);
  }
}

// Security monitoring rules
const monitor = new SecurityMonitor();

monitor.addRule({
  name: 'Multiple Failed Logins',
  severity: 'medium',
  action: 'block',
  evaluate: (event, history) => {
    if (event.type !== 'login_failed') return false;
    const recent = history.filter(e =>
      e.type === 'login_failed' &&
      e.ip === event.ip &&
      Date.now() - e.timestamp < 300000
    );
    return recent.length >= 5;
  }
});

monitor.addRule({
  name: 'Suspicious Payload',
  severity: 'high',
  evaluate: (event) => {
    const suspicious = /('|--|;|<script|\.\.\/)/i.test(event.payload || '');
    return suspicious;
  }
});