MemScan-EDR/src-csharp/MemScanEDR/Models/MemoryFeatures.cs

using System;
using System.Collections.Generic;

namespace MemScanEDR.Models;

/// <summary>
/// AI 输入特征向量 —— 从进程内存提取的全部多维特征
/// 作为无监督基线检测和监督分类的输入
/// </summary>
public class MemoryFeatures
{
    // ========== 一、进程元数据特征 ==========

    /// <summary>进程名</summary>
    public string ProcessName { get; set; } = "";

    /// <summary>原始镜像路径</summary>
    public string ExePath { get; set; } = "";

    /// <summary>父进程 PID</summary>
    public int ParentPid { get; set; }

    /// <summary>父进程名</summary>
    public string ParentName { get; set; } = "";

    /// <summary>命令行</summary>
    public string CmdLine { get; set; } = "";

    /// <summary>启动时间</summary>
    public DateTime StartTime { get; set; }

    /// <summary>工作集大小 (MB)</summary>
    public long WorkingSetMB { get; set; }

    /// <summary>线程数</summary>
    public int ThreadCount { get; set; }

    /// <summary>是否已签名</summary>
    public bool IsSigned { get; set; }

    /// <summary>签名者</summary>
    public string Signer { get; set; } = "";

    /// <summary>是否在系统路径</summary>
    public bool IsSystemPath { get; set; }

    /// <summary>是否在临时路径</summary>
    public bool IsTempPath { get; set; }

    // ========== 二、内存页权限分布特征 ==========

    /// <summary>内存区域总数</summary>
    public int TotalRegions { get; set; }

    /// <summary>只读页数 (R)</summary>
    public int ReadOnlyPages { get; set; }

    /// <summary>读写页数 (RW)</summary>
    public int ReadWritePages { get; set; }

    /// <summary>只读执行页数 (RX) —— 正常代码段</summary>
    public int ExecuteReadPages { get; set; }

    /// <summary>读写执行页数 (RWX) —— 高可疑指标</summary>
    public int ExecuteReadWritePages { get; set; }

    /// <summary>私有内存页数 (PRIVATE)</summary>
    public int PrivatePages { get; set; }

    /// <summary>映射文件页数 (MAPPED)</summary>
    public int MappedPages { get; set; }

    /// <summary>磁盘镜像页数 (IMAGE)</summary>
    public int ImagePages { get; set; }

    /// <summary>无文件匿名可执行内存页数 (PRIVATE + EXECUTE 且非 IMAGE)</summary>
    public int AnonymousExecPages { get; set; }

    /// <summary>RWX私有页数量 (恶意注入核心标志)</summary>
    public int RwxPrivatePages { get; set; }

    /// <summary>RWX页总大小 (bytes)</summary>
    public ulong RwxTotalSize { get; set; }

    // ========== 三、内存代码特征 ==========

    /// <summary>内存中是否存在 PE 头</summary>
    public bool HasInMemoryPE { get; set; }

    /// <summary>内存PE与磁盘是否不一致 (Process Hollowing 标志)</summary>
    public bool PeMismatchDisk { get; set; }

    /// <summary>检测到的可疑API字符串</summary>
    public List<string> SuspiciousApiStrings { get; set; } = new();

    /// <summary>内存敏感字符串命中数</summary>
    public int SuspiciousStringHits { get; set; }

    /// <summary>检测到的内存敏感字符串样本</summary>
    public List<string> SuspiciousStrings { get; set; } = new();

    /// <summary>签名匹配数量</summary>
    public int SignatureMatchCount { get; set; }

    /// <summary>高危签名匹配数</summary>
    public int HighSeverityMatches { get; set; }

    // ========== 四、熵/字节统计特征 ==========

    /// <summary>代码段平均熵值 (0-8)</summary>
    public double AvgCodeEntropy { get; set; }

    /// <summary>最高熵值</summary>
    public double MaxEntropy { get; set; }

    /// <summary>高熵区域数量 (熵 > 7.0)</summary>
    public int HighEntropyRegions { get; set; }

    /// <summary>高熵区域总大小</summary>
    public ulong HighEntropyTotalSize { get; set; }

    /// <summary>熵值标准差 (均匀性指标)</summary>
    public double EntropyStdDev { get; set; }

    // ========== 五、网络行为特征 ==========

    /// <summary>网络连接数</summary>
    public int ConnectionCount { get; set; }

    /// <summary>监听端口数</summary>
    public int ListeningPorts { get; set; }

    /// <summary>出站连接到非标准端口数</summary>
    public int NonStandardPortConnections { get; set; }

    /// <summary>可疑端口连接数 (4444, 1337 等)</summary>
    public int SuspiciousPortConnections { get; set; }

    /// <summary>连接到境外IP数 (简化：非私有IP)</summary>
    public int ForeignConnections { get; set; }

    // ========== 六、进程树关系特征 ==========

    /// <summary>是否为系统关键进程名</summary>
    public bool IsSystemProcessName { get; set; }

    /// <summary>父进程是否合法</summary>
    public bool HasLegitimateParent { get; set; }

    /// <summary>进程树深度</summary>
    public int ProcessTreeDepth { get; set; }

    // ========== 七、DLL加载特征 ==========

    /// <summary>已加载模块数量</summary>
    public int LoadedModuleCount { get; set; }

    /// <summary>无磁盘路径模块数</summary>
    public int UnmappedModules { get; set; }

    /// <summary>从临时目录加载的模块数</summary>
    public int TempPathModules { get; set; }

    // ========== 辅助方法 ==========

    /// <summary>
    /// 将特征向量转为数值数组，用于 AI 模型输入
    /// 特征顺序必须与训练时一致
    /// </summary>
    public double[] ToFeatureVector()
    {
        return new double[]
        {
            // 进程元数据 (9维)
            IsSigned ? 1.0 : 0.0,
            IsSystemPath ? 1.0 : 0.0,
            IsTempPath ? 1.0 : 0.0,
            WorkingSetMB,
            ThreadCount,
            IsSystemProcessName ? 1.0 : 0.0,
            HasLegitimateParent ? 1.0 : 0.0,
            ProcessTreeDepth,
            StartTime != default ? (DateTime.Now - StartTime).TotalHours : 0,

            // 内存页权限分布 (7维)
            TotalRegions,
            ReadOnlyPages / Math.Max(TotalRegions, 1.0),
            ReadWritePages / Math.Max(TotalRegions, 1.0),
            ExecuteReadPages / Math.Max(TotalRegions, 1.0),
            ExecuteReadWritePages / Math.Max(TotalRegions, 1.0),
            AnonymousExecPages / Math.Max(TotalRegions, 1.0),
            RwxPrivatePages,

            // 内存类型分布 (3维)
            PrivatePages / Math.Max(TotalRegions, 1.0),
            MappedPages / Math.Max(TotalRegions, 1.0),
            ImagePages / Math.Max(TotalRegions, 1.0),

            // 代码特征 (6维)
            HasInMemoryPE ? 1.0 : 0.0,
            PeMismatchDisk ? 1.0 : 0.0,
            SuspiciousApiStrings.Count,
            SuspiciousStringHits,
            SignatureMatchCount,
            HighSeverityMatches,

            // 熵特征 (4维)
            AvgCodeEntropy / 8.0, // 归一化到 [0,1]
            MaxEntropy / 8.0,
            HighEntropyRegions,
            EntropyStdDev / 4.0,

            // 网络特征 (5维)
            ConnectionCount,
            ListeningPorts,
            NonStandardPortConnections,
            SuspiciousPortConnections,
            ForeignConnections,

            // DLL加载特征 (3维)
            LoadedModuleCount,
            UnmappedModules,
            TempPathModules
        };
    }

    /// <summary>特征向量维度</summary>
    public static int FeatureDimension => 40;
}