using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Linq;
using System.Threading.Tasks;
using MemScanEDR.Models;

namespace MemScanEDR.Services;

/// <summary>
/// 三级联动检测管线 —— 2.0 核心编排引擎
/// 
/// 流程：
///   [快速预过滤] → [第一层: 基线异常检测] → [第二层: 监督分类] → [第三层: MITRE规则复核] → 输出
///   
/// 速度优化：
///   - 预过滤阶段不读内存，仅元数据判断，跳过 >80% 的进程
///   - 只在可疑进程上执行完整特征提取
///   - 基线匹配失败时提前退出，节省计算
/// </summary>
public class DetectionPipeline
{
    private readonly BaselineEngine _baselineEngine;
    private readonly ClassificationEngine _classificationEngine;
    private readonly RuleEngine _ruleEngine;
    private readonly FeatureExtractor _featureExtractor;
    private readonly MemoryScanner _memoryScanner;
    private readonly BaselineLibrary _baselineLibrary;

    // 扫描模式
    private readonly ScanMode _mode;

    public DetectionPipeline(ScanMode mode = ScanMode.Balanced)
    {
        _mode = mode;
        _baselineLibrary = BaselineLibrary.CreateDefault();
        _baselineEngine = new BaselineEngine(_baselineLibrary);
        _classificationEngine = new ClassificationEngine();
        _ruleEngine = new RuleEngine();
        _featureExtractor = new FeatureExtractor();
        _memoryScanner = new MemoryScanner();
    }

    /// <summary>
    /// 完整三级检测流程
    /// </summary>
    public Task<ScanResult> AnalyzeAsync(ProcessInfo proc, List<Signature> signatures)
    {
        return Task.FromResult(Analyze(proc, signatures));
    }

    /// <summary>
    /// 完整三级检测流程（同步核心）
    /// </summary>
    private ScanResult Analyze(ProcessInfo proc, List<Signature> signatures)
    {
        var sw = Stopwatch.StartNew();

        // ─── 阶段0: 快速预过滤（不读内存）───
        var memoryRegions = _memoryScanner.GetMemoryRegions(proc.Pid);
        proc.MemoryRegions = memoryRegions;
        var signatureMatches = new List<SignatureMatch>();

        var preFilterResult = QuickPreFilter(proc, memoryRegions);
        if (preFilterResult.canSkip)
        {
            return new ScanResult
            {
                Pid = proc.Pid,
                ProcessName = proc.Name,
                RiskLevel = RiskLevel.Safe,
                RiskScore = preFilterResult.score,
                Indicators = new List<string>(),
                Reasoning = preFilterResult.reason,
                AIProvider = "pipeline-v2/fast-filter",
                DetectionLayer = "PreFilter",
                ScanTime = DateTime.Now
            };
        }

        // ─── 阶段1: 内存区域扫描（轻量）───
        if (_mode != ScanMode.Fast)
        {
            var suspiciousRegions = _memoryScanner.GetSuspiciousRegions(proc.Pid);
            if (suspiciousRegions.Count > 0 || proc.IsTempPath || !proc.IsSigned)
            {
                signatureMatches = _memoryScanner.ScanProcess(proc.Pid, signatures);
            }
        }

        // ─── 阶段2: 特征提取 ───
        MemoryFeatures features;
        if (_mode == ScanMode.Fast)
        {
            features = _featureExtractor.QuickExtract(proc, memoryRegions);
        }
        else
        {
            features = _featureExtractor.Extract(proc, memoryRegions, signatureMatches, signatures);
        }

        // ─── 第一层: 无监督基线检测 ───
        var baselineResult = _baselineEngine.Analyze(features);

        // 完全匹配基线 → 直接判定为正常
        if (baselineResult.Classification == BaselineClassification.Normal &&
            baselineResult.AnomalyScore < 0.20)
        {
            return BuildSafeResult(proc, features, baselineResult, signatureMatches,
                $"第一层 | 进程内存结构完全匹配正常基线 [{baselineResult.BaselineName}] | 异常分数={baselineResult.AnomalyScore:F3}");
        }

        // ─── 第二层: 监督分类 ───
        var classificationResult = _classificationEngine.Classify(features);

        // 分类为良性 + 基线无异常 → 安全
        if (classificationResult.Classification == MalwareClass.Benign &&
            baselineResult.AnomalyScore < 0.40)
        {
            return BuildSafeResult(proc, features, baselineResult, signatureMatches,
                $"第二层 | 分类器判定良性 | {classificationResult.SuspectedFamily}");
        }

        // ─── 第三层: MITRE ATT&CK规则复核 ───
        var ruleResult = _ruleEngine.Validate(features, classificationResult, baselineResult);

        // ─── 构建最终结果 ───
        var indicators = BuildIndicators(features, baselineResult, classificationResult, ruleResult);
        var layer = DetermineDetectionLayer(baselineResult, classificationResult, ruleResult);

        return new ScanResult
        {
            Pid = proc.Pid,
            ProcessName = proc.Name,
            RiskLevel = ruleResult.FinalRiskLevel,
            RiskScore = ruleResult.CombinedScore,
            Indicators = indicators,
            Reasoning = ruleResult.Reasoning,
            Matches = signatureMatches,
            AIProvider = $"pipeline-v2/{_mode.ToString().ToLower()}",
            DetectionLayer = layer,
            ScanTime = DateTime.Now
        };
    }

    // ─── 快速预过滤 ───
    private static (bool canSkip, double score, string reason) QuickPreFilter(
        ProcessInfo proc, List<MemoryRegion> regions)
    {
        double score = 0;
        var reasons = new List<string>();

        // 已签名 + 系统路径 + 无网络 → 几乎肯定安全
        if (proc.IsSigned && proc.IsSystemPath && proc.Connections.Count == 0)
        {
            // 再检查是否有可疑内存区域
            var hasRwx = regions.Any(r =>
                r.Protect.Contains("EXECUTE_READWRITE") && r.Type == "PRIVATE");

            if (!hasRwx && !proc.IsTempPath)
            {
                return (true, 0, $"预过滤 | 已签名系统程序 | PID={proc.Pid} {proc.Name}");
            }

            // 脚本引擎/Shell 有合法RWX(JIT)，即使有RWX也是正常的
            if (hasRwx && FeatureExtractor.IsScriptingEngine(proc))
            {
                return (true, 0.05, $"预过滤 | 已签名脚本引擎(RWX为JIT正常行为) | PID={proc.Pid} {proc.Name}");
            }
        }

        // 未签名 + 临时路径 → 需要进一步分析
        if (!proc.IsSigned && proc.IsTempPath)
            score += 0.30;

        // 系统进程名 + 非系统路径 → 可疑
        if (FeatureExtractor.IsSystemProcessName(proc.Name) && !proc.IsSystemPath)
            score += 0.35;

        // 网络连接到可疑端口
        if (proc.Connections.Any(c => IsSuspiciousPort(c.RemotePort)))
            score += 0.25;

        // RWX 私有页
        if (regions.Any(r => r.Protect.Contains("EXECUTE_READWRITE") && r.Type == "PRIVATE"))
            score += 0.20;

        if (score < 0.05)
            return (true, 0, $"预过滤 | 无可疑特征 | PID={proc.Pid} {proc.Name}");

        if (score < 0.15 && proc.IsSigned)
            return (true, score * 0.5, $"预过滤 | 已签名低风险 | PID={proc.Pid} {proc.Name} | score={score:F2}");

        return (false, score, $"预过滤 | 进入AI分析 | PID={proc.Pid} {proc.Name} | score={score:F2}");
    }

    private static bool IsSuspiciousPort(int port) => port switch
    {
        4444 or 5555 or 6666 or 7777 or 1337 or 31337 or 9999 or 12345 or 27015 => true,
        _ => false
    };

    private static ScanResult BuildSafeResult(ProcessInfo proc, MemoryFeatures features,
        BaselineResult baseline, List<SignatureMatch> matches, string reasoning)
    {
        return new ScanResult
        {
            Pid = proc.Pid,
            ProcessName = proc.Name,
            RiskLevel = RiskLevel.Safe,
            RiskScore = Math.Min(baseline.AnomalyScore, 0.15),
            Indicators = new List<string>(),
            Reasoning = reasoning,
            Matches = matches,
            AIProvider = "pipeline-v2/baseline",
            DetectionLayer = "Layer1_Baseline",
            ScanTime = DateTime.Now
        };
    }

    private static List<string> BuildIndicators(MemoryFeatures f, BaselineResult baseline,
        ClassificationResult classification, RuleValidationResult rule)
    {
        var indicators = new List<string>();

        if (baseline.IsAnomalous)
        {
            indicators.Add($"基线异常(分数={baseline.AnomalyScore:F2})");
            foreach (var idx in baseline.DeviantFeatureIndices.Take(3))
                indicators.Add($"偏离特征#{idx}");
        }

        if (classification.Classification == MalwareClass.Malicious)
            indicators.Add($"AI分类:恶意({classification.SuspectedFamily})");
        else if (classification.Classification == MalwareClass.Suspicious)
            indicators.Add("AI分类:可疑");

        if (rule.MatchedRuleCount > 0)
        {
            foreach (var tech in rule.MatchedTechniques.Take(5))
                indicators.Add(tech);
        }

        if (f.RwxPrivatePages > 0)
            indicators.Add($"RWX私有页={f.RwxPrivatePages}");

        if (f.PeMismatchDisk)
            indicators.Add("ProcessHollowing");

        if (f.SuspiciousStringHits > 0)
            indicators.Add($"敏感字符串={f.SuspiciousStringHits}");

        return indicators;
    }

    private static string DetermineDetectionLayer(BaselineResult baseline,
        ClassificationResult classification, RuleValidationResult rule)
    {
        if (rule.MatchedRuleCount >= 2) return "L3_Rules+L2_AI+L1_Baseline";
        if (classification.Classification == MalwareClass.Malicious) return "L2_AI+L1_Baseline";
        if (baseline.IsAnomalous) return "L1_Baseline";
        return "PreFilter";
    }
}

/// <summary>
/// 扫描模式
/// </summary>
public enum ScanMode
{
    /// <summary>快速模式：仅元数据，不读取内存</summary>
    Fast,

    /// <summary>平衡模式：采样熵值 + 特征提取</summary>
    Balanced,

    /// <summary>深度模式：全量内存扫描 + 完整特征提取</summary>
    Deep
}