Securing Financial Markets: Comprehensive Risk Management and Cyber Defense Strategies

import logging
import json
import hashlib
from datetime import datetime, timedelta
from dataclasses import dataclass
from typing import List, Dict, Optional
from enum import Enum

class ThreatLevel(Enum):
    LOW = "low"
    MEDIUM = "medium"
    HIGH = "high"
    CRITICAL = "critical"

class AlertType(Enum):
    LOGIN_ANOMALY = "login_anomaly"
    TRANSACTION_FRAUD = "transaction_fraud"
    DATA_EXFILTRATION = "data_exfiltration"
    MALWARE_DETECTION = "malware_detection"
    API_ABUSE = "api_abuse"

@dataclass
class SecurityEvent:
    timestamp: datetime
    event_id: str
    alert_type: AlertType
    threat_level: ThreatLevel
    source_ip: str
    user_id: Optional[str]
    details: Dict
    indicators: List[str]

class SecurityMonitoringSystem:
    def __init__(self):
        self.events = []
        self.threat_intelligence = {}
        self.baseline_metrics = {}
        self.alert_thresholds = {
            ThreatLevel.LOW: 10,
            ThreatLevel.MEDIUM: 5,
            ThreatLevel.HIGH: 2,
            ThreatLevel.CRITICAL: 1
        }
        
    def analyze_login_behavior(self, user_id: str, ip_address: str, 
                              timestamp: datetime, location: str) -> Optional[SecurityEvent]:
        """Analyze login patterns for anomalies"""
        user_history = self._get_user_history(user_id)
        
        # Check for impossible travel
        if self._detect_impossible_travel(user_history, location, timestamp):
            return self._create_security_event(
                AlertType.LOGIN_ANOMALY,
                ThreatLevel.HIGH,
                ip_address,
                user_id,
                {"anomaly": "impossible_travel", "location": location}
            )
        
        # Check for unusual time patterns
        if self._detect_unusual_time_pattern(user_history, timestamp):
            return self._create_security_event(
                AlertType.LOGIN_ANOMALY,
                ThreatLevel.MEDIUM,
                ip_address,
                user_id,
                {"anomaly": "unusual_time", "timestamp": timestamp.isoformat()}
            )
        
        # Check for new device/location
        if self._is_new_device_location(user_history, ip_address, location):
            return self._create_security_event(
                AlertType.LOGIN_ANOMALY,
                ThreatLevel.LOW,
                ip_address,
                user_id,
                {"anomaly": "new_device_location", "ip": ip_address}
            )
        
        return None
    
    def analyze_transaction_patterns(self, transaction_data: Dict) -> Optional[SecurityEvent]:
        """Detect fraudulent transaction patterns"""
        user_id = transaction_data.get('user_id')
        amount = transaction_data.get('amount')
        recipient = transaction_data.get('recipient')
        timestamp = datetime.fromisoformat(transaction_data.get('timestamp'))
        
        # Check for amount anomalies
        if self._detect_amount_anomaly(user_id, amount):
            return self._create_security_event(
                AlertType.TRANSACTION_FRAUD,
                ThreatLevel.HIGH,
                transaction_data.get('source_ip'),
                user_id,
                {"anomaly": "unusual_amount", "amount": amount}
            )
        
        # Check for velocity patterns
        if self._detect_transaction_velocity(user_id, timestamp):
            return self._create_security_event(
                AlertType.TRANSACTION_FRAUD,
                ThreatLevel.MEDIUM,
                transaction_data.get('source_ip'),
                user_id,
                {"anomaly": "high_velocity", "count": self._get_recent_transaction_count(user_id)}
            )
        
        # Check against threat intelligence
        if self._check_threat_intelligence(recipient, transaction_data.get('source_ip')):
            return self._create_security_event(
                AlertType.TRANSACTION_FRAUD,
                ThreatLevel.CRITICAL,
                transaction_data.get('source_ip'),
                user_id,
                {"threat_match": "known_bad_actor", "recipient": recipient}
            )
        
        return None
    
    def monitor_api_usage(self, api_request: Dict) -> Optional[SecurityEvent]:
        """Monitor API usage for abuse patterns"""
        client_id = api_request.get('client_id')
        endpoint = api_request.get('endpoint')
        timestamp = datetime.fromisoformat(api_request.get('timestamp'))
        
        # Rate limiting check
        if self._check_rate_limits(client_id, endpoint, timestamp):
            return self._create_security_event(
                AlertType.API_ABUSE,
                ThreatLevel.MEDIUM,
                api_request.get('source_ip'),
                client_id,
                {"abuse_type": "rate_limit_exceeded", "endpoint": endpoint}
            )
        
        # Unusual data access patterns
        if self._detect_data_scraping(client_id, endpoint, timestamp):
            return self._create_security_event(
                AlertType.DATA_EXFILTRATION,
                ThreatLevel.HIGH,
                api_request.get('source_ip'),
                client_id,
                {"pattern": "potential_scraping", "endpoint": endpoint}
            )
        
        return None
    
    def _create_security_event(self, alert_type: AlertType, threat_level: ThreatLevel,
                              source_ip: str, user_id: Optional[str], details: Dict) -> SecurityEvent:
        """Create a security event with unique ID"""
        event_id = hashlib.sha256(
            f"{datetime.now().isoformat()}{source_ip}{alert_type.value}".encode()
        ).hexdigest()[:16]
        
        event = SecurityEvent(
            timestamp=datetime.now(),
            event_id=event_id,
            alert_type=alert_type,
            threat_level=threat_level,
            source_ip=source_ip,
            user_id=user_id,
            details=details,
            indicators=[source_ip]  # Add more IOCs as needed
        )
        
        self.events.append(event)
        self._trigger_response(event)
        return event
    
    def _trigger_response(self, event: SecurityEvent):
        """Trigger appropriate response based on threat level"""
        if event.threat_level == ThreatLevel.CRITICAL:
            self._block_ip(event.source_ip)
            self._disable_user_account(event.user_id)
            self._notify_security_team(event, urgent=True)
        elif event.threat_level == ThreatLevel.HIGH:
            self._flag_for_review(event.source_ip)
            self._require_additional_auth(event.user_id)
            self._notify_security_team(event)
        elif event.threat_level == ThreatLevel.MEDIUM:
            self._log_for_analysis(event)
            self._increase_monitoring(event.user_id)
    
    def generate_security_report(self, time_window: timedelta) -> Dict:
        """Generate security dashboard metrics"""
        cutoff_time = datetime.now() - time_window
        recent_events = [e for e in self.events if e.timestamp >= cutoff_time]
        
        report = {
            'total_events': len(recent_events),
            'threat_level_breakdown': {},
            'alert_type_breakdown': {},
            'top_source_ips': {},
            'recommendations': []
        }
        
        # Aggregate by threat level
        for level in ThreatLevel:
            count = len([e for e in recent_events if e.threat_level == level])
            report['threat_level_breakdown'][level.value] = count
        
        # Generate recommendations
        if report['threat_level_breakdown'].get('critical', 0) > 0:
            report['recommendations'].append("Immediate incident response required")
        
        return report
    
    # Helper methods (simplified implementations)
    def _get_user_history(self, user_id: str) -> List[Dict]: pass
    def _detect_impossible_travel(self, history: List[Dict], location: str, timestamp: datetime) -> bool: pass
    def _detect_unusual_time_pattern(self, history: List[Dict], timestamp: datetime) -> bool: pass
    def _is_new_device_location(self, history: List[Dict], ip: str, location: str) -> bool: pass
    def _detect_amount_anomaly(self, user_id: str, amount: float) -> bool: pass
    def _detect_transaction_velocity(self, user_id: str, timestamp: datetime) -> bool: pass
    def _get_recent_transaction_count(self, user_id: str) -> int: pass
    def _check_threat_intelligence(self, recipient: str, ip: str) -> bool: pass
    def _check_rate_limits(self, client_id: str, endpoint: str, timestamp: datetime) -> bool: pass
    def _detect_data_scraping(self, client_id: str, endpoint: str, timestamp: datetime) -> bool: pass
    def _block_ip(self, ip: str): pass
    def _disable_user_account(self, user_id: str): pass
    def _notify_security_team(self, event: SecurityEvent, urgent: bool = False): pass
    def _flag_for_review(self, ip: str): pass
    def _require_additional_auth(self, user_id: str): pass
    def _log_for_analysis(self, event: SecurityEvent): pass
    def _increase_monitoring(self, user_id: str): pass

class VendorRiskAssessment {
  constructor() {
    this.riskMatrix = {
      security: { weight: 0.4, categories: ['encryption', 'access_controls', 'incident_response'] },
      compliance: { weight: 0.3, categories: ['certifications', 'audit_reports', 'regulatory'] },
      operational: { weight: 0.2, categories: ['uptime', 'support', 'scalability'] },
      financial: { weight: 0.1, categories: ['stability', 'insurance', 'references'] }
    };
    
    this.complianceFrameworks = [
      'SOC2_TYPE2', 'ISO27001', 'PCI_DSS', 'GDPR', 'CCPA'
    ];
  }

  async assessVendor(vendorData) {
    const assessment = {
      vendorId: vendorData.id,
      assessmentDate: new Date().toISOString(),
      scores: {},
      overallRisk: 'PENDING',
      recommendations: [],
      complianceGaps: []
    };

    // Security Assessment
    assessment.scores.security = await this.evaluateSecurityControls(vendorData);
    
    // Compliance Assessment  
    assessment.scores.compliance = await this.evaluateCompliance(vendorData);
    
    // Operational Assessment
    assessment.scores.operational = await this.evaluateOperationalCapability(vendorData);
    
    // Financial Assessment
    assessment.scores.financial = await this.evaluateFinancialStability(vendorData);
    
    // Calculate overall risk score
    assessment.overallRisk = this.calculateOverallRisk(assessment.scores);
    
    // Generate recommendations
    assessment.recommendations = this.generateRecommendations(assessment);
    
    return assessment;
  }

  async evaluateSecurityControls(vendorData) {
    let securityScore = 0;
    const maxScore = 100;
    
    // Check encryption standards
    if (vendorData.encryption?.inTransit === 'TLS1.3' && 
        vendorData.encryption?.atRest === 'AES256') {
      securityScore += 25;
    }
    
    // Evaluate access controls
    if (vendorData.accessControls?.mfa === true && 
        vendorData.accessControls?.rbac === true) {
      securityScore += 20;
    }
    
    // Check incident response capability
    if (vendorData.incidentResponse?.plan === true && 
        vendorData.incidentResponse?.sla <= 4) { // 4 hours max
      securityScore += 15;
    }
    
    // Vulnerability management
    if (vendorData.vulnerabilityMgmt?.scanFrequency === 'weekly' && 
        vendorData.vulnerabilityMgmt?.patchingSLA <= 72) { // 72 hours max
      securityScore += 20;
    }
    
    // Security monitoring
    if (vendorData.monitoring?.siem === true && 
        vendorData.monitoring?.realTime === true) {
      securityScore += 20;
    }
    
    return {
      score: securityScore,
      percentage: (securityScore / maxScore) * 100,
      grade: this.calculateGrade(securityScore, maxScore)
    };
  }

  async evaluateCompliance(vendorData) {
    let complianceScore = 0;
    const maxScore = 100;
    let gaps = [];
    
    // Check required certifications
    this.complianceFrameworks.forEach(framework => {
      const cert = vendorData.certifications?.find(c => c.type === framework);
      if (cert && this.isValidCertification(cert)) {
        complianceScore += 20;
      } else {
        gaps.push(`Missing or expired: ${framework}`);
      }
    });
    
    return {
      score: complianceScore,
      percentage: (complianceScore / maxScore) * 100,
      grade: this.calculateGrade(complianceScore, maxScore),
      gaps: gaps
    };
  }

  calculateOverallRisk(scores) {
    let weightedScore = 0;
    
    Object.keys(this.riskMatrix).forEach(category => {
      const weight = this.riskMatrix[category].weight;
      const score = scores[category]?.percentage || 0;
      weightedScore += (score * weight);
    });
    
    if (weightedScore >= 85) return 'LOW';
    if (weightedScore >= 70) return 'MEDIUM';
    if (weightedScore >= 50) return 'HIGH';
    return 'CRITICAL';
  }

  generateRecommendations(assessment) {
    const recommendations = [];
    
    if (assessment.scores.security.percentage < 70) {
      recommendations.push({
        priority: 'HIGH',
        category: 'Security',
        action: 'Require security improvements before onboarding',
        timeline: '30 days'
      });
    }
    
    if (assessment.scores.compliance.gaps.length > 0) {
      recommendations.push({
        priority: 'MEDIUM',
        category: 'Compliance',
        action: `Address compliance gaps: ${assessment.scores.compliance.gaps.join(', ')}`,
        timeline: '60 days'
      });
    }
    
    if (assessment.overallRisk === 'CRITICAL') {
      recommendations.push({
        priority: 'CRITICAL',
        category: 'Overall',
        action: 'Do not onboard - risk too high',
        timeline: 'Immediate'
      });
    }
    
    return recommendations;
  }

  calculateGrade(score, maxScore) {
    const percentage = (score / maxScore) * 100;
    if (percentage >= 90) return 'A';
    if (percentage >= 80) return 'B';
    if (percentage >= 70) return 'C';
    if (percentage >= 60) return 'D';
    return 'F';
  }

  isValidCertification(cert) {
    const expirationDate = new Date(cert.expirationDate);
    const now = new Date();
    return expirationDate > now;
  }
}