From b6af44c1f60c5c4efd145fc5b5e2d55dc808d68e Mon Sep 17 00:00:00 2001 From: surya Date: Mon, 6 Jul 2026 18:02:05 +0530 Subject: [PATCH] [docs]: reorder detection rules by severity score MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit _PATTERN_RULES list had XXE_INJECTION (0.82) after XSS (0.80) and CRLF_INJECTION (0.65) after PATH_TRAVERSAL (0.60), placing higher- scored rules below lower-scored ones. Reordered to strict descending order and updated the module docstring to match. No change to scoring behavior — score_request() takes max + boost regardless of list position. --- .../backend/app/core/detection/rules.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/PROJECTS/advanced/ai-threat-detection/backend/app/core/detection/rules.py b/PROJECTS/advanced/ai-threat-detection/backend/app/core/detection/rules.py index 8d2ae22a..a3547393 100644 --- a/PROJECTS/advanced/ai-threat-detection/backend/app/core/detection/rules.py +++ b/PROJECTS/advanced/ai-threat-detection/backend/app/core/detection/rules.py @@ -7,9 +7,9 @@ ModSecurity Core Rule Set RuleEngine.score_request evaluates requests against 10 regex-based _PatternRules (LOG4SHELL 0.95, COMMAND_ -INJECTION 0.90, SQL_INJECTION 0.85, XSS 0.80, FILE_ -INCLUSION 0.75, XXE_INJECTION 0.82, SSRF 0.70, CRLF_ -INJECTION 0.65, PATH_TRAVERSAL 0.60, OPEN_REDIRECT 0.55), +INJECTION 0.90, SQL_INJECTION 0.85, XXE_INJECTION 0.82, +XSS 0.80, FILE_INCLUSION 0.75, SSRF 0.70, CRLF_INJECTION +0.65, PATH_TRAVERSAL 0.60, OPEN_REDIRECT 0.55), double-encoding detection (0.40), scanner user-agent signature matching (0.35), and 2 _ThresholdRules (RATE_ANOMALY >100 req/min 0.30, HIGH_ERROR_RATE >50% @@ -78,12 +78,12 @@ _PATTERN_RULES: list[_PatternRule] = [ _PatternRule("LOG4SHELL", LOG4SHELL, 0.95), _PatternRule("COMMAND_INJECTION", COMMAND_INJECTION, 0.90), _PatternRule("SQL_INJECTION", SQLI, 0.85), - _PatternRule("XSS", XSS, 0.80), _PatternRule("XXE_INJECTION", XXE_INJECTION, 0.82), + _PatternRule("XSS", XSS, 0.80), _PatternRule("FILE_INCLUSION", FILE_INCLUSION, 0.75), _PatternRule("SSRF", SSRF, 0.70), - _PatternRule("PATH_TRAVERSAL", PATH_TRAVERSAL, 0.60), _PatternRule("CRLF_INJECTION", CRLF_INJECTION, 0.65), + _PatternRule("PATH_TRAVERSAL", PATH_TRAVERSAL, 0.60), _PatternRule("OPEN_REDIRECT", OPEN_REDIRECT, 0.55), ]