Security & Fraud Detection

// Python: Advanced fraud detection algorithm
import geoip2.database
import requests
from datetime import datetime, timedelta

class FraudDetectionEngine:
    def __init__(self):
        self.reputation_api = "https://api.threatintel.com/v1/ip/"
        self.risk_threshold = {
            'low': 0.3,
            'medium': 0.6,
            'high': 0.8
        }
        self.geoip_reader = geoip2.database.Reader('GeoLite2-City.mmdb')
    
    def analyze_ip(self, ip_address, user_context=None):
        """
        Comprehensive IP analysis for fraud detection
        """
        risk_factors = {}
        
        # 1. IP Reputation Check
        reputation = self.check_ip_reputation(ip_address)
        risk_factors['reputation'] = reputation
        
        # 2. Geolocation Analysis
        geo_risk = self.analyze_geolocation(ip_address, user_context)
        risk_factors['geolocation'] = geo_risk
        
        # 3. VPN/Proxy Detection
        proxy_risk = self.detect_proxy_vpn(ip_address)
        risk_factors['proxy'] = proxy_risk
        
        # 4. Behavioral Analysis
        behavior_risk = self.analyze_behavior(ip_address, user_context)
        risk_factors['behavior'] = behavior_risk
        
        # 5. Calculate Composite Risk Score
        risk_score = self.calculate_risk_score(risk_factors)
        
        return {
            'ip_address': ip_address,
            'risk_score': risk_score,
            'risk_level': self.categorize_risk(risk_score),
            'factors': risk_factors,
            'timestamp': datetime.utcnow(),
            'recommended_action': self.get_recommended_action(risk_score)
        }
    
    def check_ip_reputation(self, ip_address):
        """Check IP against threat intelligence databases"""
        try:
            response = requests.get(f"{self.reputation_api}{ip_address}")
            data = response.json()
            
            return {
                'score': data.get('reputation_score', 0.5),
                'categories': data.get('threat_categories', []),
                'last_seen': data.get('last_malicious_activity'),
                'confidence': data.get('confidence_level', 0.5)
            }
        except:
            return {'score': 0.5, 'categories': [], 'confidence': 0.0}
    
    def analyze_geolocation(self, ip_address, user_context):
        """Analyze geolocation for suspicious patterns"""
        try:
            response = self.geoip_reader.city(ip_address)
            current_location = {
                'country': response.country.iso_code,
                'city': response.city.name,
                'latitude': float(response.location.latitude),
                'longitude': float(response.location.longitude)
            }
            
            if user_context and 'previous_locations' in user_context:
                # Calculate distance from previous locations
                distance_risk = self.calculate_location_risk(
                    current_location, 
                    user_context['previous_locations']
                )
                return distance_risk
            
            return 0.3  # Default moderate risk for new users
        except:
            return 0.8  # High risk for invalid/unlocatable IPs
    
    def detect_proxy_vpn(self, ip_address):
        """Detect VPN, proxy, and anonymization services"""
        # Implementation would check against VPN/proxy databases
        # This is a simplified example
        anonymization_indicators = [
            'known_vpn_ranges',
            'tor_exit_nodes', 
            'proxy_services',
            'hosting_providers'
        ]
        
        # Return risk score based on detection
        return 0.7 if self.is_anonymized(ip_address) else 0.1
    
    def analyze_behavior(self, ip_address, user_context):
        """Analyze behavioral patterns for anomalies"""
        if not user_context:
            return 0.4
        
        risk_indicators = []
        
        # Check request frequency
        if user_context.get('requests_per_minute', 0) > 60:
            risk_indicators.append('high_frequency')
        
        # Check time patterns
        if self.is_unusual_time(user_context.get('access_time')):
            risk_indicators.append('unusual_time')
        
        # Check failed attempts
        if user_context.get('failed_attempts', 0) > 3:
            risk_indicators.append('multiple_failures')
        
        return min(len(risk_indicators) * 0.25, 1.0)
    
    def calculate_risk_score(self, risk_factors):
        """Calculate weighted composite risk score"""
        weights = {
            'reputation': 0.3,
            'geolocation': 0.25,
            'proxy': 0.2,
            'behavior': 0.25
        }
        
        total_score = sum(
            risk_factors.get(factor, 0.5) * weight 
            for factor, weight in weights.items()
        )
        
        return min(max(total_score, 0.0), 1.0)
    
    def categorize_risk(self, score):
        """Categorize risk level based on score"""
        if score >= self.risk_threshold['high']:
            return 'HIGH'
        elif score >= self.risk_threshold['medium']:
            return 'MEDIUM'
        elif score >= self.risk_threshold['low']:
            return 'LOW'
        else:
            return 'MINIMAL'
    
    def get_recommended_action(self, risk_score):
        """Get recommended security action based on risk"""
        if risk_score >= 0.8:
            return 'BLOCK'
        elif risk_score >= 0.6:
            return 'CHALLENGE'
        elif risk_score >= 0.3:
            return 'MONITOR'
        else:
            return 'ALLOW'

# Usage example
detector = FraudDetectionEngine()
result = detector.analyze_ip('192.168.1.100', {
    'user_id': 'user123',
    'previous_locations': [{'country': 'US', 'city': 'New York'}],
    'requests_per_minute': 25,
    'failed_attempts': 1
})

print(f"Risk Score: {result['risk_score']:.2f}")
print(f"Risk Level: {result['risk_level']}")
print(f"Action: {result['recommended_action']}")

// Node.js: Security middleware implementation
const express = require('express');
const rateLimit = require('express-rate-limit');
const geoip = require('geoip-lite');

class SecurityMiddleware {
    constructor() {
        this.app = express();
        this.setupSecurityMiddleware();
    }

    setupSecurityMiddleware() {
        // IP-based rate limiting
        const limiter = rateLimit({
            windowMs: 15 * 60 * 1000, // 15 minutes
            max: (req) => {
                // Dynamic limits based on IP reputation
                const reputation = this.getIPReputation(req.ip);
                return reputation > 0.8 ? 10 : reputation > 0.5 ? 50 : 100;
            },
            message: 'Too many requests from this IP',
            standardHeaders: true,
            legacyHeaders: false,
        });

        this.app.use(limiter);
        this.app.use(this.securityAnalysis.bind(this));
        this.app.use(this.geofencing.bind(this));
    }

    async securityAnalysis(req, res, next) {
        const clientIP = req.ip;
        const analysis = await this.analyzeIP(clientIP);
        
        // Add security context to request
        req.security = {
            ip: clientIP,
            riskScore: analysis.riskScore,
            riskLevel: analysis.riskLevel,
            threats: analysis.threats,
            location: analysis.location
        };

        // Block high-risk IPs
        if (analysis.riskScore > 0.8) {
            return res.status(403).json({
                error: 'Access denied',
                reason: 'High risk IP detected',
                contactSupport: true
            });
        }

        // Challenge medium-risk IPs
        if (analysis.riskScore > 0.5 && !req.session.verified) {
            return res.status(429).json({
                error: 'Additional verification required',
                challenge: this.generateChallenge(),
                riskLevel: analysis.riskLevel
            });
        }

        next();
    }

    geofencing(req, res, next) {
        const geo = geoip.lookup(req.ip);
        
        // Restricted countries list
        const restrictedCountries = ['CN', 'RU', 'KP'];
        
        if (geo && restrictedCountries.includes(geo.country)) {
            return res.status(403).json({
                error: 'Geographic restriction',
                message: 'Service not available in your region'
            });
        }

        next();
    }

    async analyzeIP(ip) {
        // Comprehensive IP analysis
        const [reputation, geo, threats] = await Promise.all([
            this.checkReputation(ip),
            this.getGeolocation(ip),
            this.checkThreats(ip)
        ]);

        const riskScore = this.calculateRisk({
            reputation,
            geo,
            threats
        });

        return {
            ip,
            riskScore,
            riskLevel: this.categorizeRisk(riskScore),
            reputation,
            location: geo,
            threats
        };
    }

    generateChallenge() {
        return {
            type: 'captcha',
            challenge_id: this.generateChallengeId(),
            expires_in: 300 // 5 minutes
        };
    }
}

// Usage
const security = new SecurityMiddleware();
const app = security.app;

app.get('/protected', (req, res) => {
    res.json({
        message: 'Access granted',
        security: req.security
    });
});

app.listen(3000, () => {
    console.log('Secure server running on port 3000');
});