040_AI驱动的访问控制异常检测：智能识别与主动防御机制

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "@openzeppelin/contracts/access/AccessControl.sol";
import "@openzeppelin/contracts/security/Pausable.sol";
import "@openzeppelin/contracts/utils/math/SafeMath.sol";
import "@chainlink/contracts/src/v0.8/interfaces/AggregatorV3Interface.sol";

/**
 * @title AI驱动的访问控制异常检测合约
 * @dev 集成了AI异常检测功能的智能访问控制合约
 */
contract AIAccessControl is AccessControl, Pausable {
    using SafeMath for uint256;
    
    // 角色定义
    bytes32 public constant ADMIN_ROLE = keccak256("ADMIN_ROLE");
    bytes32 public constant OPERATOR_ROLE = keccak256("OPERATOR_ROLE");
    bytes32 public constant DETECTION_ROLE = keccak256("DETECTION_ROLE");
    bytes32 public constant AUDITOR_ROLE = keccak256("AUDITOR_ROLE");
    
    // 事件定义
    event AccessRequested(address indexed user, bytes32 indexed resourceId, uint256 timestamp);
    event AccessGranted(address indexed user, bytes32 indexed resourceId, uint256 timestamp);
    event AccessDenied(address indexed user, bytes32 indexed resourceId, string reason, uint256 timestamp);
    event AnomalyDetected(address indexed user, bytes32 indexed resourceId, uint256 anomalyScore, uint256 timestamp);
    event DefenseActivated(address indexed user, string defenseType, uint256 duration, uint256 timestamp);
    event DefenseDeactivated(address indexed user, string defenseType, uint256 timestamp);
    event ModelUpdated(uint256 modelId, uint256 version, uint256 timestamp);
    event ThresholdUpdated(bytes32 thresholdType, uint256 newValue, uint256 timestamp);
    event AuditLogCreated(uint256 indexed logId, address indexed user, string action, string details, uint256 timestamp);
    
    // 防御措施类型
    enum DefenseType { NONE, DELAY, RATE_LIMIT, SOFT_LOCK, HARD_LOCK }
    
    // 用户行为数据
    struct UserBehavior {
        uint256 totalAccessCount;        // 总访问次数
        uint256 failedAccessCount;       // 失败访问次数
        uint256 lastAccessTimestamp;     // 最后访问时间
        uint256 anomalyCount;            // 异常次数
        uint256 consecutiveAnomalies;    // 连续异常次数
        uint256 reputationScore;         // 声誉分数
        mapping(bytes32 => uint256) resourceAccessCount;  // 资源访问次数
        mapping(bytes32 => uint256) resourceLastAccess;   // 资源最后访问时间
        mapping(uint256 => BehaviorSnapshot) behaviorHistory; // 行为历史快照
        uint256 historyCount;            // 历史记录数量
    }
    
    // 行为快照
    struct BehaviorSnapshot {
        uint256 timestamp;               // 时间戳
        uint256 accessCount;             // 访问次数
        uint256 failedCount;             // 失败次数
        uint256 anomalyScore;            // 异常分数
        uint256 reputationScore;         // 声誉分数
    }
    
    // 防御状态
    struct DefenseStatus {
        DefenseType activeDefense;       // 激活的防御类型
        uint256 activationTimestamp;     // 激活时间
        uint256 duration;                // 持续时间
        uint256 reasonCode;              // 原因代码
        uint256 anomalyScore;            // 触发异常分数
    }
    
    // 异常检测模型
    struct DetectionModel {
        uint256 modelId;                 // 模型ID
        uint256 version;                 // 版本号
        uint256 lastUpdateTimestamp;     // 最后更新时间
        string modelDescription;         // 模型描述
        bool isActive;                   // 是否激活
    }
    
    // 资源访问控制
    struct ResourceAccess {
        bool exists;                     // 是否存在
        string resourceType;             // 资源类型
        uint256 importanceLevel;         // 重要性级别 (1-5)
        uint256 baseAccessThreshold;     // 基础访问阈值
        mapping(address => bool) explicitAccess;  // 显式访问权限
    }
    
    // 映射存储
    mapping(address => UserBehavior) public userBehaviors;
    mapping(address => DefenseStatus) public defenseStatus;
    mapping(uint256 => DetectionModel) public detectionModels;
    mapping(bytes32 => ResourceAccess) public resources;
    mapping(uint256 => AuditLog) public auditLogs;
    
    // 审计日志
    struct AuditLog {
        address user;                    // 用户地址
        string action;                   // 操作类型
        string details;                  // 详细信息
        uint256 timestamp;               // 时间戳
        bool isProcessed;                // 是否已处理
    }
    
    // 系统参数
    uint256 public activeModelId = 1;              // 激活的模型ID
    uint256 public anomalyThreshold = 75;          // 异常阈值 (0-100)
    uint256 public highAnomalyThreshold = 90;      // 高异常阈值
    uint256 public reputationDecayRate = 1;        // 声誉衰减率
    uint256 public reputationRecoveryRate = 2;     // 声誉恢复率
    uint256 public maxBehaviorHistory = 100;       // 最大行为历史记录数
    uint256 public auditLogCounter = 0;            // 审计日志计数器
    uint256 public softLockDuration = 3600;        // 软锁定持续时间 (秒)
    uint256 public hardLockDuration = 86400;       // 硬锁定持续时间 (秒)
    uint256 public maxRateLimitCount = 10;         // 速率限制最大值
    uint256 public rateLimitWindow = 60;           // 速率限制时间窗口 (秒)
    
    // Chainlink预言机接口
    AggregatorV3Interface public anomalyScoreFeed;
    
    constructor(address _anomalyScoreFeed) {
        _setupRole(DEFAULT_ADMIN_ROLE, msg.sender);
        _setupRole(ADMIN_ROLE, msg.sender);
        _setupRole(OPERATOR_ROLE, msg.sender);
        
        // 初始化默认检测模型
        detectionModels[1] = DetectionModel({
            modelId: 1,
            version: 1,
            lastUpdateTimestamp: block.timestamp,
            modelDescription: "初始异常检测模型",
            isActive: true
        });
        
        anomalyScoreFeed = AggregatorV3Interface(_anomalyScoreFeed);
    }
    
    // 添加资源
    function addResource(bytes32 resourceId, string memory resourceType, uint256 importanceLevel) external onlyRole(ADMIN_ROLE) {
        require(!resources[resourceId].exists, "Resource already exists");
        require(importanceLevel >= 1 && importanceLevel <= 5, "Invalid importance level");
        
        ResourceAccess storage resource = resources[resourceId];
        resource.exists = true;
        resource.resourceType = resourceType;
        resource.importanceLevel = importanceLevel;
        resource.baseAccessThreshold = 50; // 默认基础阈值
    }
    
    // 设置资源访问权限
    function setResourceAccess(bytes32 resourceId, address user, bool hasAccess) external onlyRole(OPERATOR_ROLE) {
        require(resources[resourceId].exists, "Resource not found");
        resources[resourceId].explicitAccess[user] = hasAccess;
    }
    
    // 更新异常检测模型
    function updateDetectionModel(uint256 modelId, uint256 version, string memory description) external onlyRole(ADMIN_ROLE) {
        detectionModels[modelId] = DetectionModel({
            modelId: modelId,
            version: version,
            lastUpdateTimestamp: block.timestamp,
            modelDescription: description,
            isActive: true
        });
        
        emit ModelUpdated(modelId, version, block.timestamp);
    }
    
    // 设置激活的模型
    function setActiveModel(uint256 modelId) external onlyRole(ADMIN_ROLE) {
        require(detectionModels[modelId].isActive, "Model not active");
        activeModelId = modelId;
    }
    
    // 更新阈值参数
    function updateThreshold(bytes32 thresholdType, uint256 newValue) external onlyRole(ADMIN_ROLE) {
        if (thresholdType == keccak256("ANOMALY")) {
            anomalyThreshold = newValue;
        } else if (thresholdType == keccak256("HIGH_ANOMALY")) {
            highAnomalyThreshold = newValue;
        } else if (thresholdType == keccak256("REPUTATION_DECAY")) {
            reputationDecayRate = newValue;
        } else if (thresholdType == keccak256("REPUTATION_RECOVERY")) {
            reputationRecoveryRate = newValue;
        } else if (thresholdType == keccak256("SOFT_LOCK_DURATION")) {
            softLockDuration = newValue;
        } else if (thresholdType == keccak256("HARD_LOCK_DURATION")) {
            hardLockDuration = newValue;
        }
        
        emit ThresholdUpdated(thresholdType, newValue, block.timestamp);
    }
    
    // 记录行为数据
    function recordBehavior(address user, bytes32 resourceId, bool isSuccessful) internal {
        UserBehavior storage behavior = userBehaviors[user];
        behavior.totalAccessCount++;
        behavior.lastAccessTimestamp = block.timestamp;
        
        if (!isSuccessful) {
            behavior.failedAccessCount++;
        }
        
        // 更新资源访问记录
        behavior.resourceAccessCount[resourceId]++;
        behavior.resourceLastAccess[resourceId] = block.timestamp;
        
        // 更新声誉分数
        if (isSuccessful) {
            behavior.reputationScore = behavior.reputationScore.add(reputationRecoveryRate);
            // 声誉分数上限为100
            if (behavior.reputationScore > 100) {
                behavior.reputationScore = 100;
            }
            // 重置连续异常计数
            behavior.consecutiveAnomalies = 0;
        } else {
            behavior.reputationScore = behavior.reputationScore.sub(reputationDecayRate, "Reputation score cannot be negative");
            behavior.consecutiveAnomalies++;
        }
        
        // 创建行为历史快照
        if (behavior.historyCount < maxBehaviorHistory) {
            behavior.behaviorHistory[behavior.historyCount] = BehaviorSnapshot({
                timestamp: block.timestamp,
                accessCount: behavior.totalAccessCount,
                failedCount: behavior.failedAccessCount,
                anomalyScore: 0, // 后续更新
                reputationScore: behavior.reputationScore
            });
            behavior.historyCount++;
        } else {
            // 替换最旧的快照
            uint256 oldestIndex = behavior.historyCount % maxBehaviorHistory;
            behavior.behaviorHistory[oldestIndex] = BehaviorSnapshot({
                timestamp: block.timestamp,
                accessCount: behavior.totalAccessCount,
                failedCount: behavior.failedAccessCount,
                anomalyScore: 0,
                reputationScore: behavior.reputationScore
            });
            behavior.historyCount++;
        }
    }
    
    // 检测异常行为
    function detectAnomaly(address user, bytes32 resourceId) internal returns (uint256) {
        // 在实际应用中，这里应该调用AI模型获取异常分数
        // 这里我们使用简化的模拟计算，并通过Chainlink预言机获取额外的异常分数
        
        UserBehavior storage behavior = userBehaviors[user];
        uint256 baseScore = 0;
        
        // 1. 基于声誉分数的异常评分
        uint256 reputationScore = behavior.reputationScore;
        if (reputationScore < 30) {
            baseScore += 40;
        } else if (reputationScore < 60) {
            baseScore += 20;
        }
        
        // 2. 基于连续失败的异常评分
        if (behavior.consecutiveAnomalies >= 5) {
            baseScore += 30;
        } else if (behavior.consecutiveAnomalies >= 3) {
            baseScore += 15;
        }
        
        // 3. 基于访问频率的异常评分
        uint256 timeSinceLastAccess = block.timestamp.sub(behavior.lastAccessTimestamp, "Invalid timestamp");
        if (timeSinceLastAccess < 5 seconds) { // 5秒内多次访问
            baseScore += 25;
        }
        
        // 4. 获取Chainlink预言机的异常分数 (0-100)
        uint256 oracleScore = getOracleAnomalyScore(user, resourceId);
        
        // 5. 综合计算最终异常分数 (加权平均)
        uint256 finalScore = (baseScore * 40 + oracleScore * 60) / 100;
        
        // 更新最新行为快照的异常分数
        if (behavior.historyCount > 0) {
            uint256 latestIndex = behavior.historyCount - 1;
            if (latestIndex >= maxBehaviorHistory) {
                latestIndex = latestIndex % maxBehaviorHistory;
            }
            behavior.behaviorHistory[latestIndex].anomalyScore = finalScore;
        }
        
        // 如果检测到异常，记录异常次数
        if (finalScore >= anomalyThreshold) {
            behavior.anomalyCount++;
            emit AnomalyDetected(user, resourceId, finalScore, block.timestamp);
        }
        
        return finalScore;
    }
    
    // 从Chainlink预言机获取异常分数
    function getOracleAnomalyScore(address user, bytes32 resourceId) internal view returns (uint256) {
        try {
            // 在实际应用中，这里应该通过Chainlink预言机获取异常分数
            // 由于预言机调用的复杂性，这里返回一个模拟值
            // (,int256 score,,,) = anomalyScoreFeed.latestRoundData();
            // return uint256(score);
            
            // 模拟返回一个基于用户地址和资源ID的随机分数
            return uint256(keccak256(abi.encodePacked(user, resourceId, block.timestamp))) % 100;
        } catch {
            // 如果预言机调用失败，返回默认值
            return 50; // 中等异常可能性
        }
    }
    
    // 激活防御措施
    function activateDefense(address user, uint256 anomalyScore) internal {
        DefenseStatus storage status = defenseStatus[user];
        
        // 如果已经有激活的防御措施，不重复激活
        if (status.activeDefense != DefenseType.NONE && 
            block.timestamp < status.activationTimestamp.add(status.duration)) {
            return;
        }
        
        DefenseType defenseType;
        uint256 duration;
        
        // 根据异常分数确定防御措施类型
        if (anomalyScore >= highAnomalyThreshold) {
            defenseType = DefenseType.HARD_LOCK;
            duration = hardLockDuration;
        } else if (anomalyScore >= anomalyThreshold) {
            defenseType = DefenseType.SOFT_LOCK;
            duration = softLockDuration;
        } else {
            defenseType = DefenseType.RATE_LIMIT;
            duration = 300; // 5分钟
        }
        
        // 更新防御状态
        status.activeDefense = defenseType;
        status.activationTimestamp = block.timestamp;
        status.duration = duration;
        status.reasonCode = 1;
        status.anomalyScore = anomalyScore;
        
        // 记录审计日志
        string memory defenseTypeName = getDefenseTypeName(defenseType);
        emit DefenseActivated(user, defenseTypeName, duration, block.timestamp);
        
        // 创建审计日志
        createAuditLog(user, "DefenseActivated", string(abi.encodePacked(
            "Defense type: ", defenseTypeName, 
            ", Anomaly score: ", uint2str(anomalyScore), 
            ", Duration: ", uint2str(duration)
        )));
    }
    
    // 停用防御措施
    function deactivateDefense(address user) external onlyRole(AUDITOR_ROLE) {
        DefenseStatus storage status = defenseStatus[user];
        require(status.activeDefense != DefenseType.NONE, "No active defense");
        
        string memory defenseTypeName = getDefenseTypeName(status.activeDefense);
        
        // 重置防御状态
        status.activeDefense = DefenseType.NONE;
        status.activationTimestamp = 0;
        status.duration = 0;
        status.reasonCode = 0;
        status.anomalyScore = 0;
        
        emit DefenseDeactivated(user, defenseTypeName, block.timestamp);
        
        // 创建审计日志
        createAuditLog(user, "DefenseDeactivated", string(abi.encodePacked(
            "Defense type: ", defenseTypeName
        )));
    }
    
    // 验证防御状态
    function validateDefenseStatus(address user) internal view returns (bool, string memory) {
        DefenseStatus storage status = defenseStatus[user];
        
        // 检查防御措施是否已过期
        if (status.activeDefense != DefenseType.NONE && 
            block.timestamp >= status.activationTimestamp.add(status.duration)) {
            // 防御措施已过期，可以临时认为有效
            return (true, "");
        }
        
        // 检查硬锁定
        if (status.activeDefense == DefenseType.HARD_LOCK) {
            return (false, "Account is hard locked due to suspicious activity");
        }
        
        // 检查软锁定
        if (status.activeDefense == DefenseType.SOFT_LOCK) {
            return (false, "Account is soft locked, please contact support");
        }
        
        // 检查速率限制
        if (status.activeDefense == DefenseType.RATE_LIMIT) {
            // 在实际应用中，这里应该检查速率限制计数
            // 简化处理，允许访问但发出警告
            return (true, "Rate limit warning");
        }
        
        return (true, "");
    }
    
    // 检查访问权限
    function checkAccess(address user, bytes32 resourceId) public view returns (bool, string memory) {
        // 1. 检查资源是否存在
        if (!resources[resourceId].exists) {
            return (false, "Resource not found");
        }
        
        // 2. 检查防御状态
        (bool defenseValid, string memory defenseReason) = validateDefenseStatus(user);
        if (!defenseValid) {
            return (false, defenseReason);
        }
        
        // 3. 检查显式访问权限
        if (!resources[resourceId].explicitAccess[user]) {
            return (false, "No explicit access permission");
        }
        
        return (true, "");
    }
    
    // 请求访问资源
    function requestAccess(bytes32 resourceId) external whenNotPaused returns (bool) {
        address user = msg.sender;
        
        // 记录访问请求
        emit AccessRequested(user, resourceId, block.timestamp);
        
        // 1. 检查基本访问权限
        (bool hasAccess, string memory reason) = checkAccess(user, resourceId);
        
        // 2. 检测异常行为
        uint256 anomalyScore = detectAnomaly(user, resourceId);
        
        // 3. 综合判断是否授予访问权限
        bool grantAccess = hasAccess && anomalyScore < anomalyThreshold;
        
        // 4. 记录行为数据
        recordBehavior(user, resourceId, grantAccess);
        
        // 5. 如果检测到异常，激活防御措施
        if (anomalyScore >= anomalyThreshold) {
            activateDefense(user, anomalyScore);
        }
        
        // 6. 记录访问结果
        if (grantAccess) {
            emit AccessGranted(user, resourceId, block.timestamp);
        } else {
            string memory finalReason = reason;
            if (bytes(finalReason).length == 0 && anomalyScore >= anomalyThreshold) {
                finalReason = "Access denied due to suspicious activity";
            }
            emit AccessDenied(user, resourceId, finalReason, block.timestamp);
            
            // 创建审计日志
            createAuditLog(user, "AccessDenied", string(abi.encodePacked(
                "Resource: ", bytes32ToString(resourceId), 
                ", Reason: ", finalReason,
                ", Anomaly score: ", uint2str(anomalyScore)
            )));
        }
        
        return grantAccess;
    }
    
    // 创建审计日志
    function createAuditLog(address user, string memory action, string memory details) internal {
        auditLogCounter++;
        auditLogs[auditLogCounter] = AuditLog({
            user: user,
            action: action,
            details: details,
            timestamp: block.timestamp,
            isProcessed: false
        });
        
        emit AuditLogCreated(auditLogCounter, user, action, details, block.timestamp);
    }
    
    // 获取用户行为数据
    function getUserBehavior(address user) external view returns (
        uint256 totalAccessCount,
        uint256 failedAccessCount,
        uint256 lastAccessTimestamp,
        uint256 anomalyCount,
        uint256 consecutiveAnomalies,
        uint256 reputationScore
    ) {
        UserBehavior storage behavior = userBehaviors[user];
        return (
            behavior.totalAccessCount,
            behavior.failedAccessCount,
            behavior.lastAccessTimestamp,
            behavior.anomalyCount,
            behavior.consecutiveAnomalies,
            behavior.reputationScore
        );
    }
    
    // 获取资源访问次数
    function getResourceAccessCount(address user, bytes32 resourceId) external view returns (uint256) {
        return userBehaviors[user].resourceAccessCount[resourceId];
    }
    
    // 获取行为历史快照
    function getBehaviorSnapshot(address user, uint256 index) external view returns (
        uint256 timestamp,
        uint256 accessCount,
        uint256 failedCount,
        uint256 anomalyScore,
        uint256 reputationScore
    ) {
        UserBehavior storage behavior = userBehaviors[user];
        
        // 处理循环索引
        if (index >= maxBehaviorHistory) {
            index = index % maxBehaviorHistory;
        }
        
        BehaviorSnapshot memory snapshot = behavior.behaviorHistory[index];
        return (
            snapshot.timestamp,
            snapshot.accessCount,
            snapshot.failedCount,
            snapshot.anomalyScore,
            snapshot.reputationScore
        );
    }
    
    // 处理审计日志
    function processAuditLog(uint256 logId, bool isApproved) external onlyRole(AUDITOR_ROLE) {
        AuditLog storage log = auditLogs[logId];
        require(!log.isProcessed, "Audit log already processed");
        
        log.isProcessed = true;
        
        // 如果是异常行为且被管理员批准，可以恢复用户声誉
        if (isApproved && keccak256(bytes(log.action)) == keccak256(bytes("AccessDenied"))) {
            UserBehavior storage behavior = userBehaviors[log.user];
            behavior.reputationScore = behavior.reputationScore.add(5);
            if (behavior.reputationScore > 100) {
                behavior.reputationScore = 100;
            }
            behavior.consecutiveAnomalies = 0;
        }
    }
    
    // 暂停合约
    function pause() external onlyRole(ADMIN_ROLE) {
        _pause();
    }
    
    // 恢复合约
    function unpause() external onlyRole(ADMIN_ROLE) {
        _unpause();
    }
    
    // 辅助函数：获取防御类型名称
    function getDefenseTypeName(DefenseType defenseType) internal pure returns (string memory) {
        if (defenseType == DefenseType.NONE) return "NONE";
        if (defenseType == DefenseType.DELAY) return "DELAY";
        if (defenseType == DefenseType.RATE_LIMIT) return "RATE_LIMIT";
        if (defenseType == DefenseType.SOFT_LOCK) return "SOFT_LOCK";
        if (defenseType == DefenseType.HARD_LOCK) return "HARD_LOCK";
        return "UNKNOWN";
    }
    
    // 辅助函数：uint转string
    function uint2str(uint256 _i) internal pure returns (string memory) {
        if (_i == 0) {
            return "0";
        }
        uint256 j = _i;
        uint256 len;
        while (j != 0) {
            len++;
            j /= 10;
        }
        bytes memory bstr = new bytes(len);
        uint256 k = len - 1;
        while (_i != 0) {
            bstr[k--] = bytes1(uint8(48 + _i % 10));
            _i /= 10;
        }
        return string(bstr);
    }
    
    // 辅助函数：bytes32转string
    function bytes32ToString(bytes32 _bytes32) internal pure returns (string memory) {
        uint8 i = 0;
        while(i < 32 && _bytes32[i] != 0) {
            i++;
        }
        bytes memory bytesArray = new bytes(i);
        for (i = 0; i < bytesArray.length; i++) {
            bytesArray[i] = _bytes32[i];
        }
        return string(bytesArray);
    }
}