59 lines
2.2 KiB
C#
59 lines
2.2 KiB
C#
// Licensed to StellaOps under the BUSL-1.1 license.
|
|
using StellaOps.ReachGraph.Schema;
|
|
|
|
namespace StellaOps.ReachGraph.Deduplication;
|
|
|
|
/// <summary>
|
|
/// Extensions for edge deduplication.
|
|
/// </summary>
|
|
public static class EdgeDeduplicatorExtensions
|
|
{
|
|
/// <summary>
|
|
/// Deduplicates edges using default extractors based on edge properties.
|
|
/// </summary>
|
|
/// <param name="deduplicator">The deduplicator instance.</param>
|
|
/// <param name="edges">The edges to deduplicate.</param>
|
|
/// <param name="vulnerabilityId">The vulnerability ID to associate with edges.</param>
|
|
/// <param name="defaultSource">Default source ID if not specified.</param>
|
|
/// <param name="timeProvider">Time provider for timestamps.</param>
|
|
/// <returns>Deduplicated edges.</returns>
|
|
public static IReadOnlyList<DeduplicatedEdge> DeduplicateWithDefaults(
|
|
this IEdgeDeduplicator deduplicator,
|
|
IEnumerable<ReachGraphEdge> edges,
|
|
string vulnerabilityId,
|
|
string defaultSource = "unknown",
|
|
TimeProvider? timeProvider = null)
|
|
{
|
|
var time = timeProvider ?? TimeProvider.System;
|
|
var now = time.GetUtcNow();
|
|
|
|
return deduplicator.Deduplicate(
|
|
edges,
|
|
keyExtractor: e => new EdgeSemanticKey(e.From, e.To, vulnerabilityId),
|
|
sourceExtractor: _ => defaultSource,
|
|
strengthExtractor: e => GetEdgeStrength(e.Why),
|
|
timestampExtractor: _ => now);
|
|
}
|
|
|
|
private static double GetEdgeStrength(EdgeExplanation explanation)
|
|
{
|
|
var typeMultiplier = explanation.Type switch
|
|
{
|
|
EdgeExplanationType.DirectCall => 1.0,
|
|
EdgeExplanationType.Import => 0.95,
|
|
EdgeExplanationType.DynamicLoad => 0.9,
|
|
EdgeExplanationType.Ffi => 0.85,
|
|
EdgeExplanationType.Reflection => 0.8,
|
|
EdgeExplanationType.LoaderRule => 0.75,
|
|
EdgeExplanationType.TaintGate => 0.7,
|
|
EdgeExplanationType.EnvGuard => 0.65,
|
|
EdgeExplanationType.FeatureFlag => 0.6,
|
|
EdgeExplanationType.PlatformArch => 0.6,
|
|
EdgeExplanationType.Unknown => 0.5,
|
|
_ => 0.5
|
|
};
|
|
|
|
return explanation.Confidence * typeMultiplier;
|
|
}
|
|
}
|