/**
 * @fileoverview Zero-Day Vulnerability Detector using Knowledge Graph Pattern Deviation
 * @module @nahisaho/musubix-security/analyzers/sast/zero-day-detector
 * @trace DES-SEC2-SAST-003, REQ-SEC2-SAST-003
 */
import type { Vulnerability, Severity, SourceLocation } from '../../types/vulnerability.js';
/**
 * Zero-day detection result
 */
export interface ZeroDayResult {
    vulnerability: ZeroDayVulnerability;
    deviation: PatternDeviation;
    riskAssessment: RiskAssessment;
    confidence: number;
}
/**
 * Zero-day vulnerability
 */
export interface ZeroDayVulnerability {
    id: string;
    type: 'unknown-pattern' | 'anomalous-flow' | 'unusual-api-usage' | 'suspicious-construct';
    severity: Severity;
    location: SourceLocation;
    description: string;
    recommendation: string;
    codeSnippet: string;
}
/**
 * Pattern deviation analysis
 */
export interface PatternDeviation {
    patternId: string;
    expectedPattern: string;
    observedPattern: string;
    deviationScore: number;
    deviationType: 'structural' | 'behavioral' | 'temporal' | 'contextual';
    context: PatternContext;
}
/**
 * Pattern context
 */
export interface PatternContext {
    surroundingCode: string;
    callStack: string[];
    dataFlowPath: string[];
    relatedPatterns: string[];
}
/**
 * Risk assessment
 */
export interface RiskAssessment {
    overallRisk: Severity;
    exploitability: number;
    impact: number;
    attackVector: string;
    mitigationComplexity: 'low' | 'medium' | 'high';
    businessImpact: string;
}
/**
 * Detection options
 */
export interface ZeroDayOptions {
    /** Minimum deviation score to report */
    minDeviationScore?: number;
    /** Enable knowledge graph analysis */
    enableKGAnalysis?: boolean;
    /** Enable heuristic analysis */
    enableHeuristics?: boolean;
    /** Enable LLM-assisted analysis */
    enableLLMAnalysis?: boolean;
    /** Custom baseline patterns */
    customBaseline?: CodePattern[];
}
/**
 * Code pattern definition
 */
export interface CodePattern {
    id: string;
    name: string;
    type: 'safe' | 'dangerous' | 'neutral';
    signature: PatternSignature;
    frequency: number;
    confidence: number;
}
/**
 * Pattern signature
 */
export interface PatternSignature {
    astPattern?: string;
    callSequence?: string[];
    dataFlowPattern?: string;
    contextMarkers?: string[];
}
/**
 * Zero-Day Detector implementation
 * @trace DES-SEC2-SAST-003
 */
export declare class ZeroDayDetector {
    private options;
    private knowledgeGraph;
    constructor(options?: ZeroDayOptions);
    /**
     * Detect potential zero-day vulnerabilities
     * @trace REQ-SEC2-SAST-003
     */
    detect(code: string, filePath: string): Promise<ZeroDayResult[]>;
    /**
     * Build local knowledge graph from code
     */
    private buildLocalKnowledgeGraph;
    /**
     * Extract function body from code
     */
    private extractFunctionBody;
    /**
     * Detect suspicious patterns using heuristics
     */
    private detectSuspiciousPatterns;
    /**
     * Analyze pattern deviation using knowledge graph
     */
    private analyzePatternDeviation;
    /**
     * Detect unusual API usage patterns
     */
    private detectAPIUsageDeviations;
    /**
     * Detect data flow anomalies
     */
    private detectDataFlowAnomalies;
    /**
     * LLM-assisted analysis (placeholder for future implementation)
     */
    analyzeWithLLM(_code: string, _filePath: string): Promise<ZeroDayResult[]>;
    /**
     * Assess risk for a detected pattern
     */
    assessRisk(pattern: {
        severity: Severity;
        description: string;
    }, deviationScore: number): RiskAssessment;
    /**
     * Calculate deviation score based on context
     */
    private calculateDeviationScore;
    /**
     * Generate recommendation for pattern
     */
    private generateRecommendation;
    /**
     * Extract code snippet around line
     */
    private extractCodeSnippet;
    /**
     * Extract call stack from context
     */
    private extractCallStack;
    /**
     * Extract data flow path
     */
    private extractDataFlowPath;
    /**
     * Determine attack vector
     */
    private determineAttackVector;
    /**
     * Determine mitigation complexity
     */
    private determineMitigationComplexity;
    /**
     * Determine business impact
     */
    private determineBusinessImpact;
    /**
     * Convert results to standard vulnerability format
     */
    toVulnerabilities(results: ZeroDayResult[]): Vulnerability[];
}
/**
 * Create zero-day detector instance
 */
export declare function createZeroDayDetector(options?: ZeroDayOptions): ZeroDayDetector;
//# sourceMappingURL=zero-day-detector.d.ts.map