Stage0 -->|✅ Whitelisted IP/Path| Allow[✅ ALLOW<br/>Pass to Backend]
Stage0 -->|❌ Not Whitelisted| Stage1{⚡ Stage 1<br/>Local Rules}

Stage1 -->|🎯 Attack Pattern Match| Honeypot[🍯 HONEYPOT<br/>Deceptive Response]
Stage1 -->|❓ Unknown Pattern| Stage2{💾 Stage 2<br/>Database Patterns}

Stage2 -->|📚 Known Attack| Honeypot
Stage2 -->|🆕 Novel Attack| Stage3{🤖 Stage 3<br/>LLM Analysis}

Stage3 -->|🚨 Attack Confirmed| Honeypot
Stage3 -->|✅ Legitimate| Allow

Honeypot --> TI[🔍 Threat Intelligence<br/>Enrichment]
TI --> Notify[📢 Notifications<br/>If Rules Match]
Notify --> Learn[📖 Learn & Store<br/>Pattern]

Allow --> Backend[🎯 Your Application]
Backend --> Response[📦 Real Response]

Learn --> LogAttack[(📊 Attack Database)]

style Start fill:#4c6ef5,stroke:#364fc7,stroke-width:3px,color:#fff
style Stage0 fill:#7950f2,stroke:#5f3dc4,stroke-width:2px,color:#fff
style Stage1 fill:#7950f2,stroke:#5f3dc4,stroke-width:2px,color:#fff
style Stage2 fill:#7950f2,stroke:#5f3dc4,stroke-width:2px,color:#fff
style Stage3 fill:#7950f2,stroke:#5f3dc4,stroke-width:2px,color:#fff
style Allow fill:#51cf66,stroke:#2f9e44,stroke-width:3px,color:#fff
style Honeypot fill:#ff6b6b,stroke:#c92a2a,stroke-width:3px,color:#fff
style TI fill:#ff922b,stroke:#e8590c,stroke-width:2px,color:#fff
style Notify fill:#fab005,stroke:#f08c00,stroke-width:2px,color:#fff
style Learn fill:#20c997,stroke:#12b886,stroke-width:2px,color:#fff
style Backend fill:#339af0,stroke:#1c7ed6,stroke-width:2px,color:#fff
style Response fill:#51cf66,stroke:#2f9e44,stroke-width:2px,color:#fff
style LogAttack fill:#868e96,stroke:#495057,stroke-width:2px,color:#fff

</details>


### 🎯 O que acontece após a detecção?
</br>
<div align="center">
  <img src="https://assets.kitploit.com/production/public/readmes/9318/267273e580b8ba7e204c0143355ee44616af19be04d4232ca4831563e0dc1280.png" alt="What Happens After Detection" width="650">
</div>


### 🔬 Pipeline de Enriquecimento de Inteligência

Cada ataque detectado aciona **coleta paralela de inteligência** em segundo plano:
</br>
<div align="center">
  <img src="https://assets.kitploit.com/production/public/readmes/9318/a0d1c286f17eeaa17f08371e683b9abc632c851cd664e931da99d1b344584ae8.png" alt="Intelligence Enrichment Pipeline" width="650">
</div>





**Características de Desempenho:**

| Cenário | Comportamento | Latência | Custo |
|----------|----------|---------|------|
| **Primeiro Ataque do IP** | Todas as 3 APIs chamadas | ~500ms | $0.003 |
| **Ataque Repetido (< 24h)** | Acerto de cache, nenhuma API | <10ms | $0.00 |
| **Após 24h** | Reenriquecer, atualizar cache | ~500ms | $0.003 |

**💡 Resultado:** 90%+ de taxa de acerto de cache = custos mínimos de API + consultas rápidas



### 💰 Aprendizado Econômico: Otimização de Custos

O IFRIT aprende com cada ataque, reduzindo drasticamente os custos operacionais:

<table>
<tr>
<th width="50%">⏰ Hora 1: Fase de Aprendizado Inicial</th>
<th width="50%">🚀 Hora 2: Operação Otimizada</th>
</tr>
<tr>
<td valign="top">

**Primeira Exposição**```
📊 Traffic Analysis
├─ 100 requests received
├─ 40 unique attack types
│
├─ 🤖 AI Calls Needed
│  ├─ Stage 3 LLM: 40 calls
│  └─ Cost: ~$0.12
│
├─ 🔍 Threat Intel APIs
│  ├─ 40 unique IPs
│  └─ Cost: ~$0.12
│
└─ 💾 Storage
   ├─ Learn all 40 patterns
   ├─ Cache threat intel (24h)
   └─ Generate honeypots

📈 Total Cost: $0.24

**O que aconteceu:**
- ✅ Taxa de cache hit de 100%
- ✅ Latência de 90ms → 10ms
- ✅ **100% de economia de custos!**
- ✅ Mesmo nível de proteção

</td>
</tr>
</table>

**📊 Cenário Real (30 Dias):**```
Day 1:  5,000 attacks, 200 unique → $6.00 in API costs
Day 2:  5,000 attacks, 150 new    → $4.50 in API costs
Day 3:  5,000 attacks, 100 new    → $3.00 in API costs
...
Day 7:  5,000 attacks,  50 new    → $1.50 in API costs
Day 14: 5,000 attacks,  20 new    → $0.60 in API costs
Day 30: 5,000 attacks,  10 new    → $0.30 in API costs

Total: 150,000 attacks handled
Cost without caching: ~$450.00
Cost with IFRIT learning: ~$45.00
💰 Savings: $405.00 (90% reduction!)

**Gerando tokens de API:** Configure em `config/default.json` sob `api.tokens`

---

#### 📡 Endpoints Disponíveis

<details>
<summary><b>🚨 Inteligência de Ataques</b></summary>```bash
# Get recent attacks
curl -H "X-API-Token: YOUR_TOKEN" \
  http://localhost:8443/api/attacks

# Get specific attack
curl -H "X-API-Token: YOUR_TOKEN" \
  http://localhost:8443/api/attacks/42

# Filter by IP
curl -H "X-API-Token: YOUR_TOKEN" \
  "http://localhost:8443/api/attacks?ip=45.67.89.1"

# Filter by date range
curl -H "X-API-Token: YOUR_TOKEN" \
  "http://localhost:8443/api/attacks?from=2024-01-01&to=2024-01-31"

# Attack statistics
curl -H "X-API-Token: YOUR_TOKEN" \
  http://localhost:8443/api/attacks/stats

</details>

<details>
<summary><b>👤 Perfis de Atacantes</b></summary>```bash
# List all attackers
curl -H "X-API-Token: YOUR_TOKEN" \
  http://localhost:8443/api/attackers

# Get specific attacker profile
curl -H "X-API-Token: YOUR_TOKEN" \
  http://localhost:8443/api/attackers/45.67.89.1

# Top attackers
curl -H "X-API-Token: YOUR_TOKEN" \
  "http://localhost:8443/api/attackers/top?limit=10"

</details>

<details>
<summary><b>🧬 Padrões Aprendidos</b></summary>```bash
# Get all patterns
curl -H "X-API-Token: YOUR_TOKEN" \
  http://localhost:8443/api/patterns

# Get pattern by ID
curl -H "X-API-Token: YOUR_TOKEN" \
  http://localhost:8443/api/patterns/15

# Add new pattern
curl -X POST \
  -H "X-API-Token: YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "attack_type": "sql_injection",
    "signature": "' OR 1=1--",
    "confidence": 0.95
  }' \
  http://localhost:8443/api/patterns

**Exemplo de Resposta:**```json
{
  "ip": "45.67.89.1",
  "risk_score": 87,
  "threat_level": "HIGH",
  "abuseipdb": {
    "score": 91,
    "total_reports": 156,
    "last_reported": "2024-01-14T10:30:00Z"
  },
  "virustotal": {
    "malicious": 3,
    "suspicious": 1
  },
  "ipinfo": {
    "country": "CN",
    "city": "Shanghai",
    "is_vpn": false,
    "is_proxy": false,
    "is_tor": false,
    "is_hosting": true
  },
  "cached_at": "2024-01-15T14:23:45Z"
}

</details>

<details>
<summary><b>💾 Gestão de Cache</b></summary>```bash
# Get cache statistics
curl -H "X-API-Token: YOUR_TOKEN" \
  http://localhost:8443/api/cache/stats

# Clear threat intel cache
curl -X POST \
  -H "X-API-Token: YOUR_TOKEN" \
  http://localhost:8443/api/cache/clear

# Clear specific IP from cache
curl -X DELETE \
  -H "X-API-Token: YOUR_TOKEN" \
  http://localhost:8443/api/cache/45.67.89.1