net.i2p.router

## Class HashPatternDetector

- java.lang.Object
- - net.i2p.router.HashPatternDetector

- All Implemented Interfaces:
    Serializable

      public class HashPatternDetector
      extends Object
      implements Serializable

  Detects patterns in router hashes to predictively ban algorithmically-generated identities. Tracks byte patterns from banned routers and applies predictive bans when confidence is high.
  See Also:
    Serialized Form

- - ### Constructor Summary

    Constructors
    Constructor and Description
    `HashPatternDetector(RouterContext context)`

  - ### Method Summary

    All Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `boolean` | `analyzeAndPredict(Hash hash, RouterContext context)` Analyze a router hash and apply predictive ban if pattern matches known attack signatures.
    `boolean` | `detectCrossPrefixPatterns(List<String> hashes)` Check for cross-prefix sequential patterns (e.g., 0xAA01FF -> 0xAA0200).
    `boolean` | `detectSequentialPatterns(List<String> hashes)` Detect sequential patterns by analyzing gaps between sorted hashes.
    `void` | `disablePredictiveBanning()` Disable predictive banning manually or after recovery period.
    `String` | `getHashPrefix(Hash hash)` Public method to get the hex prefix of a hash.
    `long` | `getRemainingRecoveryTime()` Get remaining recovery time in milliseconds.
    `Set<String>` | `getSuspiciousPrefixes()` Get suspicious prefixes that are part of a sequential pattern.
    `boolean` | `hasScriptedPattern(List<String> hashes)` Quick check for scripted patterns - returns true if any pattern detected.
    `boolean` | `hasSequentialPattern()` Check if recorded prefixes show sequential/counter patterns indicating algorithmic generation.
    `boolean` | `isPredictiveBanningActive()` Check if predictive banning is currently active and within recovery period.
    `void` | `recordBan(Hash hash, String reason)` Record a ban for pattern analysis.
    `void` | `scanNetDBForPatterns()` Scan netDB for routers matching suspicious patterns and auto-ban them.
    `void` | `startScanner()` Initialize the NetDB scanner with configured frequency.
    `void` | `stopScanner()` Stop the NetDB scanner.

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Constructor Detail

    - #### HashPatternDetector

          public HashPatternDetector(RouterContext context)

  - ### Method Detail

    - #### analyzeAndPredict

          public boolean analyzeAndPredict(Hash hash,
                                           RouterContext context)

      Analyze a router hash and apply predictive ban if pattern matches known attack signatures.
      Parameters:
        `hash` - Router hash to analyze
        `context` - Context for banlist operations
      Returns:
        true if predictively banned, false otherwise

    - #### detectCrossPrefixPatterns

          public boolean detectCrossPrefixPatterns(List<String> hashes)

      Check for cross-prefix sequential patterns (e.g., 0xAA01FF -> 0xAA0200). Indicates scripted IDs crossing byte boundaries.
      Parameters:
        `hashes` - List of router hashes to analyze
      Returns:
        true if cross-prefix patterns detected

    - #### detectSequentialPatterns

          public boolean detectSequentialPatterns(List<String> hashes)

      Detect sequential patterns by analyzing gaps between sorted hashes. Returns true if gap clustering suggests algorithmic generation.
      Parameters:
        `hashes` - List of router hashes to analyze
      Returns:
        true if sequential pattern detected

    - #### disablePredictiveBanning

          public void disablePredictiveBanning()

      Disable predictive banning manually or after recovery period.

    - #### getHashPrefix

          public String getHashPrefix(Hash hash)

      Public method to get the hex prefix of a hash. Used for logging predictive bans.

    - #### getRemainingRecoveryTime

          public long getRemainingRecoveryTime()

      Get remaining recovery time in milliseconds.
      Returns:
        remaining time, or 0 if not in recovery

    - #### getSuspiciousPrefixes

          public Set<String> getSuspiciousPrefixes()

      Get suspicious prefixes that are part of a sequential pattern.
      Returns:
        Set of suspicious prefix strings

    - #### hasScriptedPattern

          public boolean hasScriptedPattern(List<String> hashes)

      Quick check for scripted patterns - returns true if any pattern detected.
      Parameters:
        `hashes` - List of router hashes to check
      Returns:
        true if scripted pattern detected

    - #### hasSequentialPattern

          public boolean hasSequentialPattern()

      Check if recorded prefixes show sequential/counter patterns indicating algorithmic generation. This detects botnets that generate identities with incrementing counters.
      Returns:
        true if sequential pattern detected with high confidence

    - #### isPredictiveBanningActive

          public boolean isPredictiveBanningActive()

      Check if predictive banning is currently active and within recovery period.
      Returns:
        true if predictive banning should be applied

    - #### recordBan

          public void recordBan(Hash hash,
                                String reason)

      Record a ban for pattern analysis.
      Parameters:
        `hash` - Banned router hash
        `reason` - Ban reason

    - #### scanNetDBForPatterns

          public void scanNetDBForPatterns()

      Scan netDB for routers matching suspicious patterns and auto-ban them. Uses gap-based detection for pre-emptive banning.

    - #### startScanner

          public void startScanner()

      Initialize the NetDB scanner with configured frequency. Called after constructor to ensure all dependencies are ready.

    - #### stopScanner

          public void stopScanner()

      Stop the NetDB scanner.