/**
 * Volume Spike Anomaly Detector
 *
 * Detects unusual request volume patterns by:
 * - Tracking request counts per user, IP, and endpoint
 * - Learning baseline volume statistics over time
 * - Flagging when volume exceeds statistical thresholds
 *
 * Uses a sliding window approach with statistical analysis to identify
 * traffic spikes that may indicate:
 * - Credential stuffing attacks
 * - API abuse
 * - Automated scraping
 * - Denial of service attempts
 *
 * @packageDocumentation
 * @module security/anomaly/detectors/volume
 */
import type { Detector, DetectionResult, SecurityEvent, VolumeDetectorConfig } from '../types.js';
/**
 * Volume spike anomaly detector
 */
export declare class VolumeDetector implements Detector {
    readonly name = "volume";
    readonly description = "Detects unusual request volume spikes per user, IP, or endpoint";
    private readonly config;
    private readonly redis;
    private readonly countPrefix;
    private readonly baselinePrefix;
    constructor(config?: Partial<VolumeDetectorConfig>, countPrefix?: string, baselinePrefix?: string);
    /**
     * Analyze an event for volume anomalies
     */
    detect(event: SecurityEvent): Promise<DetectionResult>;
    /**
     * Learn from an event by updating volume counts and baselines
     */
    learn(event: SecurityEvent): Promise<void>;
    /**
     * Reset all learned baselines and counts
     */
    reset(): Promise<void>;
    /**
     * Update baseline with a new sample
     * Called periodically to update baselines from accumulated counts
     */
    updateBaseline(identifierType: 'user' | 'ip' | 'endpoint', identifier: string, count: number): Promise<void>;
    /**
     * Check volume for a specific identifier
     */
    private checkVolume;
    /**
     * Increment count for an identifier in the current time bucket
     */
    private incrementCount;
    /**
     * Get current count for an identifier
     */
    private getCount;
    /**
     * Get Redis key for count
     */
    private getCountKey;
    /**
     * Get baseline for an identifier
     */
    private getBaseline;
    /**
     * Save baseline for an identifier
     */
    private saveBaseline;
    /**
     * Get Redis key for baseline
     */
    private getBaselineKey;
    /**
     * Delete keys matching a pattern
     */
    private deleteKeysByPattern;
    /**
     * Format identifier type for display
     */
    private formatIdentifierType;
    /**
     * Calculate severity based on confidence and indicators
     */
    private calculateSeverity;
    /**
     * Generate human-readable description
     */
    private generateDescription;
}
/**
 * Create a new volume detector instance
 */
export declare function createVolumeDetector(config?: Partial<VolumeDetectorConfig>, countPrefix?: string, baselinePrefix?: string): VolumeDetector;
//# sourceMappingURL=volume.d.ts.map