/**
 * Account Compromise Detector
 *
 * Detects potential account compromise by analyzing:
 * - Password/MFA changes followed by unusual activity
 * - Session from new device after credential change
 * - Activity during user's typical offline hours
 * - Combined signals: impossible travel + new device + sensitive access
 *
 * Uses multi-signal fusion to identify compromised accounts with
 * high confidence.
 *
 * @packageDocumentation
 * @module security/anomaly/detectors/account-compromise
 */
import type { Detector, DetectionResult, SecurityEvent } from '../types.js';
/**
 * Configuration for account compromise detection
 */
export interface AccountCompromiseDetectorConfig {
    /** Hours in a day (24-hour format) */
    hoursInDay: number;
    /** Weight for impossible travel signal */
    impossibleTravelWeight: number;
    /** Weight for new device signal */
    newDeviceWeight: number;
    /** Weight for credential change + activity signal */
    credentialChangeActivityWeight: number;
    /** Weight for unusual time signal */
    unusualTimeWeight: number;
    /** Weight for sensitive access signal */
    sensitiveAccessWeight: number;
    /** Sensitive resources that increase risk */
    sensitiveResources: string[];
    /** Minimum confidence to combine signals */
    signalCombinationThreshold: number;
    /** Number of signals required for high confidence */
    minSignalsForHighConfidence: number;
    /** Track user active hours */
    trackActiveHours: boolean;
}
export declare const DEFAULT_ACCOUNT_COMPROMISE_CONFIG: AccountCompromiseDetectorConfig;
/**
 * User's activity baseline for compromise detection
 */
interface UserActivityBaseline {
    userId: string;
    /** Known device fingerprints */
    knownDevices: string[];
    /** Known IP addresses */
    knownIps: string[];
    /** Active hours histogram (24 bins) */
    activeHourHistogram: number[];
    /** Typical locations */
    typicalLocations: Array<{
        latitude: number;
        longitude: number;
        countryCode?: string;
        city?: string;
    }>;
    /** Resources typically accessed */
    typicalResources: string[];
    /** Last credential change timestamp */
    lastCredentialChange?: string;
    /** Total events tracked */
    totalEvents: number;
    /** Last updated */
    lastUpdated: string;
}
/**
 * Account compromise anomaly detector
 */
export declare class AccountCompromiseDetector implements Detector {
    readonly name = "account-compromise";
    readonly description = "Detects account compromise through credential changes, device analysis, and multi-signal fusion";
    private readonly config;
    private readonly redis;
    private readonly keyPrefix;
    constructor(config?: Partial<AccountCompromiseDetectorConfig>, keyPrefix?: string);
    /**
     * Analyze an event for account compromise indicators
     */
    detect(event: SecurityEvent): Promise<DetectionResult>;
    /**
     * Learn from an event by updating baselines
     */
    learn(event: SecurityEvent): Promise<void>;
    /**
     * Reset all learned baselines
     */
    reset(): Promise<void>;
    /**
     * Get baseline for a specific user
     */
    getBaseline(userId: string): Promise<UserActivityBaseline>;
    /**
     * Update baseline for a user based on a security event
     */
    updateBaseline(userId: string, event: SecurityEvent): Promise<void>;
    /**
     * Check if event is a credential change event
     */
    private isCredentialChangeEvent;
    /**
     * Record a credential change event
     */
    private recordCredentialChange;
    /**
     * Get the type of credential change
     */
    private getCredentialChangeType;
    /**
     * Check for unusual activity after recent credential change
     */
    private checkPostCredentialChangeActivity;
    /**
     * Check for activity from new device
     */
    private checkNewDevice;
    /**
     * Check for impossible travel
     */
    private checkImpossibleTravel;
    /**
     * Check for activity during unusual hours
     */
    private checkUnusualTimeActivity;
    /**
     * Check for access to sensitive resources
     */
    private checkSensitiveAccess;
    /**
     * Perform multi-signal fusion for compromise detection
     */
    private performSignalFusion;
    /**
     * Update user's activity baseline
     */
    private updateUserBaseline;
    /**
     * Update device tracking
     */
    private updateDeviceTracking;
    /**
     * Update location history
     */
    private updateLocationHistory;
    /**
     * Get recent locations for a user
     */
    private getRecentLocations;
    /**
     * Check if resource is sensitive
     */
    private isSensitiveResource;
    /**
     * Calculate distance between two points using Haversine formula
     */
    private calculateDistance;
    /**
     * Convert degrees to radians
     */
    private toRadians;
    /**
     * Format location for display
     */
    private formatLocation;
    /**
     * Save baseline to Redis
     */
    private saveBaseline;
    /**
     * Create empty baseline for new user
     */
    private createEmptyBaseline;
    /**
     * Calculate combined risk score
     */
    private calculateRiskScore;
    /**
     * Generate human-readable description
     */
    private generateDescription;
    /**
     * Create a detection result
     */
    private createResult;
    /**
     * Delete keys matching a pattern
     */
    private deleteKeysByPattern;
}
/**
 * Create a new account compromise detector instance
 */
export declare function createAccountCompromiseDetector(config?: Partial<AccountCompromiseDetectorConfig>, keyPrefix?: string): AccountCompromiseDetector;
export {};
//# sourceMappingURL=account-compromise.d.ts.map