import type { Detector, DetectionResult, SecurityEvent } from '../types.js';
/**
 * Configuration for data exfiltration detection
 */
export interface DataExfiltrationDetectorConfig {
    /** Maximum records accessed per 15 minutes before alerting */
    maxRecordsPerWindow: number;
    /** Maximum download volume in bytes per hour */
    maxDownloadBytesPerHour: number;
    /** Maximum bulk export size in records */
    maxBulkExportRecords: number;
    /** Data sensitivity classifications */
    dataSensitivity: Record<string, number>;
    /** High-risk export formats */
    riskyExportFormats: string[];
    /** Velocity threshold multiplier vs baseline */
    velocityThresholdMultiplier: number;
    /** Enable scope analysis (access outside normal data scope) */
    enableScopeAnalysis: boolean;
}
export declare const DEFAULT_DATA_EXFILTRATION_CONFIG: DataExfiltrationDetectorConfig;
/**
 * User's data access baseline
 */
interface DataAccessBaseline {
    userId: string;
    /** Average records accessed per hour */
    avgRecordsPerHour: number;
    /** Standard deviation of records per hour */
    stdDevRecordsPerHour: number;
    /** Average download bytes per hour */
    avgBytesPerHour: number;
    /** Standard deviation of bytes per hour */
    stdDevBytesPerHour: number;
    /** Normal data scopes accessed */
    normalScopes: string[];
    /** Normal data types accessed */
    normalDataTypes: string[];
    /** Export frequency (per day) */
    avgExportsPerDay: number;
    /** Total events tracked */
    totalEvents: number;
    /** Rolling sample count */
    sampleCount: number;
    /** Last updated */
    lastUpdated: string;
}
/**
 * Data exfiltration anomaly detector
 */
export declare class DataExfiltrationDetector implements Detector {
    readonly name = "data-exfiltration";
    readonly description = "Detects bulk data exports, unusual download volumes, and access outside normal scope";
    private readonly config;
    private readonly redis;
    private readonly keyPrefix;
    constructor(config?: Partial<DataExfiltrationDetectorConfig>, keyPrefix?: string);
    /**
     * Analyze an event for data exfiltration anomalies
     */
    detect(event: SecurityEvent): Promise<DetectionResult>;
    /**
     * Learn from an event by updating baselines
     */
    learn(event: SecurityEvent): Promise<void>;
    /**
     * Reset all learned baselines
     */
    reset(): Promise<void>;
    /**
     * Get baseline for a specific user
     */
    getBaseline(userId: string): Promise<DataAccessBaseline>;
    /**
     * Check if event is data access related
     */
    private isDataAccessEvent;
    /**
     * Check for bulk data exports
     */
    private checkBulkExport;
    /**
     * Check for unusual download volumes
     */
    private checkVolumeAnomaly;
    /**
     * Check for high-velocity access patterns
     */
    private checkVelocityAnomaly;
    /**
     * Check for access outside normal scope
     */
    private checkScopeAnomaly;
    /**
     * Check data sensitivity level
     */
    private checkDataSensitivity;
    /**
     * Update velocity tracking for current window
     */
    private updateVelocityTracking;
    /**
     * Update user's data access baseline
     */
    private updateBaseline;
    /**
     * Update scope tracking
     */
    private updateScopeTracking;
    /**
     * Get recent scopes accessed
     */
    private getRecentScopes;
    /**
     * Get hourly byte count
     */
    private getHourlyBytes;
    /**
     * Extract record count from metadata
     */
    private extractRecordCount;
    /**
     * Extract byte count from metadata
     */
    private extractByteCount;
    /**
     * Get data sensitivity level
     */
    private getDataSensitivity;
    /**
     * Format bytes for display
     */
    private formatBytes;
    /**
     * Create empty baseline for new user
     */
    private createEmptyBaseline;
    /**
     * Calculate combined risk score
     */
    private calculateRiskScore;
    /**
     * Generate human-readable description
     */
    private generateDescription;
    /**
     * Create a detection result
     */
    private createResult;
    /**
     * Delete keys matching a pattern
     */
    private deleteKeysByPattern;
}
/**
 * Create a new data exfiltration detector instance
 */
export declare function createDataExfiltrationDetector(config?: Partial<DataExfiltrationDetectorConfig>, keyPrefix?: string): DataExfiltrationDetector;
export {};
//# sourceMappingURL=data-exfiltration.d.ts.map