/**
 * MITRE ATLAS Compliance Framework
 *
 * Maps security findings to MITRE ATLAS (Adversarial Threat Landscape for
 * Artificial-Intelligence Systems) techniques. ATLAS provides a knowledge
 * base of adversary tactics and techniques against AI systems.
 *
 * @see https://atlas.mitre.org/
 * @module compliance/frameworks/mitre-atlas
 */
/**
 * MITRE ATLAS Controls mapped from techniques
 *
 * Based on ATLAS Matrix version 4.5 (2024).
 * Controls are derived from ATLAS techniques and mapped to finding categories.
 */
export const MITRE_ATLAS_CONTROLS = [
    // ============================================================================
    // Reconnaissance Techniques
    // ============================================================================
    {
        id: "AML.T0000",
        framework: "MITRE-ATLAS",
        category: "Reconnaissance",
        title: "Search for Victim's Publicly Available Research Materials",
        description: "Adversaries may search for information about victim ML capabilities through research papers, blog posts, and documentation that reveal model architectures or training approaches.",
        keywords: [
            "reconnaissance",
            "public research",
            "model architecture",
            "documentation",
        ],
        findingCategories: [
            "sensitive-disclosure",
        ],
        severityThreshold: "low",
    },
    {
        id: "AML.T0001",
        framework: "MITRE-ATLAS",
        category: "Reconnaissance",
        title: "Search Public ML Model Repositories",
        description: "Adversaries may search public model repositories (HuggingFace, GitHub) to find models that can be used as starting points for attacks or to understand target systems.",
        keywords: [
            "model repositories",
            "huggingface",
            "public models",
        ],
        findingCategories: [
            "supply-chain-vuln",
        ],
        severityThreshold: "low",
    },
    {
        id: "AML.T0002",
        framework: "MITRE-ATLAS",
        category: "Reconnaissance",
        title: "Discover ML Model Ontology",
        description: "Adversaries gather information about an ML model's structure, inputs, outputs, and capabilities through direct or indirect queries.",
        keywords: [
            "model ontology",
            "model structure",
            "api probing",
        ],
        findingCategories: [
            "model-theft",
            "sensitive-disclosure",
        ],
        severityThreshold: "medium",
    },
    // ============================================================================
    // Resource Development Techniques
    // ============================================================================
    {
        id: "AML.T0010",
        framework: "MITRE-ATLAS",
        category: "Resource Development",
        title: "Acquire Public ML Artifacts",
        description: "Adversaries may acquire publicly available ML models, datasets, or tools to use in their attacks against victim systems.",
        keywords: [
            "public artifacts",
            "pretrained models",
            "datasets",
        ],
        findingCategories: [
            "supply-chain-vuln",
        ],
        severityThreshold: "low",
    },
    {
        id: "AML.T0011",
        framework: "MITRE-ATLAS",
        category: "Resource Development",
        title: "Develop Adversarial ML Tools",
        description: "Adversaries develop or acquire tools specifically designed to attack ML systems, including prompt injection frameworks, model extraction tools, or adversarial example generators.",
        keywords: [
            "adversarial tools",
            "attack frameworks",
            "jailbreak tools",
        ],
        findingCategories: [
            "prompt-injection",
        ],
        severityThreshold: "medium",
    },
    {
        id: "AML.T0012",
        framework: "MITRE-ATLAS",
        category: "Resource Development",
        title: "Poison Training Data",
        description: "Adversaries may poison public or private training datasets to embed backdoors or biases in models trained on that data.",
        keywords: [
            "data poisoning",
            "training data",
            "backdoors",
        ],
        findingCategories: [
            "training-data-poisoning",
            "integrity-failure",
        ],
        severityThreshold: "critical",
    },
    // ============================================================================
    // Initial Access Techniques
    // ============================================================================
    {
        id: "AML.T0020",
        framework: "MITRE-ATLAS",
        category: "Initial Access",
        title: "Supply Chain Compromise",
        description: "Adversaries may compromise supply chain components including ML frameworks, model repositories, or dependency packages to gain access to target systems.",
        keywords: [
            "supply chain",
            "compromised packages",
            "malicious dependencies",
        ],
        findingCategories: [
            "supply-chain-vuln",
            "dependency-vuln",
            "vulnerable-component",
        ],
        severityThreshold: "critical",
    },
    {
        id: "AML.T0021",
        framework: "MITRE-ATLAS",
        category: "Initial Access",
        title: "Publish Poisoned Model",
        description: "Adversaries publish poisoned or backdoored models to public repositories, hoping targets will download and deploy them.",
        keywords: [
            "poisoned model",
            "backdoored model",
            "malicious model",
        ],
        findingCategories: [
            "supply-chain-vuln",
            "training-data-poisoning",
        ],
        severityThreshold: "critical",
    },
    {
        id: "AML.T0022",
        framework: "MITRE-ATLAS",
        category: "Initial Access",
        title: "Compromise ML Development Environment",
        description: "Adversaries compromise ML development environments (notebooks, training pipelines) to inject malicious code or modify models.",
        keywords: [
            "development environment",
            "notebooks",
            "training pipeline",
        ],
        findingCategories: [
            "code-injection",
            "integrity-failure",
        ],
        severityThreshold: "critical",
    },
    // ============================================================================
    // ML Model Access Techniques
    // ============================================================================
    {
        id: "AML.T0030",
        framework: "MITRE-ATLAS",
        category: "ML Model Access",
        title: "ML API Exploitation",
        description: "Adversaries exploit APIs that provide access to ML models to perform attacks like model extraction, prompt injection, or data exfiltration.",
        keywords: [
            "api exploitation",
            "model api",
            "inference api",
        ],
        findingCategories: [
            "prompt-injection",
            "model-theft",
            "auth-bypass",
        ],
        severityThreshold: "high",
    },
    {
        id: "AML.T0031",
        framework: "MITRE-ATLAS",
        category: "ML Model Access",
        title: "Prompt Injection",
        description: "Adversaries craft inputs that manipulate an LLM to execute unintended actions, bypass safety controls, or leak sensitive information.",
        keywords: [
            "prompt injection",
            "jailbreak",
            "instruction override",
        ],
        findingCategories: [
            "prompt-injection",
            "injection",
        ],
        severityThreshold: "critical",
    },
    {
        id: "AML.T0032",
        framework: "MITRE-ATLAS",
        category: "ML Model Access",
        title: "Indirect Prompt Injection",
        description: "Adversaries inject malicious prompts through external data sources (documents, websites) that the LLM processes, causing it to execute attacker instructions.",
        keywords: [
            "indirect injection",
            "external data",
            "rag poisoning",
        ],
        findingCategories: [
            "prompt-injection",
            "insecure-plugin",
        ],
        severityThreshold: "critical",
    },
    // ============================================================================
    // Execution Techniques
    // ============================================================================
    {
        id: "AML.T0040",
        framework: "MITRE-ATLAS",
        category: "Execution",
        title: "User Execution of Malicious Prompt",
        description: "Adversaries trick users into executing malicious prompts that exploit the LLM to perform unauthorized actions.",
        keywords: [
            "user execution",
            "social engineering",
            "malicious prompt",
        ],
        findingCategories: [
            "prompt-injection",
        ],
        severityThreshold: "high",
    },
    {
        id: "AML.T0041",
        framework: "MITRE-ATLAS",
        category: "Execution",
        title: "Unsafe Model Loading",
        description: "Adversaries exploit unsafe model deserialization to execute arbitrary code when a model file is loaded (pickle, joblib, torch.load).",
        keywords: [
            "unsafe loading",
            "deserialization",
            "pickle",
            "code execution",
        ],
        findingCategories: [
            "code-injection",
            "supply-chain-vuln",
        ],
        severityThreshold: "critical",
    },
    {
        id: "AML.T0042",
        framework: "MITRE-ATLAS",
        category: "Execution",
        title: "Plugin/Tool Abuse",
        description: "Adversaries abuse LLM plugins or tools to execute unauthorized actions, access sensitive data, or escape the intended sandbox.",
        keywords: [
            "plugin abuse",
            "tool exploitation",
            "mcp",
            "function calling",
        ],
        findingCategories: [
            "insecure-plugin",
            "excessive-agency",
            "missing-sandbox",
        ],
        severityThreshold: "critical",
    },
    // ============================================================================
    // Persistence Techniques
    // ============================================================================
    {
        id: "AML.T0050",
        framework: "MITRE-ATLAS",
        category: "Persistence",
        title: "Poison Fine-Tuning Data",
        description: "Adversaries poison fine-tuning datasets to embed persistent backdoors or biases that survive model updates.",
        keywords: [
            "fine-tuning poisoning",
            "persistent backdoor",
            "model corruption",
        ],
        findingCategories: [
            "training-data-poisoning",
        ],
        severityThreshold: "critical",
    },
    {
        id: "AML.T0051",
        framework: "MITRE-ATLAS",
        category: "Persistence",
        title: "Inject Persistent System Prompt",
        description: "Adversaries inject persistent instructions into system prompts or configuration that persist across sessions.",
        keywords: [
            "persistent prompt",
            "system prompt injection",
            "configuration tampering",
        ],
        findingCategories: [
            "prompt-injection",
            "manifest-drift",
        ],
        severityThreshold: "high",
    },
    // ============================================================================
    // Defense Evasion Techniques
    // ============================================================================
    {
        id: "AML.T0060",
        framework: "MITRE-ATLAS",
        category: "Defense Evasion",
        title: "Evade ML-Based Detection",
        description: "Adversaries craft inputs to evade ML-based security controls like content filters, spam detectors, or prompt injection classifiers.",
        keywords: [
            "detection evasion",
            "filter bypass",
            "adversarial examples",
        ],
        findingCategories: [
            "prompt-injection",
        ],
        severityThreshold: "high",
    },
    {
        id: "AML.T0061",
        framework: "MITRE-ATLAS",
        category: "Defense Evasion",
        title: "Obfuscate Malicious Prompts",
        description: "Adversaries obfuscate malicious prompts using encoding, unicode tricks, or semantic variations to bypass detection.",
        keywords: [
            "obfuscation",
            "encoding",
            "unicode",
            "homoglyphs",
        ],
        findingCategories: [
            "prompt-injection",
        ],
        severityThreshold: "high",
    },
    // ============================================================================
    // Discovery Techniques
    // ============================================================================
    {
        id: "AML.T0070",
        framework: "MITRE-ATLAS",
        category: "Discovery",
        title: "Discover Model Architecture",
        description: "Adversaries probe the ML system to discover model architecture, hyperparameters, and capabilities through API queries.",
        keywords: [
            "model discovery",
            "architecture probing",
            "fingerprinting",
        ],
        findingCategories: [
            "model-theft",
            "sensitive-disclosure",
        ],
        severityThreshold: "medium",
    },
    {
        id: "AML.T0071",
        framework: "MITRE-ATLAS",
        category: "Discovery",
        title: "Extract System Prompt",
        description: "Adversaries craft prompts to extract the system prompt or hidden instructions from an LLM application.",
        keywords: [
            "system prompt extraction",
            "prompt leakage",
            "instruction disclosure",
        ],
        findingCategories: [
            "prompt-injection",
            "sensitive-disclosure",
        ],
        severityThreshold: "high",
    },
    {
        id: "AML.T0072",
        framework: "MITRE-ATLAS",
        category: "Discovery",
        title: "Enumerate Available Tools",
        description: "Adversaries enumerate available tools, plugins, or functions that the LLM can invoke to identify attack vectors.",
        keywords: [
            "tool enumeration",
            "plugin discovery",
            "capability mapping",
        ],
        findingCategories: [
            "sensitive-disclosure",
            "insecure-plugin",
        ],
        severityThreshold: "medium",
    },
    // ============================================================================
    // Collection Techniques
    // ============================================================================
    {
        id: "AML.T0080",
        framework: "MITRE-ATLAS",
        category: "Collection",
        title: "Data from ML Model",
        description: "Adversaries extract training data, memorized information, or sensitive data from ML models through carefully crafted queries.",
        keywords: [
            "data extraction",
            "memorization",
            "training data leakage",
        ],
        findingCategories: [
            "sensitive-disclosure",
            "pii-exposure",
        ],
        severityThreshold: "high",
    },
    {
        id: "AML.T0081",
        framework: "MITRE-ATLAS",
        category: "Collection",
        title: "Credential Harvesting via LLM",
        description: "Adversaries use the LLM to access or reveal credentials, API keys, or authentication tokens.",
        keywords: [
            "credential harvesting",
            "api key extraction",
            "secret disclosure",
        ],
        findingCategories: [
            "hardcoded-secret",
            "credential-overscoped",
            "exfil-path",
        ],
        severityThreshold: "critical",
    },
    // ============================================================================
    // ML Attack Staging Techniques
    // ============================================================================
    {
        id: "AML.T0090",
        framework: "MITRE-ATLAS",
        category: "ML Attack Staging",
        title: "Create Proxy Model",
        description: "Adversaries create a proxy/substitute model that mimics the target model's behavior for developing attacks offline.",
        keywords: [
            "proxy model",
            "substitute model",
            "model cloning",
        ],
        findingCategories: [
            "model-theft",
        ],
        severityThreshold: "medium",
    },
    {
        id: "AML.T0091",
        framework: "MITRE-ATLAS",
        category: "ML Attack Staging",
        title: "Generate Adversarial Examples",
        description: "Adversaries generate inputs specifically crafted to cause the model to produce incorrect or malicious outputs.",
        keywords: [
            "adversarial examples",
            "perturbations",
            "attack generation",
        ],
        findingCategories: [
            "prompt-injection",
        ],
        severityThreshold: "high",
    },
    // ============================================================================
    // Exfiltration Techniques
    // ============================================================================
    {
        id: "AML.T0100",
        framework: "MITRE-ATLAS",
        category: "Exfiltration",
        title: "Model Extraction",
        description: "Adversaries extract a copy of the ML model through repeated queries, allowing them to steal intellectual property or prepare offline attacks.",
        keywords: [
            "model extraction",
            "model stealing",
            "api abuse",
        ],
        findingCategories: [
            "model-theft",
        ],
        severityThreshold: "critical",
    },
    {
        id: "AML.T0101",
        framework: "MITRE-ATLAS",
        category: "Exfiltration",
        title: "Exfiltrate Data via Model Output",
        description: "Adversaries use the model as a covert channel to exfiltrate sensitive data by encoding it in model outputs.",
        keywords: [
            "data exfiltration",
            "covert channel",
            "output encoding",
        ],
        findingCategories: [
            "exfil-path",
            "sensitive-disclosure",
        ],
        severityThreshold: "critical",
    },
    {
        id: "AML.T0102",
        framework: "MITRE-ATLAS",
        category: "Exfiltration",
        title: "Exfiltrate via Tool Call",
        description: "Adversaries use LLM tool/function calls to exfiltrate data to external systems through authorized network channels.",
        keywords: [
            "tool exfiltration",
            "function call abuse",
            "data theft",
        ],
        findingCategories: [
            "exfil-path",
            "insecure-plugin",
        ],
        severityThreshold: "critical",
    },
    // ============================================================================
    // Impact Techniques
    // ============================================================================
    {
        id: "AML.T0110",
        framework: "MITRE-ATLAS",
        category: "Impact",
        title: "Denial of ML Service",
        description: "Adversaries cause denial of service by exhausting ML system resources through crafted queries or adversarial inputs.",
        keywords: [
            "denial of service",
            "resource exhaustion",
            "model dos",
        ],
        findingCategories: [
            "model-denial-of-service",
            "resource-exhaustion",
        ],
        severityThreshold: "high",
    },
    {
        id: "AML.T0111",
        framework: "MITRE-ATLAS",
        category: "Impact",
        title: "Manipulate Model Output",
        description: "Adversaries manipulate model outputs to cause incorrect decisions, spread misinformation, or cause harm to downstream systems.",
        keywords: [
            "output manipulation",
            "misinformation",
            "incorrect decisions",
        ],
        findingCategories: [
            "insecure-output",
            "prompt-injection",
        ],
        severityThreshold: "high",
    },
    {
        id: "AML.T0112",
        framework: "MITRE-ATLAS",
        category: "Impact",
        title: "Erode Trust in ML System",
        description: "Adversaries cause the ML system to produce outputs that erode user trust through hallucinations, biased responses, or harmful content.",
        keywords: [
            "trust erosion",
            "reputation damage",
            "harmful content",
        ],
        findingCategories: [
            "overreliance",
            "insecure-output",
        ],
        severityThreshold: "medium",
    },
];
/**
 * Get all MITRE ATLAS controls
 */
export function getMITREATLASControls() {
    return MITRE_ATLAS_CONTROLS;
}
/**
 * Get MITRE ATLAS control by technique ID
 */
export function getMITREATLASControlById(id) {
    return MITRE_ATLAS_CONTROLS.find((c) => c.id === id);
}
/**
 * Get MITRE ATLAS controls by tactic
 */
export function getMITREATLASControlsByTactic(tactic) {
    return MITRE_ATLAS_CONTROLS.filter((c) => c.category === tactic);
}
/**
 * Get all MITRE ATLAS tactics
 */
export function getMITREATLASTactics() {
    return [
        "Reconnaissance",
        "Resource Development",
        "Initial Access",
        "ML Model Access",
        "Execution",
        "Persistence",
        "Defense Evasion",
        "Discovery",
        "Collection",
        "ML Attack Staging",
        "Exfiltration",
        "Impact",
    ];
}
/**
 * Get mitigations for a specific technique
 */
export function getMitigationsForTechnique(techniqueId) {
    const mitigations = {
        "AML.T0031": [
            "Implement prompt injection detection",
            "Use privilege separation for system vs user prompts",
            "Apply output filtering and validation",
            "Use allowlisting for tool invocations",
        ],
        "AML.T0032": [
            "Sanitize all external data before processing",
            "Implement content security policies",
            "Use data provenance tracking",
            "Apply sandboxing for document processing",
        ],
        "AML.T0042": [
            "Apply principle of least privilege to tools",
            "Implement tool sandboxing",
            "Require explicit user confirmation for sensitive actions",
            "Monitor and log all tool invocations",
        ],
        "AML.T0100": [
            "Implement rate limiting on model APIs",
            "Use query obfuscation techniques",
            "Monitor for model extraction patterns",
            "Apply watermarking to model outputs",
        ],
        "AML.T0102": [
            "Implement egress filtering for tool network access",
            "Use data loss prevention controls",
            "Monitor tool call patterns for anomalies",
            "Apply network segmentation",
        ],
    };
    return mitigations[techniqueId] || [
        "Implement defense-in-depth controls",
        "Monitor for suspicious activity",
        "Apply least privilege principles",
    ];
}
/**
 * Map MITRE ATLAS technique to ATT&CK techniques
 */
export const ATLAS_TO_ATTACK_MAPPING = {
    "AML.T0020": ["T1195"], // Supply Chain Compromise
    "AML.T0022": ["T1059"], // Command Execution
    "AML.T0041": ["T1059.006"], // Python Execution
    "AML.T0081": ["T1552"], // Credentials in Files
    "AML.T0100": ["T1048"], // Exfiltration Over Alternative Protocol
    "AML.T0110": ["T1499"], // Endpoint Denial of Service
};
//# sourceMappingURL=mitre-atlas.js.map