intelligence/behavior_intel.py

from __future__ import annotations

from typing import Any, Dict, List

from shield.models.evidence import Evidence


def collect_behavior_evidence(metadata: Dict[str, Any] | None) -> List[Evidence]:
    metadata = metadata if isinstance(metadata, dict) else {}
    evidence: List[Evidence] = []
    signups_hour = metadata.get("signups_last_hour") or metadata.get("signup_velocity_hour")
    actions_minute = metadata.get("actions_last_minute")
    session_age = metadata.get("session_age_seconds")

    if isinstance(signups_hour, (int, float)) and signups_hour >= 20:
        evidence.append(Evidence(
            source="behavior_intelligence",
            category="velocity_abuse",
            risk_score=82,
            weight=0.8,
            confidence=0.86,
            explanation="High signup velocity indicates coordinated account creation",
            metadata={"signups_last_hour": signups_hour},
        ))
    elif isinstance(signups_hour, (int, float)) and signups_hour >= 6:
        evidence.append(Evidence(
            source="behavior_intelligence",
            category="velocity_abuse",
            risk_score=55,
            weight=0.62,
            confidence=0.75,
            explanation="Elevated signup velocity detected",
            metadata={"signups_last_hour": signups_hour},
        ))

    if isinstance(actions_minute, (int, float)) and actions_minute >= 120:
        evidence.append(Evidence(
            source="behavior_intelligence",
            category="bot_automation",
            risk_score=72,
            weight=0.72,
            confidence=0.8,
            explanation="Action rate is unusually high for a human session",
            metadata={"actions_last_minute": actions_minute},
        ))

    if isinstance(session_age, (int, float)) and session_age <= 2 and actions_minute:
        evidence.append(Evidence(
            source="behavior_intelligence",
            category="bot_automation",
            risk_score=50,
            weight=0.5,
            confidence=0.68,
            explanation="Actions began immediately after session creation",
        ))

    return evidence