PrimusSaaS.Security.Heuristics 2.0.2

PrimusSaaS.Security.Heuristics

This package provides a fast, lightweight, and local-only security scanner for .NET applications. It uses regex-based heuristic analysis to detect suspicious code patterns and potential security risks without requiring any external AI services or API keys.

Features

• No AI Required: Runs entirely locally.
• Fast Execution: Uses compiled regular expressions for high-performance scanning.
• Configurable: Add your own custom regex patterns or disable default ones.
• Privacy-First: No code is sent to the cloud.

Installation

dotnet add package PrimusSaaS.Security.Heuristics

Usage

Register the analyzer in your dependency injection container:

using PrimusSaaS.Security.Heuristics;

// Default configuration
builder.Services.AddSingleton<IBehavioralAnalyzer, HeuristicBehavioralAnalyzer>();

// OR with custom options
builder.Services.AddSingleton<IBehavioralAnalyzer>(sp => 
 new HeuristicBehavioralAnalyzer(
 sp.GetRequiredService<ILogger<HeuristicBehavioralAnalyzer>>(),
 new HeuristicAnalyzerOptions 
 {
 IncludeDefaultPatterns = true,
 CustomPatterns = new List<CustomPatternDefinition>
 {
 new CustomPatternDefinition 
 {
 Name = "Forbidden Method",
 RegexPattern = @"\bDangerousMethod\b",
 Confidence = 0.9,
 Description = "This method is deprecated and unsafe."
 }
 }
 }
 ));

Default Patterns

The scanner detects patterns such as:

• Infinite loops (while(true))
• Suspicious delays (Thread.Sleep with large values)
• Dynamic assembly loading (Assembly.Load)
• Reflection usage (MethodInfo.Invoke)
• Unbounded file writes