Class AbusePatternMonitor

java.lang.Object

com.svenruppert.jsentinel.credential.abuse.AbusePatternMonitor

public final class AbusePatternMonitor
extends Object

Higher-level abuse-pattern detector that sits next to the AbuseDetectionService.

Patterns

• AbusePattern.PASSWORD_SPRAYING — same client touches many distinct usernames inside a window.
• AbusePattern.CREDENTIAL_STUFFING — single username receives failures from many distinct clients.
• AbusePattern.RESET_ABUSE — single username or client generates many reset requests.

Each pattern keeps a privacy-minimised sliding-window record of timestamps + the distinct-target set hashed to a string key. When the configured threshold trips, the monitor emits an AbusePatternSignal through the provided signalSink — the signal carries aggregates only, never the usernames or client addresses themselves (CWE-359).

This is the in-memory reference implementation. Production multi-node deployments must replace the backing maps with a clustered store; see Konzept §13.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	AbusePatternMonitor.Config	Tunables for the three pattern detectors.

Constructor Summary

Constructors

Constructor	Description
AbusePatternMonitor(AbusePatternMonitor.Config config, Consumer<AbusePatternSignal> signalSink)

Method Summary

Modifier and Type	Method	Description
List<AbusePatternSignal>	observe(AbuseAttemptContext context, AttemptOutcome outcome)	Feed one attempt + outcome into the monitor.
Map<AbusePattern, Integer>	snapshotCardinalities()	Snapshot of internal state for diagnostics.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

AbusePatternMonitor

public AbusePatternMonitor(AbusePatternMonitor.Config config,
 Consumer<AbusePatternSignal> signalSink)

Method Details

observe

public List<AbusePatternSignal> observe(AbuseAttemptContext context,
 AttemptOutcome outcome)

Feed one attempt + outcome into the monitor. Detectors are evaluated independently; each may emit at most one signal per call.

snapshotCardinalities

public Map<AbusePattern, Integer> snapshotCardinalities()

Snapshot of internal state for diagnostics. The returned map is a copy; mutating it does not affect the monitor.