SecOps LLM for Supply Chain Anomaly Auditing

import json
import pandas as pd
from sklearn.ensemble import IsolationForest
import boto3

s3 = boto3.client('s3')
sns = boto3.client('sns')

# Configuration
ANOMALY_THRESHOLD = 0.5  # Adjust based on testing
SNS_TOPIC_ARN = 'arn:aws:sns:us-east-1:123456789012:supply-chain-anomalies'

def lambda_handler(event, context):
    bucket_name = event['Records'][0]['s3']['bucket']['name']
    file_key = event['Records'][0]['s3']['object']['key']
    
    try:
        # Download data from S3
        response = s3.get_object(Bucket=bucket_name, Key=file_key)
        data = response['Body'].read().decode('utf-8')
        df = pd.read_csv(io.StringIO(data))
        
        # Basic Data Cleaning and Preprocessing (Example)
        # Replace 'NaN' with 0 or appropriate imputation strategy
        df.fillna(0, inplace=True)
        # Ensure all columns are numeric for Isolation Forest
        numeric_cols = df.select_dtypes(include=['float64', 'int64']).columns
        df_numeric = df[numeric_cols]
        
        # Anomaly Detection using Isolation Forest
        # n_estimators: number of trees, contamination: expected proportion of outliers
        model = IsolationForest(n_estimators=100, contamination=ANOMALY_THRESHOLD, random_state=42)
        model.fit(df_numeric)
        
        # Predict anomalies (-1 for anomalies, 1 for inliers)
        df['anomaly_score'] = model.decision_function(df_numeric)
        df['is_anomaly'] = model.predict(df_numeric)
        
        # Filter for actual anomalies
        anomalies_df = df[df['is_anomaly'] == -1]
        
        # Prepare output for logging/alerting
        anomaly_records = []
        for index, row in anomalies_df.iterrows():
            anomaly_record = {
                'timestamp': pd.Timestamp.now().isoformat(),
                'source_file': file_key,
                'anomaly_score': row['anomaly_score'],
                'details': row.to_json()
            }
            anomaly_records.append(anomaly_record)
            
            # Send alert for high-severity anomalies
            if row['anomaly_score'] < -0.5: # Example threshold for high severity
                try:
                    sns.publish(
                        TopicArn=SNS_TOPIC_ARN,
                        Message=json.dumps({'alert': 'High-severity anomaly detected', 'details': anomaly_record}),
                        Subject='High-Severity Supply Chain Anomaly'
                    )
                except Exception as sns_e:
                    print(f"Error sending SNS notification: {sns_e}")

        # Save processed data with anomaly scores back to S3 (optional)
        output_key = file_key.replace('.csv', '_scored.csv')
        df.to_csv(f'/tmp/{output_key}', index=False)
        s3.upload_file(f'/tmp/{output_key}', bucket_name, output_key)
        
        # Log anomaly records to a system (e.g., DynamoDB - requires additional setup)
        # For this basic example, we'll just print
        print(f"Detected {len(anomaly_records)} anomalies.")
        # For production, integrate with DynamoDB or other logging services here.
        
        return {
            'statusCode': 200,
            'body': json.dumps(f'Anomaly detection complete for {file_key}. Found {len(anomaly_records)} anomalies.')
        }

    except Exception as e:
        print(f"Error processing file {file_key}: {e}")
        # Optionally send an error alert via SNS
        try:
            sns.publish(
                TopicArn=SNS_TOPIC_ARN,
                Message=json.dumps({'alert': 'Error processing supply chain data', 'error': str(e), 'file': file_key}),
                Subject='Error in Supply Chain Anomaly Detection'
            )
        except Exception as sns_e:
            print(f"Error sending error SNS notification: {sns_e}")
        
        return {
            'statusCode': 500,
            'body': json.dumps(f'Error processing file {file_key}: {e}')
        }

# --- To run this locally for testing (requires AWS credentials configured) ---
# import io
# if __name__ == '__main__':
#     # Create a dummy CSV file for testing
#     dummy_data = {
#         'timestamp': ['2023-10-27T10:00:00Z', '2023-10-27T10:05:00Z', '2023-10-27T10:10:00Z', '2023-10-27T10:15:00Z', '2023-10-27T10:20:00Z'],
#         'sensor_temp': [25.1, 25.3, 25.0, 45.0, 25.5], # Anomaly here
#         'sensor_humidity': [60.5, 61.0, 60.8, 62.0, 61.2],
#         'location_id': ['A1', 'A1', 'A1', 'A1', 'A1']
#     }
#     dummy_df = pd.DataFrame(dummy_data)
#     dummy_csv_path = '/tmp/dummy_data.csv'
#     dummy_df.to_csv(dummy_csv_path, index=False)
#     
#     # Mock S3 event
#     mock_event = {
#         'Records': [
#             {
#                 's3': {
#                     'bucket': {'name': 'your-test-bucket'},
#                     'object': {'key': 'test_data.csv'}
#                 }
#             }
#         ]
#     }
#     
#     # Mock S3 upload for testing 
#     def mock_upload_file(filename, bucket, key):
#         print(f"Mock upload: {filename} to {bucket}/{key}")
#     s3.upload_file = mock_upload_file
#     
#     # Mock SNS publish
#     def mock_publish(**kwargs):
#         print(f"Mock SNS Publish: {kwargs['Subject']} - {kwargs['Message']}")
#     sns.publish = mock_publish
#     
#     # Mock S3 get_object to read from the local file
#     def mock_get_object(**kwargs):
#         with open(dummy_csv_path, 'rb') as f:
#             return {'Body': io.BytesIO(f.read())}
#     s3.get_object = mock_get_object
#     
#     lambda_handler(mock_event, None)