vs-coap-monitor

CoAP protocol intrusion detection for Craton Shield.

Overview

Monitors CoAP (Constrained Application Protocol) traffic for security anomalies. Uses longest-prefix matching for URI rules and token-bucket rate limiting. All state is stack-allocated with fixed-size arrays.

Detection Mechanisms

Configuration

use vs_coap_monitor::{CoapMonitor, UriAction, AllowedMethods};

let mut monitor = CoapMonitor::new();           // allow-by-default
// let mut monitor = CoapMonitor::new_deny_default(); // deny-by-default

// URI rules (prefix matching).
monitor.add_rule(b"/sensors", UriAction::Allow, AllowedMethods::GET_ONLY, 10).unwrap();
monitor.add_rule(b"/admin", UriAction::Block, AllowedMethods::ALL, 0).unwrap();
monitor.add_rule(
    b"/data",
    UriAction::Allow,
    AllowedMethods::new(true, true, false, false), // GET + POST
    5,
).unwrap();

// Amplification threshold (response/request size ratio).
monitor.set_amplification_threshold(10);

Inspection

let result = monitor.inspect(&msg);
// result.allowed     — whether the message should be forwarded
// result.alert_count — number of alerts (0-4)

// Check for amplification on response:
// `token` is the response's CoAP token (0-8 bytes); used together with
// `message_id` to match the original request and reduce false positives.
if let Some(alert) = monitor.check_amplification(message_id, token, response_payload_len, ts_us) {
    // handle amplification attack
}

Alert Source IDs

Limits

Most capacities scale with the capacity-large / capacity-xl Cargo features on vs-types-embedded. The URI pattern length is fixed.

Errors

• VsError::InvalidInput — empty or oversized URI prefix
• VsError::ResourceExhausted — rule capacity full

Changelog

See the workspace CHANGELOG for version history.

Feature Flags

See core/docs/feature-flags.md for the full workspace feature reference.

License

Apache-2.0. See LICENSE.