Threat Detection & Security
Relevant source files
The following files were used as context for generating this wiki page:
The Threat Detection & Security system in MarketSage is a multi-layered framework designed to identify, analyze, and mitigate risks within e-commerce environments. It combines behavioral analysis, pattern recognition, and heuristics-based scam detection to provide real-time protection for users. The system operates across the background services, core security modules, and the user interface to ensure comprehensive coverage against phishing, fraudulent sellers, and price manipulation.
Sources: src/core/security/AdvancedThreatDetection.ts:1-10, src/background/services/protect/securityAnalyzer.ts:10-15
System Architecture
The security architecture is centered around the AdvancedThreatDetection service, which orchestrates various detection modules. It utilizes a ThreatIntelligence database containing known threat signatures, blacklisted sellers, and suspicious behavior patterns.
Core Components
The following diagram illustrates the flow of product analysis through the security ecosystem:
The system calculates a totalRiskScore based on weighted severities of detected threats:
- Low: 1 point
- Medium: 3 points
- High: 7 points
- Critical: 10 points
Sources: src/core/security/AdvancedThreatDetection.ts:80-130, src/core/security/AdvancedThreatDetection.ts:316-330
Detection Modules
1. Phishing and Website Security
This module analyzes URLs and product descriptions for phishing indicators. It checks for domain spoofing and suspicious redirect patterns.
Sources: src/core/security/AdvancedThreatDetection.ts:140-186
2. Scam Detection Model
The ScamDetectionModel runs specific heuristics to evaluate product legitimacy. It employs several specialized engines:
- AnomalyDetectionEngine: Detects price outliers.
- ImageAnalysisEngine: Evaluates image quality and brand consistency.
- SellerAnalysisEngine: Analyzes account age and listing volume.
- ReviewAnalyzer: Detects unusual spikes in 5-star reviews.
Sources: src/common/models/scamDetectionModel.ts:10-50, src/common/models/scamDetectionModel.ts:125-165
3. Pricing Risk Analysis
Security is also maintained by monitoring price volatility. The SecurityAnalyzer calculates a z-score for the current price relative to historical data stored in the system.
Sources: src/background/services/protect/securityAnalyzer.ts:68-85
Data Structures and Metrics
Threat Intelligence
The system maintains a stateful intelligence object to track known entities:
| Field | Type | Description |
|---|---|---|
knownThreats | Map<string, ThreatSignature> | Database of identified threat patterns. |
blacklistedSellers | Set<string> | IDs of sellers explicitly blocked for fraud. |
suspiciousPatterns | BehavioralPattern[] | List of behaviors flagged for monitoring. |
lastUpdated | number | Timestamp of the last intelligence sync. |
Sources: src/core/security/AdvancedThreatDetection.ts:58-69
Security Levels
Users are classified into security tiers, which determine the depth of analysis available in the EnhancedProtectSection:
| Level | Features Enabled |
|---|---|
| Basic | Standard scanning, basic risk assessment. |
| Enhanced | Advanced threat detection, threat history. |
| Premium | AI-enhanced detection, detailed reports, real-time protection. |
Sources: src/popup/components/protect/EnhancedProtectSection.tsx:45-55, src/popup/components/protect/EnhancedProtectSection.tsx:238-255
Security Utilities and Sanitization
The SecurityUtils class provides low-level protection against common web vulnerabilities, specifically focusing on XSS prevention and CSRF protection.
Input Sanitization Flow
Key security functions include:
constantTimeCompare: Prevents timing attacks during token validation.generateCSRFToken: Usescrypto.getRandomValuesfor cryptographically secure token generation.isUrlAllowed: Implements domain-based allow-listing.
Sources: src/common/security/SecurityUtils.ts:32-60, src/common/security/SecurityUtils.ts:133-160
Monitoring and Alerts
The MarketplaceMonitoringDashboard provides a real-time stream of security events. It tracks metrics such as threatsDetected, threatsBlocked, and incidentTrends.
Alert Thresholds
The system triggers alerts when metrics exceed defined safety boundaries:
- Response Time: > 3000ms
- Error Rate: > 5%
- Security Score: < 70
- Threat Count: > 10
Sources: src/core/monitoring/MarketplaceMonitoringDashboard.ts:140-155, src/core/monitoring/MarketplaceMonitoringDashboard.ts:466-485
Conclusion
MarketSage's security architecture is a proactive defense system. By combining front-end UI indicators (Safety and Trust scores) with complex background heuristics and a robust sanitization layer, it provides a hardened environment for marketplace interactions. The modular nature of the AdvancedThreatDetection service allows for the independent scaling of phishing, seller, and pricing analysis components.
Sources: src/core/security/AdvancedThreatDetection.ts:355-385, src/popup/components/protect/EnhancedProtectSection.tsx:170-195