Correlation Engine

Correlation Engine

GloomProxy correlates all offensive-security runtime data into unified attack intelligence. Correlation runs reactively on every new finding/replay/scan-finish event and can be triggered retroactively via the API.

What it detects

Analysis	Description
Exact duplicates	Same scanner + type + normalized URL — fingerprint collision
Near duplicates	Same type + similar URL, ≥65% 3-gram evidence similarity (cross-scanner)
Related findings	Different types on the same host within the same scan job
Attack chains	Multi-step exploit paths inferred from rule-based pattern matching
Endpoint clusters	Findings grouped by (host, path-prefix) with attack surface score
Replay lineage	Replay sessions → confirmed findings (verified vs derived)
Auth correlation	Auth sessions active during finding discovery on the same host

Attack chain rules

Chain inference applies ordered rules against findings on the same host. Each rule is a sequence of finding types matched by case-insensitive substring (e.g. "auth" matches authentication_bypass, auth_failure, etc.).

Chain	Steps	Confidence
Full Compromise	sql_injection → auth → idor	0.90
Auth Bypass → Privilege Escalation	auth → idor	0.85
File Upload → RCE	file_upload → rce	0.85
SQLi → Auth Bypass	sql_injection → auth	0.80
SSRF → Internal Pivot	ssrf → information_disclosure	0.80
IDOR → Data Exfiltration	idor → information_disclosure	0.80
XSS → CSRF / Session Hijack	xss → csrf	0.75
Path Traversal → Credential Disclosure	path_traversal → information_disclosure	0.75
Open Redirect → OAuth Token Steal	open_redirect → oauth	0.70
Information Disclosure → Auth Bypass	information_disclosure → auth	0.70
XSS → Stored XSS Persistence	reflected_xss → stored_xss (same path)	0.70
Injection → Lateral Movement	injection → ssrf	0.65

Risk score = geometric mean of step severities (info=0, low=1, medium=2, high=3, critical=4).

Correlation API

Method	Path	Description
GET	/api/correlation/summary	High-level counts across all findings
GET	/api/correlation/chains	Attack chains sorted by risk score desc
GET	/api/correlation/clusters	Endpoint clusters (host+path grouping)
GET	/api/correlation/duplicates	Duplicate/near-duplicate finding groups
GET	/api/correlation/lineage	Replay session → finding lineage
GET	/api/correlation/findings/{id}	All correlations anchored to a finding
POST	/api/correlation/run	Trigger full retroactive correlation pass

All responses include _vis hints (layout type, color, shape) for direct use by D3/Cytoscape frontends.