《刺杀肯尼迪》与预言机攻击：暗杀作为数据操纵

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "@openzeppelin/contracts/access/Ownable.sol";
import "@openzeppelin/contracts/security/ReentrancyGuard.sol";

// 易受攻击的预言机合约
contract VulnerableOracle is Ownable, ReentrancyGuard {
    struct DataFeed {
        string name;
        uint256 value;
        uint256 timestamp;
        uint256 updateInterval;
        address provider;
        bool isActive;
    }
    
    struct ProviderInfo {
        string name;
        uint256 reputation;
        uint256 totalUpdates;
        uint256 stakeAmount;
        bool isRegistered;
        bool isActive;
    }
    
    mapping(bytes32 => DataFeed) public dataFeeds;
    mapping(address => ProviderInfo) public providers;
    
    bytes32[] public feedKeys;
    uint256 public constant MIN_STAKE = 1000 ether;
    uint256 public constant MAX_REPUTATION = 1000;
    uint256 public constant MULTI_SIG_THRESHOLD = 3;
    
    // 单点故障：只有一个数据源
    bytes32 public singleSourceFeed;
    address public singleProvider;
    
    event DataUpdated(bytes32 indexed feedKey, uint256 value, uint256 timestamp);
    event ProviderRegistered(address indexed provider, string name);
    event AttackDetected(bytes32 indexed feedKey, uint256 expectedValue, uint256 actualValue);
    
    constructor() {
        // 初始化一个单源数据源（易受攻击）
        singleProvider = msg.sender;
    }
    
    // 注册数据提供者
    function registerProvider(string memory _name) external payable {
        require(msg.value >= MIN_STAKE, "Insufficient stake");
        require(!providers[msg.sender].isRegistered, "Already registered");
        
        providers[msg.sender] = ProviderInfo({
            name: _name,
            reputation: 100,
            totalUpdates: 0,
            stakeAmount: msg.value,
            isRegistered: true,
            isActive: true
        });
        
        emit ProviderRegistered(msg.sender, _name);
    }
    
    // 单源数据更新（易受攻击）
    function updateSingleSourceFeed(uint256 _value) external {
        require(msg.sender == singleProvider, "Unauthorized provider");
        
        bytes32 feedKey = keccak256(abi.encodePacked("SINGLE_PRICE"));
        
        dataFeeds[feedKey] = DataFeed({
            name: "SINGLE_PRICE",
            value: _value,
            timestamp: block.timestamp,
            updateInterval: 1 hours,
            provider: msg.sender,
            isActive: true
        });
        
        singleSourceFeed = feedKey;
        
        emit DataUpdated(feedKey, _value, block.timestamp);
    }
    
    // 攻击者可以篡改单源数据
    function compromiseSingleSource(uint256 _fakeValue) external {
        // 攻击者通过某种方式控制了单源提供者
        // 比如：社会工程学攻击、私钥泄露、贿赂等
        // 在《刺杀肯尼迪》中，这相当于"篡改目击证词"
        
        // 假设攻击者已经获得了单源提供者的控制权
        // 这里模拟攻击者更新数据
        bytes32 feedKey = keccak256(abi.encodePacked("SINGLE_PRICE"));
        
        dataFeeds[feedKey] = DataFeed({
            name: "SINGLE_PRICE",
            value: _fakeValue,
            timestamp: block.timestamp,
            updateInterval: 1 hours,
            provider: singleProvider,  // 使用被攻破的提供者地址
            isActive: true
        });
        
        emit AttackDetected(feedKey, 0, _fakeValue);
    }
    
    // 多源数据聚合（更安全）
    function updateMultiSourceFeed(
        bytes32 _feedKey,
        uint256 _value,
        address[] memory _signers
    ) external {
        // 需要多个提供者签名
        require(_signers.length >= MULTI_SIG_THRESHOLD, "Insufficient signatures");
        
        for (uint256 i = 0; i < _signers.length; i++) {
            require(providers[_signers[i]].isRegistered, "Invalid provider");
            require(providers[_signers[i]].isActive, "Provider inactive");
        }
        
        DataFeed storage feed = dataFeeds[_feedKey];
        // 使用加权平均
        feed.value = (feed.value + _value) / 2;
        feed.timestamp = block.timestamp;
        feed.provider = address(this); // 多源聚合，提供者是合约本身
        feed.isActive = true;
        
        // 更新提供者信誉
        for (uint256 i = 0; i < _signers.length; i++) {
            if (providers[_signers[i]].reputation < MAX_REPUTATION) {
                providers[_signers[i]].reputation += 1;
            }
            providers[_signers[i]].totalUpdates++;
        }
        
        emit DataUpdated(_feedKey, feed.value, block.timestamp);
    }
    
    // 延迟更新攻击检测
    function detectStaleData(bytes32 _feedKey, uint256 _maxAge) external view returns (bool) {
        DataFeed storage feed = dataFeeds[_feedKey];
        return (block.timestamp - feed.timestamp) > _maxAge;
    }
    
    // 验证数据一致性
    function verifyDataConsistency(
        bytes32 _feedKey,
        uint256 _expectedValue,
        uint256 _tolerance
    ) external view returns (bool) {
        DataFeed storage feed = dataFeeds[_feedKey];
        uint256 diff = _expectedValue > feed.value 
            ? _expectedValue - feed.value 
            : feed.value - _expectedValue;
        return diff <= _tolerance;
    }
    
    // 惩罚不诚实提供者
    function slashProvider(address _provider, uint256 _penalty) external onlyOwner {
        ProviderInfo storage provider = providers[_provider];
        require(provider.isRegistered, "Provider not found");
        
        uint256 penalty = _penalty > provider.stakeAmount 
            ? provider.stakeAmount 
            : _penalty;
        
        provider.stakeAmount -= penalty;
        provider.reputation = provider.reputation > 50 
            ? provider.reputation - 50 
            : 0;
        
        if (provider.stakeAmount == 0) {
            provider.isActive = false;
        }
        
        payable(owner()).transfer(penalty);
    }
    
    function getFeedValue(bytes32 _feedKey) external view returns (uint256, uint256, address) {
        DataFeed storage feed = dataFeeds[_feedKey];
        return (feed.value, feed.timestamp, feed.provider);
    }
}

import pandas as pd
import numpy as np
from datetime import datetime, timedelta
from typing import Dict, List, Tuple, Optional
import matplotlib.pyplot as plt
import seaborn as sns
from dataclasses import dataclass
from collections import defaultdict
from sklearn.ensemble import IsolationForest
from sklearn.preprocessing import StandardScaler

@dataclass
class OracleUpdate:
    feed_key: str
    provider: str
    value: float
    timestamp: datetime
    block_number: int
    tx_hash: str
    is_valid: bool

@dataclass
class AttackScenario:
    attack_type: str
    description: str
    severity: str
    detected: bool
    impact: str

class OracleAttackAnalyzer:
    def __init__(self):
        self.updates = []
        self.providers = defaultdict(lambda: {
            'total_updates': 0,
            'avg_value': 0,
            'std_value': 0,
            'reputation': 100,
            'suspicious_count': 0
        })
        self.attack_patterns = {
            'flash_crash': '在短时间内大幅改变数据',
            'stale_data': '提供过时的数据',
            'sybil_attack': '创建多个虚假身份操纵数据',
            'front_running': '抢先交易操纵数据',
            'delay_attack': '延迟数据更新以制造套利机会'
        }
        
    def load_oracle_data(self, data: List[Dict]):
        """加载预言机数据，就像收集目击证词"""
        for item in data:
            update = OracleUpdate(
                feed_key=item['feed_key'],
                provider=item['provider'],
                value=item['value'],
                timestamp=datetime.fromtimestamp(item['timestamp']),
                block_number=item['block_number'],
                tx_hash=item['tx_hash'],
                is_valid=item.get('is_valid', True)
            )
            self.updates.append(update)
            
            stats = self.providers[update.provider]
            stats['total_updates'] += 1
            stats['values'] = stats.get('values', []) + [update.value]
    
    def anomaly_detection(self) -> pd.DataFrame:
        """异常检测，就像发现证词中的矛盾"""
        if len(self.updates) < 10:
            return pd.DataFrame()
        
        df = pd.DataFrame([{
            'feed_key': u.feed_key,
            'provider': u.provider,
            'value': u.value,
            'timestamp': u.timestamp,
            'hour': u.timestamp.hour,
            'day_of_week': u.timestamp.weekday(),
            'value_change': 0
        } for u in self.updates])
        
        # 计算值的变化
        df['value_change'] = df.groupby('feed_key')['value'].transform(
            lambda x: x.diff().fillna(0)
        )
        
        # 准备特征
        features = ['value', 'value_change', 'hour', 'day_of_week']
        X = df[features].fillna(0)
        
        # 使用隔离森林检测异常
        scaler = StandardScaler()
        X_scaled = scaler.fit_transform(X)
        
        iso_forest = IsolationForest(
            contamination=0.1,
            random_state=42,
            n_estimators=100
        )
        
        df['anomaly_score'] = iso_forest.fit_predict(X_scaled)
        df['is_anomaly'] = df['anomaly_score'] == -1
        
        # 找出异常数据点
        anomalies = df[df['is_anomaly']].copy()
        
        # 计算每个提供者的异常率
        provider_anomaly_rates = df.groupby('provider').agg({
            'is_anomaly': 'mean',
            'value': ['mean', 'std', 'count']
        }).round(3)
        
        print("\n[异常检测] 提供者异常率:")
        print(provider_anomaly_rates)
        
        return anomalies
    
    def detect_flash_crash_attack(self, threshold: float = 0.5) -> List[Dict]:
        """检测闪电崩盘攻击，就像发现证词中的突然变化"""
        flash_crashes = []
        
        df = pd.DataFrame([{
            'feed_key': u.feed_key,
            'provider': u.provider,
            'value': u.value,
            'timestamp': u.timestamp
        } for u in self.updates])
        
        for feed_key in df['feed_key'].unique():
            feed_data = df[df['feed_key'] == feed_key].sort_values('timestamp')
            
            for i in range(1, len(feed_data)):
                prev_val = feed_data.iloc[i-1]['value']
                curr_val = feed_data.iloc[i]['value']
                
                if prev_val > 0:
                    change_pct = abs(curr_val - prev_val) / prev_val
                    
                    if change_pct > threshold:
                        flash_crashes.append({
                            'feed_key': feed_key,
                            'timestamp': feed_data.iloc[i]['timestamp'],
                            'provider': feed_data.iloc[i]['provider'],
                            'previous_value': prev_val,
                            'current_value': curr_val,
                            'change_pct': change_pct,
                            'attack_type': 'flash_crash',
                            'severity': '高' if change_pct > 0.8 else '中'
                        })
        
        return flash_crashes
    
    def detect_provider_collusion(self) -> List[Dict]:
        """检测提供者合谋，就像发现串通作伪证"""
        collusion_cases = []
        
        # 分析提供者之间的数据相关性
        provider_data = defaultdict(list)
        for update in self.updates:
            provider_data[update.provider].append({
                'value': update.value,
                'timestamp': update.timestamp,
                'feed_key': update.feed_key
            })
        
        # 计算提供者之间的Pearson相关系数
        providers_list = list(provider_data.keys())
        for i in range(len(providers_list)):
            for j in range(i+1, len(providers_list)):
                p1_data = provider_data[providers_list[i]]
                p2_data = provider_data[providers_list[j]]
                
                # 对齐时间戳
                aligned_data = self._align_data(p1_data, p2_data)
                
                if len(aligned_data) > 5:
                    p1_values = [d[0] for d in aligned_data]
                    p2_values = [d[1] for d in aligned_data]
                    
                    correlation = np.corrcoef(p1_values, p2_values)[0, 1]
                    
                    # 高度相关可能表示合谋
                    if correlation > 0.95:
                        collusion_cases.append({
                            'provider_1': providers_list[i],
                            'provider_2': providers_list[j],
                            'correlation': correlation,
                            'data_points': len(aligned_data),
                            'severity': '高' if correlation > 0.98 else '中',
                            'suspicious': True
                        })
        
        return collusion_cases
    
    def _align_data(self, data1: List, data2: List) -> List[Tuple]:
        """对齐两个数据源的时间序列"""
        aligned = []
        for d1 in data1:
            for d2 in data2:
                time_diff = abs(
                    (d1['timestamp'] - d2['timestamp']).total_seconds()
                )
                if time_diff < 300 and d1['feed_key'] == d2['feed_key']:  # 5分钟内
                    aligned.append((d1['value'], d2['value']))
                    break
        return aligned
    
    def detect_stale_data_attack(self, max_age_hours: int = 24) -> List[Dict]:
        """检测过时数据攻击，就像发现陈旧的证据"""
        stale_attacks = []
        now = datetime.now()
        
        for update in self.updates:
            age_hours = (now - update.timestamp).total_seconds() / 3600
            
            if age_hours > max_age_hours:
                stale_attacks.append({
                    'feed_key': update.feed_key,
                    'provider': update.provider,
                    'value': update.value,
                    'age_hours': age_hours,
                    'timestamp': update.timestamp,
                    'attack_type': 'stale_data'
                })
        
        return stale_attacks
    
    def simulate_oracle_attack(
        self, feed_type: str, attack_vector: str
    ) -> Dict:
        """模拟预言机攻击，就像重演犯罪现场"""
        scenarios = {
            'single_source': {
                'description': '单源预言机攻击',
                'success_probability': 0.85,
                'detection_probability': 0.15,
                'impact': '数据被完全篡改，整个系统崩溃'
            },
            'multi_source_collusion': {
                'description': '多源共谋攻击',
                'success_probability': 0.45,
                'detection_probability': 0.65,
                'impact': '部分数据被篡改，但可能被检测到'
            },
            'front_running': {
                'description': '抢先交易攻击',
                'success_probability': 0.60,
                'detection_probability': 0.40,
                'impact': '利用时间差获取套利机会'
            },
            'delay_attack': {
                'description': '延迟更新攻击',
                'success_probability': 0.70,
                'detection_probability': 0.30,
                'impact': '利用过时数据制造套利机会'
            }
        }
        
        scenario = scenarios.get(attack_vector, {
            'description': '未知攻击',
            'success_probability': 0.5,
            'detection_probability': 0.5,
            'impact': '未知'
        })
        
        # 模拟攻击结果
        np.random.seed(42)
        attack_success = np.random.random() < scenario['success_probability']
        detection_success = np.random.random() < scenario['detection_probability']
        
        return {
            'feed_type': feed_type,
            'attack_vector': attack_vector,
            'scenario': scenario,
            'attack_success': attack_success,
            'detection_success': detection_success,
            'net_impact': '成功' if attack_success and not detection_success else '失败',
            'recommendation': self._get_recommendation(attack_vector)
        }
    
    def _get_recommendation(self, attack_vector: str) -> str:
        """获取防御建议"""
        recommendations = {
            'single_source': '使用多源预言机，设置多重签名验证',
            'multi_source_collusion': '引入随机化提供者选择机制，增加合谋成本',
            'front_running': '使用提交-揭示方案，隐藏真实数据',
            'delay_attack': '设置数据新鲜度检查，强制定期更新'
        }
        return recommendations.get(attack_vector, '加强安全审计')
    
    def visualize_attack_patterns(self):
        """可视化攻击模式"""
        fig, axes = plt.subplots(2, 2, figsize=(14, 12))
        
        # 1. 提供者数据分布
        ax1 = axes[0, 0]
        provider_values = defaultdict(list)
        for update in self.updates:
            provider_values[update.provider].append(update.value)
        
        for provider, values in provider_values.items():
            ax1.hist(values, alpha=0.5, label=provider[:10] + '...', bins=20)
        ax1.set_title('提供者数据分布')
        ax1.set_xlabel('数值')
        ax1.set_ylabel('频率')
        ax1.legend()
        
        # 2. 时间序列异常检测
        ax2 = axes[0, 1]
        df = pd.DataFrame([{
            'timestamp': u.timestamp,
            'value': u.value,
            'provider': u.provider
        } for u in self.updates])
        
        for provider in df['provider'].unique():
            provider_df = df[df['provider'] == provider]
            ax2.plot(provider_df['timestamp'], provider_df['value'], 
                    marker='o', label=provider[:10] + '...', alpha=0.7)
        ax2.set_title('数据更新时间序列')
        ax2.set_xlabel('时间')
        ax2.set_ylabel('数值')
        ax2.legend()
        
        # 3. 攻击向量风险矩阵
        ax3 = axes[1, 0]
        attack_vectors = list(self.attack_patterns.keys())
        success_probs = [0.85, 0.70, 0.45, 0.60, 0.70]
        detection_probs = [0.15, 0.30, 0.65, 0.40, 0.30]
        
        x = np.arange(len(attack_vectors))
        width = 0.35
        ax3.bar(x - width/2, success_probs, width, label='攻击成功率', color='red', alpha=0.7)
        ax3.bar(x + width/2, detection_probs, width, label='检测率', color='green', alpha=0.7)
        ax3.set_title('攻击向量风险矩阵')
        ax3.set_xticks(x)
        ax3.set_xticklabels(attack_vectors, rotation=45, ha='right')
        ax3.set_ylabel('概率')
        ax3.legend()
        
        # 4. 提供者信誉评分
        ax4 = axes[1, 1]
        providers_list = list(self.providers.keys())
        reputations = [self.providers[p]['reputation'] for p in providers_list]
        colors = ['green' if r > 80 else 'yellow' if r > 50 else 'red' for r in reputations]
        ax4.barh(range(len(providers_list)), reputations, color=colors)
        ax4.set_yticks(range(len(providers_list)))
        ax4.set_yticklabels([p[:12] + '...' for p in providers_list])
        ax4.set_title('提供者信誉评分')
        ax4.set_xlabel('信誉分')
        
        plt.tight_layout()
        return plt
    
    def generate_forensic_report(self) -> str:
        """生成取证报告，就像案件调查报告"""
        total_updates = len(self.updates)
        unique_providers = len(self.providers)
        unique_feeds = len(set(u.feed_key for u in self.updates))
        
        flash_crashes = self.detect_flash_crash_attack()
        collusion_cases = self.detect_provider_collusion()
        stale_attacks = self.detect_stale_data_attack()
        
        report = f"""
=== 预言机攻击取证报告 ===

【数据概况】
总更新次数: {total_updates}
活跃提供者数: {unique_providers}
数据源数量: {unique_feeds}
时间跨度: {self.updates[0].timestamp} - {self.updates[-1].timestamp}

【攻击检测结果】
闪电崩盘攻击: {len(flash_crashes)} 次
提供者合谋嫌疑: {len(collusion_cases)} 对
过时数据攻击: {len(stale_attacks)} 次

【高风险提供者】
"""
        for provider, stats in self.providers.items():
            if stats['reputation'] < 50:
                report += f"  {provider[:20]}... - 信誉: {stats['reputation']}\n"
        
        report += """
【防御建议】
1. 部署多源预言机聚合方案
2. 实现数据新鲜度检查机制
3. 引入提供者信誉惩罚系统
4. 使用零知识证明验证数据来源
5. 建立实时异常检测和警报系统
"""
        return report


# 使用示例
if __name__ == "__main__":
    analyzer = OracleAttackAnalyzer()
    
    # 模拟预言机数据
    sample_data = [
        {
            'feed_key': 'ETH/USD',
            'provider': '0xprovider1',
            'value': 3500.0 + np.random.normal(0, 10),
            'timestamp': (datetime.now() - timedelta(hours=i)).timestamp(),
            'block_number': 15000000 + i,
            'tx_hash': f'0xtx{i}',
            'is_valid': i not in [5, 15, 25]  # 部分数据无效
        }
        for i in range(100)
    ]
    
    # 添加一些异常数据
    sample_data.append({
        'feed_key': 'ETH/USD',
        'provider': '0xprovider1',
        'value': 100.0,  # 异常低值
        'timestamp': (datetime.now() - timedelta(hours=1)).timestamp(),
        'block_number': 15000100,
        'tx_hash': '0xattack_tx',
        'is_valid': False
    })
    
    analyzer.load_oracle_data(sample_data)
    
    # 异常检测
    anomalies = analyzer.anomaly_detection()
    print(f"检测到 {len(anomalies)} 个异常数据点")
    
    # 闪电崩盘检测
    flash_crashes = analyzer.detect_flash_crash_attack(threshold=0.3)
    print(f"检测到 {len(flash_crashes)} 次闪电崩盘攻击")
    
    # 取证报告
    report = analyzer.generate_forensic_report()
    print(report)

// 预言机安全监控前端
const Web3 = require('web3');
const axios = require('axios');

class OracleMonitor {
    constructor(providerUrl, oracleAddresses) {
        this.web3 = new Web3(providerUrl);
        this.oracleAddresses = oracleAddresses;
        this.dataFeeds = new Map();
        this.providers = new Map();
        this.alerts = [];
        this.monitoringIntervals = new Map();
    }
    
    // 启动监控
    async startMonitoring() {
        console.log('[预言机监控] 启动...');
        
        for (const [name, address] of Object.entries(this.oracleAddresses)) {
            await this.monitorOracle(name, address);
        }
        
        // 定期检查数据一致性
        setInterval(() => this.checkConsistency(), 60000);
        
        // 定期检查提供者信誉
        setInterval(() => this.checkProviderReputation(), 300000);
    }
    
    // 监控单个预言机
    async monitorOracle(name, address) {
        console.log(`[监控] 开始监控预言机: ${name}`);
        
        // 获取当前数据
        const feedData = await this.getFeedData(address);
        this.dataFeeds.set(name, feedData);
        
        // 设置定期更新
        const interval = setInterval(async () => {
            const newData = await this.getFeedData(address);
            const oldData = this.dataFeeds.get(name);
            
            // 检测数据变化
            if (oldData) {
                const change = Math.abs(newData.value - oldData.value) / oldData.value;
                if (change > 0.1) { // 10%变化
                    this.triggerAlert({
                        type: 'LARGE_PRICE_CHANGE',
                        feed: name,
                        oldValue: oldData.value,
                        newValue: newData.value,
                        change: change
                    });
                }
            }
            
            this.dataFeeds.set(name, newData);
        }, 10000);
        
        this.monitoringIntervals.set(name, interval);
    }
    
    // 获取喂价数据
    async getFeedData(address) {
        try {
            const contract = new this.web3.eth.Contract([], address);
            // 实际应用中需要正确的ABI
            const value = await contract.methods.latestAnswer().call();
            const timestamp = await contract.methods.latestTimestamp().call();
            const provider = await contract.methods.provider().call();
            
            return {
                value: this.web3.utils.fromWei(value, 'ether'),
                timestamp: new Date(timestamp * 1000),
                provider: provider,
                address: address
            };
        } catch (error) {
            console.error(`获取喂价数据失败: ${address}`, error);
            return null;
        }
    }
    
    // 触发警报
    triggerAlert(alert) {
        this.alerts.push({
            ...alert,
            timestamp: new Date(),
            id: `alert_${this.alerts.length + 1}`
        });
        
        console.log(`[警报] ${alert.type}: ${alert.feed}`);
        console.log(`  值变化: ${alert.oldValue} -> ${alert.newValue}`);
        console.log(`  变化率: ${(alert.change * 100).toFixed(1)}%`);
    }
    
    // 检查数据一致性
    async checkConsistency() {
        console.log('[一致性检查] 开始...');
        
        const feeds = Array.from(this.dataFeeds.entries());
        
        // 比较不同数据源的值
        for (let i = 0; i < feeds.length; i++) {
            for (let j = i + 1; j < feeds.length; j++) {
                const [name1, data1] = feeds[i];
                const [name2, data2] = feeds[j];
                
                if (data1 && data2) {
                    const diff = Math.abs(data1.value - data2.value);
                    const avg = (data1.value + data2.value) / 2;
                    
                    if (avg > 0 && diff / avg > 0.05) {
                        // 5%以上的差异触发警报
                        this.triggerAlert({
                            type: 'DATA_INCONSISTENCY',
                            feed1: name1,
                            feed2: name2,
                            value1: data1.value,
                            value2: data2.value,
                            diff: diff / avg
                        });
                    }
                }
            }
        }
    }
    
    // 检查提供者信誉
    async checkProviderReputation() {
        console.log('[信誉检查] 开始...');
        
        for (const [name, data] of this.dataFeeds) {
            if (data && data.provider) {
                // 检查提供者状态
                const providerInfo = this.providers.get(data.provider) || {
                    totalUpdates: 0,
                    lastUpdate: null,
                    avgUpdateInterval: 0,
                    updateHistory: []
                };
                
                providerInfo.totalUpdates++;
                providerInfo.lastUpdate = data.timestamp;
                providerInfo.updateHistory.push({
                    value: data.value,
                    timestamp: data.timestamp
                });
                
                this.providers.set(data.provider, providerInfo);
            }
        }
    }
    
    // 防御建议生成
    generateDefenseRecommendations() {
        const recommendations = [];
        
        // 检查数据源数量
        if (this.dataFeeds.size < 3) {
            recommendations.push({
                priority: '高',
                issue: '数据源数量不足',
                suggestion: '增加至少3个独立的预言机数据源'
            });
        }
        
        // 检查更新频率
        for (const [name, data] of this.dataFeeds) {
            if (data) {
                const age = (Date.now() - data.timestamp.getTime()) / 1000;
                if (age > 3600) {
                    recommendations.push({
                        priority: '高',
                        issue: `${name} 数据已过时 ${age} 秒`,
                        suggestion: '检查数据更新机制，确保及时更新'
                    });
                }
            }
        }
        
        // 检查提供者多样性
        const uniqueProviders = new Set();
        for (const [, data] of this.dataFeeds) {
            if (data && data.provider) {
                uniqueProviders.add(data.provider);
            }
        }
        if (uniqueProviders.size < 3) {
            recommendations.push({
                priority: '中',
                issue: '提供者多样性不足',
                suggestion: '引入更多独立数据提供者，避免单点故障'
            });
        }
        
        return recommendations;
    }
    
    // 生成安全报告
    generateSecurityReport() {
        const alerts = this.alerts;
        const totalAlerts = alerts.length;
        const criticalAlerts = alerts.filter(a => a.type === 'LARGE_PRICE_CHANGE').length;
        const inconsistencyAlerts = alerts.filter(a => a.type === 'DATA_INCONSISTENCY').length;
        
        return {
            summary: {
                totalAlerts,
                criticalAlerts,
                inconsistencyAlerts,
                monitoredFeeds: this.dataFeeds.size,
                activeProviders: this.providers.size
            },
            recentAlerts: alerts.slice(-10),
            providerHealth: Array.from(this.providers.entries()).map(
                ([addr, info]) => ({
                    address: addr,
                    totalUpdates: info.totalUpdates,
                    lastUpdate: info.lastUpdate,
                    health: info.totalUpdates > 100 ? '良好' : '需关注'
                })
            ),
            recommendations: this.generateDefenseRecommendations()
        };
    }
}

// 使用示例
const monitor = new OracleMonitor(
    'https://mainnet.infura.io/v3/YOUR_PROJECT_ID',
    {
        'ETH/USD': '0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419',
        'BTC/USD': '0xF4030086522a5bEEa4988F8cA5B36dbC97BeE88c',
        'LINK/USD': '0x2c1d072e956AFFC0D435Cb7AC38EF18d24d9127c'
    }
);

monitor.startMonitoring().then(() => {
    console.log('预言机监控系统已启动');
    
    // 每10分钟生成报告
    setInterval(() => {
        const report = monitor.generateSecurityReport();
        console.log('安全报告:', JSON.stringify(report, null, 2));
    }, 600000);
});