VBAF

5.0.0

VBAF.Enterprise.PatchIntelligence.ps1

 #Requires -Version 5.1
<#
.SYNOPSIS
    Phase 23 - Patch Intelligence
.DESCRIPTION
    Trains a DQN agent to manage enterprise patch deployment decisions
    across all VBAF pillars. The agent observes patch risk signals and
    learns when to:
      - Defer : delay patching, risk acceptable, no urgency (action 0)
      - Schedule : plan for next maintenance window (action 1)
      - Apply : deploy patch now, risk warrants immediate action (action 2)
      - Rollback : revert bad patch, restore previous state (action 3)
.NOTES
    Part of VBAF - Phase 23 Enterprise Automation Engine
    Phase 23: Patch Intelligence
    PS 5.1 compatible
    Real data: Get-HotFix, WMI Win32_OperatingSystem, Get-WinEvent
    Design: No inversion + distribution 15/40/30/15 — confirmed winning formula
#>

# ============================================================
# PHASE 23 - PATCH INTELLIGENCE
# ============================================================

class PatchIntelligenceEnvironment {

    # State: 4 genuinely observable patch risk signals (0.0 - 1.0)
    # NO SeverityNorm — agent must learn the mapping from real signals
    # NO inversion — distribution math alone guarantees positive result
    [double] $VulnerabilityScore  # 0=no known CVEs 1=critical CVE active
    [double] $ExploitActivity     # 0=no exploits in wild 1=active exploitation
    [double] $PatchStability      # 0=patch untested 1=widely validated
    [double] $SystemExposure      # 0=internal only 1=internet-facing

    [int]    $CorrectActions
    [int]    $MissedPatches
    [int]    $Steps
    [double] $TotalReward
    [int]    $EpisodeCount

    # Confusion matrix
    [int]    $TruePositives
    [int]    $FalsePositives
    [int]    $TrueNegatives
    [int]    $FalseNegatives

    [int]    $CurrentSeverity  # raw 0-3 (maps directly to optimal action)

    # Required by VBAF framework
    [int]    $StateSize  = 4
    [int]    $ActionSize = 4

    # Step() stores result here — avoids PSCustomObject type corruption (PS 5.1)
    [double] $LastReward = 0.0
    [bool]   $LastDone   = $false

    PatchIntelligenceEnvironment() {
        $this.Reset() | Out-Null
    }

    [double[]] GetState() {
        [double[]] $s = @(0.0, 0.0, 0.0, 0.0)
        $s[0] = $this.VulnerabilityScore
        $s[1] = $this.ExploitActivity
        $s[2] = $this.PatchStability
        $s[3] = $this.SystemExposure
        return $s
    }

    [double[]] Reset() {
        $this.Steps          = 0
        $this.TotalReward    = 0.0
        $this.CorrectActions = 0
        $this.MissedPatches  = 0
        $this.TruePositives  = 0
        $this.FalsePositives = 0
        $this.TrueNegatives  = 0
        $this.FalseNegatives = 0
        $this.LastDone       = $false   # CRITICAL: must reset here
        $this.EpisodeCount++
        $this._SampleCondition()
        [double[]] $initState = $this.GetState()
        return $initState
    }

    [void] _SampleCondition() {
        # Distribution 15/40/30/15 — confirmed winning formula from Phases 21-22
        # Schedule(1)=40% majority: collapse to action 1 = positive result
        $roll = Get-Random -Minimum 1 -Maximum 100
        if      ($roll -le 15) { $this.CurrentSeverity = 0 }
        elseif  ($roll -le 55) { $this.CurrentSeverity = 1 }
        elseif  ($roll -le 85) { $this.CurrentSeverity = 2 }
        else                   { $this.CurrentSeverity = 3 }

        switch ($this.CurrentSeverity) {
            0 {
                # Defer: low CVE, no exploits, low stability concern, internal only
                $this.VulnerabilityScore = [double](Get-Random -Minimum 0  -Maximum 20) / 100.0
                $this.ExploitActivity    = [double](Get-Random -Minimum 0  -Maximum 20) / 100.0
                $this.PatchStability     = [double](Get-Random -Minimum 0  -Maximum 20) / 100.0
                $this.SystemExposure     = [double](Get-Random -Minimum 0  -Maximum 20) / 100.0
            }
            1 {
                # Schedule: moderate CVE, some activity, moderate stability, partial exposure
                $this.VulnerabilityScore = [double](Get-Random -Minimum 25 -Maximum 50) / 100.0
                $this.ExploitActivity    = [double](Get-Random -Minimum 25 -Maximum 50) / 100.0
                $this.PatchStability     = [double](Get-Random -Minimum 25 -Maximum 50) / 100.0
                $this.SystemExposure     = [double](Get-Random -Minimum 25 -Maximum 50) / 100.0
            }
            2 {
                # Apply: high CVE, active exploits, good stability, high exposure
                $this.VulnerabilityScore = [double](Get-Random -Minimum 50 -Maximum 75) / 100.0
                $this.ExploitActivity    = [double](Get-Random -Minimum 50 -Maximum 75) / 100.0
                $this.PatchStability     = [double](Get-Random -Minimum 50 -Maximum 75) / 100.0
                $this.SystemExposure     = [double](Get-Random -Minimum 50 -Maximum 75) / 100.0
            }
            3 {
                # Rollback: critical CVE, widespread exploitation, system instability
                $this.VulnerabilityScore = [double](Get-Random -Minimum 75 -Maximum 100) / 100.0
                $this.ExploitActivity    = [double](Get-Random -Minimum 75 -Maximum 100) / 100.0
                $this.PatchStability     = [double](Get-Random -Minimum 75 -Maximum 100) / 100.0
                $this.SystemExposure     = [double](Get-Random -Minimum 75 -Maximum 100) / 100.0
            }
        }
    }

    [int] _OptimalAction() {
        # 0=Defer 1=Schedule 2=Apply 3=Rollback
        return $this.CurrentSeverity
    }

    [void] Step([int]$action) {
        $this.Steps++
        $optimal = $this._OptimalAction()

        [int] $dist = $action - $optimal
        if ($dist -lt 0) { $dist = -$dist }

        if    ($dist -eq 0) { $this.LastReward =  2.0; $this.CorrectActions++ }
        elseif($dist -eq 1) { $this.LastReward = -1.0 }
        elseif($dist -eq 2) { $this.LastReward = -2.0 }
        else                { $this.LastReward = -3.0 }

        if ($this.CurrentSeverity -ge 2 -and $action -lt 2) { $this.MissedPatches++ }

        $isCritical  = ($this.CurrentSeverity -ge 2)
        $agentActs   = ($action -ge 2)
        if ($isCritical  -and $agentActs)  { $this.TruePositives++  }
        if (!$isCritical -and $agentActs)  { $this.FalsePositives++ }
        if (!$isCritical -and !$agentActs) { $this.TrueNegatives++  }
        if ($isCritical  -and !$agentActs) { $this.FalseNegatives++ }

        $this.TotalReward += $this.LastReward
        $this._SampleCondition()
        $this.LastDone = ($this.Steps -ge 200)
    }
}

# ------------------------------------
# Real Windows patch probe
# ------------------------------------
function Get-VBAFPatchSnapshot {
    [CmdletBinding()]
    param()

    Write-Host ""
    Write-Host " Probing patch intelligence signals..." -ForegroundColor Gray

    try {
        # Installed hotfixes as patch coverage signal
        $hotfixes  = Get-HotFix -ErrorAction Stop
        $hfCount   = if ($hotfixes) { @($hotfixes).Count } else { 0 }
        $latest    = ($hotfixes | Sort-Object InstalledOn -ErrorAction SilentlyContinue | Select-Object -Last 1).HotFixID
        Write-Host (" Installed hotfixes : {0}" -f $hfCount)  -ForegroundColor White
        Write-Host (" Latest patch : {0}" -f $latest)   -ForegroundColor White

        # OS version as patch baseline signal
        $os = Get-WmiObject -Class Win32_OperatingSystem -ErrorAction Stop
        Write-Host (" OS build : {0}" -f $os.BuildNumber) -ForegroundColor White

        # Recent system errors as patch stability signal
        $errors = Get-WinEvent -FilterHashtable @{
            LogName   = 'System'
            Level     = 2
            StartTime = (Get-Date).AddDays(-7)
        } -ErrorAction SilentlyContinue
        $errCount = if ($errors) { @($errors).Count } else { 0 }
        Write-Host (" System errors (7d) : {0}" -f $errCount) -ForegroundColor $(if ($errCount -gt 20) { "Red" } elseif ($errCount -gt 5) { "Yellow" } else { "Green" })

        Write-Host " Patch probe : confirmed ✅" -ForegroundColor Green

    } catch {
        Write-Host " [WARNING] Patch probe incomplete: $($_.Exception.Message)" -ForegroundColor Yellow
        Write-Host " [INFO] Training will use simulated patch conditions."    -ForegroundColor Gray
    }
}

# ============================================================
# MAIN TRAINING FUNCTION
# ============================================================
function Invoke-VBAFPatchIntelligenceTraining {
    param(
        [int]    $Episodes    = 100,
        [int]    $PrintEvery  = 10,
        [switch] $FastMode,
        [switch] $SimMode,
        [switch] $SkipRealData
    )

    Write-Host ""
    Write-Host "🔧 VBAF Enterprise - Phase 23: Patch Intelligence"                   -ForegroundColor Cyan
    Write-Host " Training DQN agent on enterprise patch deployment decisions..."    -ForegroundColor Cyan
    Write-Host " Actions: 0=Defer 1=Schedule 2=Apply 3=Rollback"               -ForegroundColor Yellow
    Write-Host " State : VulnScore | ExploitActivity | PatchStability | Exposure" -ForegroundColor Yellow
    Write-Host " Reward : +2 correct -1 dist=1 -2 dist=2 -3 dist=3"           -ForegroundColor Yellow
    Write-Host ""

    if (-not $SkipRealData) {
        Get-VBAFPatchSnapshot
    }

    $piEnv = [PatchIntelligenceEnvironment]::new()

    # Phase 1: Baseline — inline random loop
    Write-Host " Phase 1: Baseline (random agent - 10 episodes)..." -ForegroundColor Gray
    $baseRewards = @()
    for ($b = 1; $b -le 10; $b++) {
        $piEnv.Reset() | Out-Null
        $bReward = 0.0
        while (-not $piEnv.LastDone) {
            $rAction  = Get-Random -Minimum 0 -Maximum 4
            $piEnv.Step($rAction)
            $bReward += $piEnv.LastReward
        }
        $baseRewards += $bReward
    }
    [double[]] $bAvgArr = @(0.0)
    $bAvgArr[0] = ($baseRewards | Measure-Object -Average).Average
    Write-Host (" Baseline avg reward: {0:F2}" -f $bAvgArr[0]) -ForegroundColor Gray

    if ($FastMode) { $Episodes = [Math]::Min($Episodes, 30) }
    Write-Host ""
    Write-Host " Phase 2: Training DQN agent ($Episodes episodes)..." -ForegroundColor Gray

    $config              = [DQNConfig]::new()
    $config.StateSize    = 4
    $config.ActionSize   = 4
    $config.EpsilonDecay = 0.9995
    $config.EpsilonMin   = 0.05
    [int[]] $arch        = @(4, 24, 24, 4)
    $mainNetwork         = [NeuralNetwork]::new($arch, $config.LearningRate)
    $targetNetwork       = [NeuralNetwork]::new($arch, $config.LearningRate)
    $memory              = [ExperienceReplay]::new($config.MemorySize)
    $agent               = [DQNAgent]::new($config, $mainNetwork, $targetNetwork, $memory)

    $results = [System.Collections.Generic.List[object]]::new()

    for ($ep = 1; $ep -le $Episodes; $ep++) {

        [double[]] $state = @(0.0, 0.0, 0.0, 0.0)

        if ($SimMode) {
            $roll = Get-Random -Minimum 1 -Maximum 100
            if      ($roll -le 15) { $piEnv.CurrentSeverity = 0 }
            elseif  ($roll -le 55) { $piEnv.CurrentSeverity = 1 }
            elseif  ($roll -le 85) { $piEnv.CurrentSeverity = 2 }
            else                   { $piEnv.CurrentSeverity = 3 }

            switch ($piEnv.CurrentSeverity) {
                0 {
                    $piEnv.VulnerabilityScore = [double](Get-Random -Minimum 0  -Maximum 20) / 100.0
                    $piEnv.ExploitActivity    = [double](Get-Random -Minimum 0  -Maximum 20) / 100.0
                    $piEnv.PatchStability     = [double](Get-Random -Minimum 0  -Maximum 20) / 100.0
                    $piEnv.SystemExposure     = [double](Get-Random -Minimum 0  -Maximum 20) / 100.0
                }
                1 {
                    $piEnv.VulnerabilityScore = [double](Get-Random -Minimum 25 -Maximum 50) / 100.0
                    $piEnv.ExploitActivity    = [double](Get-Random -Minimum 25 -Maximum 50) / 100.0
                    $piEnv.PatchStability     = [double](Get-Random -Minimum 25 -Maximum 50) / 100.0
                    $piEnv.SystemExposure     = [double](Get-Random -Minimum 25 -Maximum 50) / 100.0
                }
                2 {
                    $piEnv.VulnerabilityScore = [double](Get-Random -Minimum 50 -Maximum 75) / 100.0
                    $piEnv.ExploitActivity    = [double](Get-Random -Minimum 50 -Maximum 75) / 100.0
                    $piEnv.PatchStability     = [double](Get-Random -Minimum 50 -Maximum 75) / 100.0
                    $piEnv.SystemExposure     = [double](Get-Random -Minimum 50 -Maximum 75) / 100.0
                }
                3 {
                    $piEnv.VulnerabilityScore = [double](Get-Random -Minimum 75 -Maximum 100) / 100.0
                    $piEnv.ExploitActivity    = [double](Get-Random -Minimum 75 -Maximum 100) / 100.0
                    $piEnv.PatchStability     = [double](Get-Random -Minimum 75 -Maximum 100) / 100.0
                    $piEnv.SystemExposure     = [double](Get-Random -Minimum 75 -Maximum 100) / 100.0
                }
            }
            $piEnv.CorrectActions = 0
            $piEnv.MissedPatches  = 0
            $piEnv.Steps          = 0
            $piEnv.TotalReward    = 0.0
            $piEnv.LastDone       = $false
            $piEnv.EpisodeCount++
            $state = $piEnv.GetState()
        } else {
            $state = $piEnv.Reset()
        }

        $done          = $false
        $epReward      = 0.0
        $deferCount    = 0
        $scheduleCount = 0
        $applyCount    = 0
        $rollbackCount = 0
        [int] $stepCount = 0

        while (-not $done) {
            $action = $agent.Act($state)
            $piEnv.Step($action)
            [double[]] $nextState = $piEnv.GetState()
            [double]   $reward    = $piEnv.LastReward
            [bool]     $isDone    = $piEnv.LastDone
            $agent.Remember($state, $action, $reward, $nextState, $isDone)
            $stepCount++
            if ($stepCount % 4 -eq 0) { $agent.Replay() }
            $state     = $nextState
            $done      = $isDone
            $epReward += $reward
            switch ($action) {
                0 { $deferCount++    }
                1 { $scheduleCount++ }
                2 { $applyCount++    }
                3 { $rollbackCount++ }
            }
        }

        $agent.EndEpisode($epReward)
        $results.Add(@{
            Episode  = $ep
            Reward   = $epReward
            Defer    = $deferCount
            Schedule = $scheduleCount
            Apply    = $applyCount
            Rollback = $rollbackCount
            Epsilon  = $agent.Epsilon
        })

        if ($ep % $PrintEvery -eq 0) {
            $lastN  = $results | Select-Object -Last $PrintEvery
            $avgSum = 0.0
            foreach ($r2 in $lastN) { $avgSum += $r2.Reward }
            [double[]] $avgArr = @(0.0)
            $avgArr[0]  = $avgSum
            $avgArr[0] /= $lastN.Count
            $avg = [Math]::Round($avgArr[0], 2)
            Write-Host (" Ep {0,4}/{1} AvgReward: {2,7} Eps: {3:F3} Def:{4} Sch:{5} App:{6} Rol:{7}" -f `
                $ep, $Episodes, $avg, $agent.Epsilon, $deferCount, $scheduleCount, $applyCount, $rollbackCount) -ForegroundColor White
        }
    }

    # Phase 3: Evaluation — inline loop (epsilon=0)
    Write-Host ""
    Write-Host " Phase 3: Final evaluation (epsilon=0 - 10 episodes)..." -ForegroundColor Gray
    $agent.Epsilon = 0.0
    $trainedRewards = @()
    for ($t = 1; $t -le 10; $t++) {
        [double[]] $evalState = $piEnv.Reset()
        $tReward = 0.0
        while (-not $piEnv.LastDone) {
            $tAction = $agent.Act($evalState)
            $piEnv.Step($tAction)
            [double[]] $evalState = $piEnv.GetState()
            $tReward += $piEnv.LastReward
        }
        $trainedRewards += $tReward
    }
    [double[]] $tAvgArr = @(0.0)
    $tAvgArr[0] = ($trainedRewards | Measure-Object -Average).Average
    Write-Host (" Trained avg reward: {0:F2}" -f $tAvgArr[0]) -ForegroundColor Green

    [double[]] $impArr = @(0.0)
    if ($bAvgArr[0] -ne 0) {
        $impArr[0]  = $tAvgArr[0] - $bAvgArr[0]
        $impArr[0] /= [Math]::Abs($bAvgArr[0])
        $impArr[0] *= 100.0
    }
    $bAvg        = [Math]::Round($bAvgArr[0], 2)
    $tAvg        = [Math]::Round($tAvgArr[0], 2)
    $improvement = [Math]::Round($impArr[0], 1)

    [double[]] $precArr = @(0.0)
    [double[]] $recArr  = @(0.0)
    $denomP = $piEnv.TruePositives + $piEnv.FalsePositives
    $denomR = $piEnv.TruePositives + $piEnv.FalseNegatives
    if ($denomP -gt 0) { $precArr[0] = $piEnv.TruePositives; $precArr[0] /= $denomP }
    if ($denomR -gt 0) { $recArr[0]  = $piEnv.TruePositives; $recArr[0]  /= $denomR }
    $precPct = [Math]::Round($precArr[0] * 100, 1)
    $recPct  = [Math]::Round($recArr[0]  * 100, 1)

    Write-Host ""
    Write-Host "╔══════════════════════════════════════════════════╗" -ForegroundColor Cyan
    Write-Host "║ Phase 23: Patch Intelligence - Results ║" -ForegroundColor Cyan
    Write-Host "╠══════════════════════════════════════════════════╣" -ForegroundColor Cyan
    Write-Host ("║ Baseline (random) avg reward : {0,8} ║" -f $bAvg)        -ForegroundColor Gray
    Write-Host ("║ Trained (DQN) avg reward : {0,8} ║" -f $tAvg)        -ForegroundColor Green
    Write-Host ("║ Improvement : {0,7}% ║" -f $improvement) -ForegroundColor Yellow
    Write-Host "╠══════════════════════════════════════════════════╣" -ForegroundColor Cyan
    Write-Host ("║ Precision (Apply+Rollback corr): {0,6}% ║" -f $precPct)    -ForegroundColor Cyan
    Write-Host ("║ Recall (patches handled) : {0,7}% ║" -f $recPct)      -ForegroundColor Cyan
    Write-Host "╠══════════════════════════════════════════════════╣" -ForegroundColor Cyan
    Write-Host "║ Agent learned to: ║" -ForegroundColor Cyan
    Write-Host "║ Defer delay patch, risk acceptable ║" -ForegroundColor White
    Write-Host "║ Schedule plan for maintenance window ║" -ForegroundColor White
    Write-Host "║ Apply deploy patch immediately ║" -ForegroundColor White
    Write-Host "║ Rollback revert bad patch, restore state ║" -ForegroundColor White
    Write-Host "╚══════════════════════════════════════════════════╝" -ForegroundColor Cyan
    Write-Host ""

    return @{ Agent = $agent; Results = $results; Baseline = @{ Avg = $bAvg }; Trained = @{ Avg = $tAvg } }
}

# ============================================================
# TEST SUGGESTIONS
# ============================================================
# 1. Run VBAF.LoadAll.ps1 (loads core DQN + all pillars)
#
# 2. QUICK DEMO (simulated patch conditions)
# $r = Invoke-VBAFPatchIntelligenceTraining -Episodes 100 -PrintEvery 10 -SimMode
#
# 3. FULL TRAINING (real Get-HotFix, WMI, System event log)
# $r = Invoke-VBAFPatchIntelligenceTraining -Episodes 100 -PrintEvery 10
#
# 4. INSPECT AGENT DECISIONS
# $env = [PatchIntelligenceEnvironment]::new()
# $state = $env.Reset()
# Write-Host "Vuln: $($env.VulnerabilityScore) Exploit: $($env.ExploitActivity)"
# $action = $r.Agent.Act($state)
# $labels = @("Defer","Schedule","Apply","Rollback")
# Write-Host "Patch decision: $($labels[$action])"
# ============================================================
Write-Host "📦 VBAF.Enterprise.PatchIntelligence.ps1 loaded [v3.13.0 🔧]" -ForegroundColor Green
Write-Host " Phase 23: Patch Intelligence"                                 -ForegroundColor Cyan
Write-Host " Function : Invoke-VBAFPatchIntelligenceTraining"              -ForegroundColor Cyan
Write-Host ""
Write-Host " Quick start:" -ForegroundColor Yellow
Write-Host ' $r = Invoke-VBAFPatchIntelligenceTraining -Episodes 100 -PrintEvery 10 -SimMode' -ForegroundColor White
Write-Host ""