Create src/security/featureExtractor.js

src/security/featureExtractor.js

@@ -0,0 +1,11 @@
+import { AuditLog } from "../models/AuditLog.js";
+
+export async function extractFeatures(log) {
+  const since = new Date(Date.now() - 10 * 60 * 1000);
+  const ipCount = await AuditLog.countDocuments({
+    ip: log.ip,
+    createdAt: { $gte: since },
+  });
+
+  return [log.createdAt.getHours(), Math.min(ipCount, 100)];
+}