InjectionDetector.cpp

#include "InjectionDetector.h"
#include "ModuleValidator.h"
#include "../utils/FileUtils.h"
#include "../utils/Logger.h"
#include "../utils/PeParser.h"

#include "../utils/ProcessClassifier.h"

#include <sstream>
#include <algorithm>

#include <winternl.h>

#pragma comment(lib, "ntdll.lib")

namespace dl2 {

namespace {

using NtQueryInformationProcessFn = NTSTATUS(NTAPI*)(
    HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG);

NtQueryInformationProcessFn getNtQueryInformationProcess() {
    static auto fn = reinterpret_cast<NtQueryInformationProcessFn>(
        GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtQueryInformationProcess"));
    return fn;
}

typedef struct _PEB_MIN {
    BYTE Reserved1[2];
    BYTE BeingDebugged;
    BYTE Reserved2[1];
    PVOID Reserved3[2];
    PVOID ImageBaseAddress;
} PEB_MIN, *PPEB_MIN;

bool readRemotePebImageBase(DWORD pid, ULONGLONG& imageBase) {
    const auto ntQuery = getNtQueryInformationProcess();
    if (!ntQuery) {
        return false;
    }

    HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, pid);
    if (!hProcess) {
        return false;
    }

    PROCESS_BASIC_INFORMATION pbi{};
    ULONG retLen = 0;
    const NTSTATUS status = ntQuery(hProcess, ProcessBasicInformation, &pbi, sizeof(pbi), &retLen);
    if (status != 0 || !pbi.PebBaseAddress) {
        CloseHandle(hProcess);
        return false;
    }

    PEB_MIN peb{};
    SIZE_T read = 0;
    if (!ReadProcessMemory(hProcess, pbi.PebBaseAddress, &peb, sizeof(peb), &read) ||
        read != sizeof(peb) || !peb.ImageBaseAddress) {
        CloseHandle(hProcess);
        return false;
    }

    PVOID imageBasePtr = nullptr;
    const BYTE* pebBase = reinterpret_cast<const BYTE*>(pbi.PebBaseAddress);
    const SIZE_T imageBaseOffset = offsetof(PEB_MIN, ImageBaseAddress);
    if (!ReadProcessMemory(hProcess, pebBase + imageBaseOffset, &imageBasePtr, sizeof(imageBasePtr), &read) ||
        read != sizeof(imageBasePtr) || !imageBasePtr) {
        CloseHandle(hProcess);
        return false;
    }

    imageBase = reinterpret_cast<ULONGLONG>(imageBasePtr);
    CloseHandle(hProcess);
    return true;
}

std::wstring parseJsonStringValue(const std::wstring& json, const std::wstring& key) {
    const std::wstring search = L"\"" + key + L"\"";
    size_t pos = json.find(search);
    if (pos == std::wstring::npos) {
        return L"";
    }
    pos = json.find(L'"', pos + search.size());
    if (pos == std::wstring::npos) {
        return L"";
    }
    ++pos;
    size_t end = json.find(L'"', pos);
    if (end == std::wstring::npos) {
        return L"";
    }
    return json.substr(pos, end - pos);
}

std::vector<std::wstring> parseJsonStringArray(const std::wstring& json, const std::wstring& key) {
    std::vector<std::wstring> result;
    const std::wstring search = L"\"" + key + L"\"";
    size_t pos = json.find(search);
    if (pos == std::wstring::npos) {
        return result;
    }
    pos = json.find(L'[', pos);
    if (pos == std::wstring::npos) {
        return result;
    }
    size_t end = json.find(L']', pos);
    if (end == std::wstring::npos) {
        return result;
    }
    const std::wstring slice = json.substr(pos + 1, end - pos - 1);
    size_t i = 0;
    while (i < slice.size()) {
        const size_t q1 = slice.find(L'"', i);
        if (q1 == std::wstring::npos) {
            break;
        }
        const size_t q2 = slice.find(L'"', q1 + 1);
        if (q2 == std::wstring::npos) {
            break;
        }
        result.push_back(slice.substr(q1 + 1, q2 - q1 - 1));
        i = q2 + 1;
    }
    return result;
}

} // namespace

InjectionDetector::InjectionDetector() {
    ProcessIdToSessionId(GetCurrentProcessId(), &currentSessionId_);
}

void InjectionDetector::setAlertCallback(AlertCallback cb) {
    std::lock_guard lock(mutex_);
    alertCallback_ = std::move(cb);
}

Expected<void> InjectionDetector::loadWhitelist() {
    auto dir = FileUtils::getDl2InjectDataDir();
    if (!dir) {
        return dir.error();
    }
    const std::wstring path = *dir + L"\\whitelist.json";
    const auto content = FileUtils::readFileText(path);
    if (!content) {
        return {};
    }

    std::lock_guard lock(mutex_);
    whitelistPaths_.clear();
    whitelistNameSigner_.clear();
    whitelistModuleNames_.clear();

    for (const auto& p : parseJsonStringArray(*content, L"paths")) {
        whitelistPaths_.insert(FileUtils::normalizePath(p));
    }

    size_t pos = content->find(L"\"nameSigner\"");
    if (pos != std::wstring::npos) {
        pos = content->find(L'[', pos);
        size_t end = content->find(L']', pos);
        if (pos != std::wstring::npos && end != std::wstring::npos) {
            std::wstring slice = content->substr(pos, end - pos + 1);
            size_t i = 0;
            while ((i = slice.find(L'{', i)) != std::wstring::npos) {
                const size_t j = slice.find(L'}', i);
                if (j == std::wstring::npos) {
                    break;
                }
                const std::wstring obj = slice.substr(i, j - i + 1);
                const std::wstring name = parseJsonStringValue(obj, L"name");
                const std::wstring signer = parseJsonStringValue(obj, L"signer");
                if (!name.empty()) {
                    whitelistNameSigner_.insert(FileUtils::toLower(name) + L"|" + FileUtils::toLower(signer));
                }
                i = j + 1;
            }
        }
    }

    for (const auto& n : parseJsonStringArray(*content, L"moduleNames")) {
        whitelistModuleNames_.insert(FileUtils::toLower(n));
    }
    return {};
}

Expected<void> InjectionDetector::saveWhitelist() {
    auto dir = FileUtils::getDl2InjectDataDir();
    if (!dir) {
        return dir.error();
    }
    const std::wstring path = *dir + L"\\whitelist.json";

    std::lock_guard lock(mutex_);
    std::wstring json = L"{\n  \"paths\": [\n";
    bool first = true;
    for (const auto& p : whitelistPaths_) {
        if (!first) {
            json += L",\n";
        }
        json += L"    \"" + FileUtils::escapeJson(p) + L"\"";
        first = false;
    }
    json += L"\n  ],\n  \"moduleNames\": [\n";
    first = true;
    for (const auto& n : whitelistModuleNames_) {
        if (!first) {
            json += L",\n";
        }
        json += L"    \"" + FileUtils::escapeJson(n) + L"\"";
        first = false;
    }
    json += L"\n  ],\n  \"nameSigner\": [\n";
    first = true;
    for (const auto& ns : whitelistNameSigner_) {
        const size_t sep = ns.find(L'|');
        if (sep == std::wstring::npos) {
            continue;
        }
        if (!first) {
            json += L",\n";
        }
        const std::wstring name = ns.substr(0, sep);
        const std::wstring signer = ns.substr(sep + 1);
        json += L"    {\"name\": \"" + FileUtils::escapeJson(name) +
                L"\", \"signer\": \"" + FileUtils::escapeJson(signer) + L"\"}";
        first = false;
    }
    json += L"\n  ]\n}\n";

    return FileUtils::writeFileText(path, json);
}

void InjectionDetector::seedWhitelistFromSnapshot(const std::unordered_map<DWORD, ProcessInfo>& snapshot) {
    std::lock_guard lock(mutex_);
    for (const auto& [pid, proc] : snapshot) {
        for (const auto& mod : proc.modules) {
            if (!mod.fullPath.empty()) {
                whitelistPaths_.insert(FileUtils::normalizePath(mod.fullPath));
            } else if (!mod.name.empty()) {
                whitelistModuleNames_.insert(FileUtils::toLower(mod.name));
            }
        }
    }
}

void InjectionDetector::addToWhitelist(const std::wstring& path, const std::wstring& dllName,
                                       const std::wstring& signer) {
    std::lock_guard lock(mutex_);
    if (!path.empty()) {
        whitelistPaths_.insert(FileUtils::normalizePath(path));
    }
    if (!dllName.empty()) {
        whitelistNameSigner_.insert(FileUtils::toLower(dllName) + L"|" + FileUtils::toLower(signer));
    }
}

bool InjectionDetector::isWhitelisted(const std::wstring& path, const std::wstring& dllName,
                                      const std::wstring& signer) const {
    if (isWhitelistedFast(path, dllName)) {
        return true;
    }
    std::lock_guard lock(mutex_);
    const std::wstring key = FileUtils::toLower(dllName) + L"|" + FileUtils::toLower(signer);
    return whitelistNameSigner_.count(key) > 0;
}

bool InjectionDetector::isWhitelistedFast(const std::wstring& path, const std::wstring& dllName) const {
    std::lock_guard lock(mutex_);
    if (!path.empty() && whitelistPaths_.count(FileUtils::normalizePath(path)) > 0) {
        return true;
    }
    if (path.empty() && !dllName.empty() &&
        whitelistModuleNames_.count(FileUtils::toLower(dllName)) > 0) {
        return true;
    }
    return false;
}

bool InjectionDetector::isMicrosoftSignedProcess(const ProcessInfo& proc) const {
    if (proc.isMicrosoftSigned) {
        return true;
    }
    if (proc.exePath.empty()) {
        return false;
    }
    return ModuleValidator::getCachedSigner(proc.exePath) == SignerType::Microsoft;
}

void InjectionDetector::setBaseline(const std::unordered_map<DWORD, ProcessInfo>& current) {
    std::lock_guard lock(mutex_);
    previous_ = current;
}

bool InjectionDetector::hasBaseline() const {
    std::lock_guard lock(mutex_);
    return !previous_.empty();
}

std::wstring InjectionDetector::severityFromScore(int score) const {
    if (score >= 75) {
        return L"HIGH";
    }
    if (score >= 50) {
        return L"MEDIUM";
    }
    return L"LOW";
}

std::wstring InjectionDetector::makeAlertKey(DWORD pid, const std::wstring& dllName,
                                              const std::wstring& path) const {
    return std::to_wstring(pid) + L"|" + FileUtils::toLower(dllName) + L"|" +
           FileUtils::normalizePath(path);
}

void InjectionDetector::fillAlertDetails(DetectionAlert& alert, const ProcessInfo& proc,
                                         const ModuleInfo* mod) const {
    if (alert.processPath.empty()) {
        alert.processPath = proc.exePath;
    }
    if (alert.processOrigin.empty()) {
        alert.processOrigin = ProcessClassifier::originToLabel(
            ProcessClassifier::classifyExecutable(proc.exePath));
    }

    if (alert.detectionMethod.find(L"Hollowing") != std::wstring::npos) {
        alert.injectionRisk = L"Yes - Process Hollowing";
    } else if (alert.detectionMethod.find(L"Reflective") != std::wstring::npos) {
        alert.injectionRisk = L"Yes - Reflective Injection";
    } else if (alert.anomalyScore >= 75 || alert.severity == L"HIGH") {
        alert.injectionRisk = L"Yes - High Risk";
    } else if (alert.anomalyScore >= 50) {
        alert.injectionRisk = L"Yes - Medium Risk";
    } else {
        alert.injectionRisk = L"Possible - Low Risk";
    }

    const std::wstring dllPathForCheck = (mod && !mod->fullPath.empty()) ? mod->fullPath : alert.suspiciousDll;

    if (alert.detectionMethod.find(L"Hollowing") != std::wstring::npos) {
        alert.pathWriteAccess = L"N/A (image hollowing)";
    } else {
        alert.pathWriteAccess = FileUtils::describePathWriteAccess(
            dllPathForCheck, alert.processPath, alert.dllName);
    }

    std::wostringstream oss;
    oss << L"=== Process ===\r\n"
        << L"PID: " << alert.pid << L"\r\n"
        << L"Name: " << alert.process << L"\r\n"
        << L"Path: " << (alert.processPath.empty() ? L"(unknown)" : alert.processPath) << L"\r\n"
        << L"Origin: " << (alert.processOrigin.empty() ? L"Unknown" : alert.processOrigin) << L"\r\n"
        << L"Microsoft Process: " << (alert.isMicrosoftProcess ? L"Yes" : L"No") << L"\r\n\r\n"
        << L"=== DLL / Module ===\r\n"
        << L"DLL Name: " << (alert.dllName.empty() ? L"(n/a)" : alert.dllName) << L"\r\n"
        << L"DLL Path: " << (alert.suspiciousDll.empty() ? L"(not on disk / empty)" : alert.suspiciousDll) << L"\r\n"
        << L"Load State: " << alert.loadState << L"\r\n"
        << L"Still Present: " << (alert.stillPresent ? L"Yes" : L"No") << L"\r\n";

    if (mod) {
        oss << L"Base Address: 0x" << std::hex << std::uppercase << mod->baseAddress << std::dec << L"\r\n"
            << L"Module Size: " << mod->moduleSize << L" bytes\r\n";
    }

    oss << L"\r\n=== Detection ===\r\n"
        << L"Severity: " << alert.severity << L"\r\n"
        << L"Anomaly Score: " << alert.anomalyScore << L"\r\n"
        << L"Method: " << alert.detectionMethod << L"\r\n"
        << L"Time: " << alert.timestamp << L"\r\n\r\n"
        << L"Recommendation: " << alert.recommendation;

    alert.details = oss.str();
}

void InjectionDetector::upsertTrackedAlert(const DetectionAlert& alert,
                                           std::vector<DetectionAlert>& emitted) {
    std::lock_guard lock(mutex_);
    const auto it = trackedAlerts_.find(alert.alertKey);
    if (it == trackedAlerts_.end()) {
        trackedAlerts_[alert.alertKey] = alert;
        alerts_.push_back(alert);
        emitted.push_back(alert);
        return;
    }

    const std::wstring prevState = it->second.loadState;
    it->second = alert;
    it->second.timestamp = alert.timestamp;

    if (prevState != alert.loadState || it->second.stillPresent != alert.stillPresent) {
        emitted.push_back(it->second);
    }
}

void InjectionDetector::refreshTrackedPresence(
    const std::unordered_map<DWORD, ProcessInfo>& current,
    std::vector<DetectionAlert>& emitted) {

    std::unordered_set<std::wstring> presentKeys;
    for (const auto& [pid, proc] : current) {
        for (const auto& mod : proc.modules) {
            presentKeys.insert(makeAlertKey(pid, mod.name, mod.fullPath));
        }
    }

    std::lock_guard lock(mutex_);
    for (auto& [key, tracked] : trackedAlerts_) {
        const bool nowPresent = presentKeys.count(key) > 0;
        if (nowPresent && !tracked.stillPresent) {
            tracked.stillPresent = true;
            if (tracked.loadState.find(L"Not Loaded") != std::wstring::npos ||
                tracked.loadState.find(L"Reflective") != std::wstring::npos) {
                tracked.loadState = L"Previously Missing - Now Loaded";
            } else {
                tracked.loadState = L"Loaded";
            }
            tracked.timestamp = FileUtils::iso8601Now();
            emitted.push_back(tracked);
        } else if (!nowPresent && tracked.stillPresent) {
            tracked.stillPresent = false;
            tracked.loadState = L"Unloaded / Removed";
            tracked.timestamp = FileUtils::iso8601Now();
            emitted.push_back(tracked);
        }
    }
}

std::vector<DetectionAlert> InjectionDetector::getTrackedAlerts() const {
    std::lock_guard lock(mutex_);
    std::vector<DetectionAlert> out;
    out.reserve(trackedAlerts_.size());
    for (const auto& [key, alert] : trackedAlerts_) {
        out.push_back(alert);
    }
    std::sort(out.begin(), out.end(), [](const DetectionAlert& a, const DetectionAlert& b) {
        return a.timestamp > b.timestamp;
    });
    return out;
}

int InjectionDetector::scoreModule(const ProcessInfo& proc, ModuleInfo& mod, std::wstring& methods) {
    int score = 0;

    if (FileUtils::isTempPath(mod.fullPath)) {
        score += 30;
        if (!methods.empty()) {
            methods += L"+";
        }
        methods += L"PathAnomaly";
        mod.isPathSuspicious = true;
    }

    if (FileUtils::isSuspiciousDllName(mod.name)) {
        score += 25;
        if (!methods.empty()) {
            methods += L"+";
        }
        methods += L"SuspiciousName";
        mod.isPathSuspicious = true;
    }

    if (!mod.fullPath.empty() && !FileUtils::isUnderTrustedPrefix(mod.fullPath)) {
        score += 20;
        if (!methods.empty()) {
            methods += L"+";
        }
        methods += L"UntrustedPath";
        mod.isPathSuspicious = true;
    }

    if (!mod.fullPath.empty()) {
        if (!PeParser::hasValidMzHeader(mod.fullPath)) {
            score += 25;
            if (!methods.empty()) {
                methods += L"+";
            }
            methods += L"InvalidPE";
        } else {
            mod.isPeSigned = FileUtils::isUnderTrustedPrefix(mod.fullPath);
        }
    } else {
        score += 25;
        if (!methods.empty()) {
            methods += L"+";
        }
        methods += L"InvalidPE";
    }

    if (proc.sessionId != 0 && proc.sessionId != currentSessionId_) {
        score += 20;
        if (!methods.empty()) {
            methods += L"+";
        }
        methods += L"UserContext";
    }

    mod.anomalyScore = score;
    return score;
}

bool InjectionDetector::detectHollowing(const ProcessInfo& proc, DetectionAlert& alert) {
    if (proc.exePath.empty()) {
        return false;
    }

    ULONGLONG pebImageBase = 0;
    if (!readRemotePebImageBase(proc.pid, pebImageBase)) {
        return false;
    }

    const auto pe = PeParser::parseFile(proc.exePath);
    if (!pe || !pe->validPe) {
        return false;
    }

    if (pebImageBase != pe->imageBase) {
        alert.timestamp = FileUtils::iso8601Now();
        alert.severity = L"HIGH";
        alert.pid = proc.pid;
        alert.process = proc.name;
        alert.processPath = proc.exePath;
        alert.dllName = L"(main executable image)";
        alert.suspiciousDll = L"PEB ImageBase mismatch - possible hollowing";
        alert.loadState = L"Process Hollowed";
        alert.anomalyScore = 100;
        alert.detectionMethod = L"Hollowing";
        alert.isMicrosoftProcess = proc.isMicrosoftSigned;
        alert.recommendation = L"Terminate process / Investigate process hollowing";
        alert.stillPresent = true;
        alert.alertKey = makeAlertKey(proc.pid, alert.dllName, alert.suspiciousDll);
        fillAlertDetails(alert, proc, nullptr);
        return true;
    }
    return false;
}

bool InjectionDetector::detectReflective(const ProcessInfo& proc, const ModuleInfo& mod,
                                         DetectionAlert& alert) {
    const std::wstring normExe = FileUtils::normalizePath(proc.exePath);
    const std::wstring normMod = FileUtils::normalizePath(mod.fullPath);
    const std::wstring normProcName = FileUtils::toLower(proc.name);
    const std::wstring normModName = FileUtils::toLower(mod.name);

    if (!mod.fullPath.empty()) {
        if (normMod != normExe) {
            return false;
        }
        if (normModName == normProcName) {
            return false;
        }
    }

    alert.timestamp = FileUtils::iso8601Now();
    alert.severity = L"HIGH";
    alert.pid = proc.pid;
    alert.process = proc.name;
    alert.processPath = proc.exePath;
    alert.suspiciousDll = mod.fullPath.empty() ? L"(no path - reflective)" : mod.fullPath;
    alert.dllName = mod.name;
    alert.loadState = mod.fullPath.empty() ? L"Not Loaded (reflective)" : L"Reflective Injection";
    alert.moduleBase = mod.baseAddress;
    alert.moduleSize = mod.moduleSize;
    alert.anomalyScore = 80;
    alert.detectionMethod = L"ReflectiveInjection";
    alert.isMicrosoftProcess = proc.isMicrosoftSigned;
    alert.recommendation = L"Terminate process / Quarantine DLL";
    alert.stillPresent = true;
    alert.alertKey = makeAlertKey(proc.pid, mod.name, mod.fullPath);
    fillAlertDetails(alert, proc, &mod);
    return true;
}

void InjectionDetector::clearAlerts() {
    std::lock_guard lock(mutex_);
    alerts_.clear();
    trackedAlerts_.clear();
}

std::vector<DetectionAlert> InjectionDetector::analyzeSnapshot(
    const std::unordered_map<DWORD, ProcessInfo>& current) {

    std::vector<DetectionAlert> newAlerts;
    std::unordered_set<ModuleKey, ModuleKeyHash> previousModules;
    std::unordered_map<DWORD, ProcessInfo> previousCopy;

    {
        std::lock_guard lock(mutex_);
        previousCopy = previous_;
    }

    for (const auto& [pid, proc] : previousCopy) {
        for (const auto& mod : proc.modules) {
            previousModules.insert({pid, mod.fullPath, mod.name});
        }
    }

    const bool hasBaseline = !previousCopy.empty();

    for (const auto& [pid, proc] : current) {
        bool processHasNewModule = false;
        for (const auto& mod : proc.modules) {
            ModuleKey key{pid, mod.fullPath, mod.name};
            if (hasBaseline && previousModules.find(key) == previousModules.end()) {
                processHasNewModule = true;
                break;
            }
        }

        if (processHasNewModule) {
            DetectionAlert hollowAlert{};
            if (detectHollowing(proc, hollowAlert)) {
                if (!isWhitelistedFast(L"", hollowAlert.dllName)) {
                    upsertTrackedAlert(hollowAlert, newAlerts);
                }
            }
        }

        const bool msSignedProcess = isMicrosoftSignedProcess(proc);

        for (auto mod : proc.modules) {
            ModuleKey key{pid, mod.fullPath, mod.name};
            const bool isNew = hasBaseline && previousModules.find(key) == previousModules.end();

            if (isWhitelistedFast(mod.fullPath, mod.name)) {
                continue;
            }

            std::wstring methods;
            const int score = scoreModule(proc, mod, methods);

            DetectionAlert reflective{};
            if (detectReflective(proc, mod, reflective)) {
                if (!isWhitelistedFast(reflective.suspiciousDll, reflective.dllName)) {
                    upsertTrackedAlert(reflective, newAlerts);
                }
                continue;
            }

            if (isNew) {
                if (!methods.empty()) {
                    methods += L"+";
                }
                methods += L"SnapshotDiff";
            }

            if (!isNew && score < 50) {
                continue;
            }

            std::wstring signerName;
            if (!mod.fullPath.empty() &&
                (isNew || score >= 50 || msSignedProcess)) {
                signerName = ModuleValidator::signerTypeToString(
                    ModuleValidator::getCachedSigner(mod.fullPath));
            }

            if (!signerName.empty()) {
                std::lock_guard lock(mutex_);
                const std::wstring keyNs = FileUtils::toLower(mod.name) + L"|" + FileUtils::toLower(signerName);
                if (whitelistNameSigner_.count(keyNs) > 0) {
                    continue;
                }
            }

            const bool msProcNewModule = isNew && msSignedProcess;
            if (score >= 50 || msProcNewModule) {
                DetectionAlert alert{};
                alert.timestamp = FileUtils::iso8601Now();
                alert.severity = msProcNewModule && score < 75 ? L"HIGH" : severityFromScore(score);
                if (msProcNewModule && score < 50) {
                    alert.anomalyScore = 75;
                } else {
                    alert.anomalyScore = score;
                }
                alert.pid = proc.pid;
                alert.process = proc.name;
                alert.processPath = proc.exePath;
                alert.suspiciousDll = mod.fullPath.empty() ? L"(no path on disk)" : mod.fullPath;
                alert.dllName = mod.name;
                alert.loadState = mod.fullPath.empty() ? L"Not Loaded (no path)" :
                    (isNew ? L"Newly Loaded" : L"Loaded");
                alert.moduleBase = mod.baseAddress;
                alert.moduleSize = mod.moduleSize;
                alert.detectionMethod = methods.empty() ? L"SnapshotDiff" : methods;
                alert.isMicrosoftProcess = msSignedProcess;
                alert.recommendation = L"Terminate process / Quarantine DLL";
                alert.stillPresent = true;
                alert.alertKey = makeAlertKey(proc.pid, mod.name, mod.fullPath);
                fillAlertDetails(alert, proc, &mod);
                upsertTrackedAlert(alert, newAlerts);
            }
        }
    }

    refreshTrackedPresence(current, newAlerts);

    {
        std::lock_guard lock(mutex_);
        previous_ = current;
    }

    return newAlerts;
}

} // namespace dl2