src/security/featureExtractor.js

import { AuditLog } from "../models/AuditLog.js";

export async function extractFeatures(log) {
  const since = new Date(Date.now() - 10 * 60 * 1000);
  const ipCount = await AuditLog.countDocuments({
    ip: log.ip,
    createdAt: { $gte: since },
  });

  return [log.createdAt.getHours(), Math.min(ipCount, 100)];
}