src/security/featureExtractor.js

import { AuditLog } from "../models/AuditLog.js";

export async function extractFeature(log) {
  const since = new Date(Date.now() - 10 * 60 * 1000);

  const count = await AuditLog.countDocuments({
    ip: log.ip,
    createdAt: { $gte: since },
  });

  return count;
}