# Roadmap

**English** · [Português](ROADMAP.pt-BR.md)

This roadmap separates what exists from what is planned. The four detection pillars
are implemented in their **initial version (v1)** and validated against public traffic.

## Done

- Rust workspace with `acaua-core` and `acaua-cli`.
- CLI commands (`analyze`, `serve`, `doctor`, `update`), Axum API and embedded web dashboard.
- 100% Docker containerization, compose deployment, non-root hardened profile.
- Prebuilt DuckDB linking and daily Hive-partitioned Parquet storage with sandbox isolation.
- Real Zeek log parser for `conn.log` and `dns.log` mapping columns by name.
- **Pillar 1 (v1.2):** Rayleigh/Schuster periodogram with bounded grid ($T \le \text{span}/3$), regularity gating, and infrastructure exclusions.
- **Pillar 2 (v1.0):** Persistent TCP sessions with inactivity timeout chaining (gaps $\le 3600$s without SYN), log persistence score, and PCR/failed attempts in evidence.
- **Pillar 3 (v1.0):** DNS information capacity (Shannon entropy $\times$ unique subdomain chars per UTC hour) to detect tunneling, with JSD in evidence.
- **Pillar 4 (v1.0):** Per-host weighted noisy-OR fusion ($w_1=w_2=w_3=0.75$) with deterministic JSON evidence and priority ranking (`hosts:` output).
- In-memory alert reporting in `/api/alerts` and updated web interface.
- English/Portuguese documentation, CI/release workflows and `scripts/check.sh`.
- Deterministic test suite and validation scripts against IoT-23 and CTU-Normal captures.

## Next

1. **Continuous ingestion:** automated log rotation and directory watching in daemon mode.
2. **Persistent alerts:** SQLite/DuckDB persistence of alerts across daemon restarts.
3. **Live long connection tracking:** sensor-side long connection logging before TCP teardown.
4. **Public Suffix List (PSL):** replace base domain heuristic with official PSL.
5. **Allowlisting & baselining:** reduce benign cloud IoT polling (e.g. Philips HUE) false positives.

## Later

- UDP sessions and additional protocol parsers (`ssl.log`, `smb_mapping.log`, `dce_rpc.log`, `rdp.log`, `ssh.log`, `kerberos.log`, `ntlm.log`).
- Identity tracking, lateral movement detection, and pivot graphs.
- NetFlow/IPFIX as a documented degraded mode and Suricata EVE JSON as an optional secondary input.
- Signed release metadata, SBOM and reproducible builds.

## Non-goals

- Opaque AI scoring that cannot explain an alert.
- A required cloud service or telemetry pipeline.
- Python in the shipped runtime.
- Treating flow records as equivalent to full Zeek protocol logs.
- Native desktop shell or binary self-mutation.