1 Release 1 Tag

RSS Feed

• v0.1.0 673b11c88c

  Compare

  Acauã 0.1.0 Stable

  gitea-actions released this 2026-11-01 13:27:06 +00:00 | 0 commits to main since this release

  Added

  • Pillar 1 (v1.2): Rayleigh/Schuster periodogram with grid bounded by the observed span (T \le \text{span}/3), regularity gating, and infrastructure exclusions (NTP, mDNS/LLMNR/NBNS, SSDP, non-TCP/UDP).
  • Pillar 2 (v1.0): Persistent TCP session detector with inactivity chaining (gaps $\le 3600$s without SYN), logarithmic duration scoring, and PCR / failed attempt metrics in evidence.
  • Pillar 3 (v1.0): DNS subdomain information capacity detector (I = H \times C bits/h) to identify high-entropy tunnels, with Jensen-Shannon Divergence (JSD) recorded in evidence.
  • Pillar 4 (v1.0): Per-host weighted noisy-OR fusion (w_1=w_2=w_3=0.75) with deterministic evidence linkage, ranking hosts in acaua analyze human output via the hosts: section.
  • Zeek dns.log ingestion: Daily Hive Parquet partitioning for DNS queries with deterministic column mapping by TSV header.
  • Parquet storage schema (v1.2): 15-column schema for conn.log supporting conn_state, history, orig_pkts, resp_pkts, orig_ip_bytes, resp_ip_bytes.
  • In-memory alert reporting: Web daemon /api/alerts route now serves alerts from the most recent analysis run.
  • Real dashboard UI: Sidebar navigation now switches panels instead of a no-op scroll. New Hosts panel ranks observed hosts by fusion score with per-pillar (P1/P2/P3) drill-down. Alerts panel is filterable/sortable by pillar and score, with full evidence rendered as a formatted table. Overview panel adds KPI tiles and two interactive SVG charts (top hosts by fusion score, alert distribution by pillar).

  Changed

  • Breaking (0.x): Pillar 1 formula v1.2 modifies scores and changes Alert.id generation to reflect the corrected bounded grid and session-based aggregation.
  • Distribution pivoted to 100% Docker and docker-compose (server daemon and web dashboard); native binary tarballs and desktop installers are discontinued.
  • DuckDB is now a mandatory runtime dependency, dynamically linked against the official prebuilt libduckdb.so (v1.5.6) with fixed SHA-256 via scripts/fetch-libduckdb.sh.
  • Upgraded workspace MSRV to Rust 1.88 (required by duckdb ~1.10506.1).
  • Upgraded container runtime and base image to Debian 13 trixie.

  Fixed

  • Fixed critical false positives in short captures where period candidates exceeded the observed span.
  • Corrected partition counting in ingest_dir to take the union of partition dates instead of summing file counts.
  • DuckDB execution errors are now tracked in files_failed instead of miscounted as bad rows.
  • Updated doctor check status from "skeleton" to "ok" / "degraded".
  • Graceful shutdown on SIGTERM when running as PID 1 in container environments.

  Removed

  • Tauri desktop application (apps/gui/src-tauri) and associated desktop build scripts.
  • Self-update flag (acaua update --apply) and in-place binary overwrite. Updates are now handled via image pulls (docker compose pull).

  Initial scaffold

  • Rust workspace with acaua-core and acaua-cli.
  • CLI skeleton with serve, analyze, doctor and update [--apply].
  • Axum API skeleton with health, status, alerts, analyze and update-check routes.
  • Embedded vanilla UI (desktop shell since removed; see Removed above).
  • English/Portuguese documentation, CI/release workflows and local check script.

  docker pull git.lucasrguerra.dev.br/ciberfauna/acaua:0.1.0
  

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)