Lucas RayanandClaude Sonnet 5
1b974bb90d
Acauã: Network Detection & Threat Hunting, heuristic analysis over a rolling 7-day window using deterministic math (time series, graph theory, information theory) instead of opaque ML models. Third product in the Ciberfauna ecosystem, alongside Guará and Sabiá. Follows the ecosystem's established conventions: OpenWolf project memory, bilingual PT-BR/EN docs and UI, Gitea Actions CI/CD on the same self-hosted runners, Conventional Commits, SemVer, logo and productName handling, MIT OR Apache-2.0 licensing. Architecture decision (made with the project owner after a dedicated consultation, not the original blueprint's suggested stack): Rust throughout, not Python/FastAPI/React. Most of the statistics (Bowley skew, MADM, Shannon entropy, PCR, Z-score, novel-edge detection, pivot chains) reduces to SQL over an embedded DuckDB/Parquet store; only the spectral analysis and graph centrality need host-language code, and both have workable Rust crates. Documented in full, including six corrections to the original blueprint's math (Rayleigh/Schuster instead of a degenerate Lomb-Scargle over bare timestamps, an explicit sentinel for Bowley skew's Q3=Q1 case, Jensen-Shannon instead of unbounded KL, a dedicated long-connection detector, JA4 vs. JA4+ licensing caution, deterministic per-alert evidence), in docs/architecture.md. Skeleton only: crates/acaua-core has the four detection pillars, fusion, storage, zeek log parsing and the updater as typed stubs that compile and return a clear "skeleton" status rather than real detection logic — that is separate, future work. crates/acaua-cli has serve/analyze/doctor/update. apps/gui is a minimal Tauri shell. Also already includes the one-click desktop self-update mechanism shared with Guará and Sabiá (AppImage/.deb/Windows installer), even with no release published yet, for consistency across the ecosystem. No Gitea repository exists for this project yet; this is a local-only commit. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
56 lines
2.2 KiB
Markdown
56 lines
2.2 KiB
Markdown
# Roadmap
|
||
|
||
**English** · [Português](ROADMAP.pt-BR.md)
|
||
|
||
This roadmap separates what exists from what is planned. The four pillars are
|
||
**not implemented** in `0.1.0`; they are the next body of work.
|
||
|
||
## Done
|
||
|
||
- Rust workspace with `acaua-core` and `acaua-cli`.
|
||
- CLI skeleton, Axum API skeleton and embedded vanilla UI.
|
||
- Tauri desktop shell with language and theme settings.
|
||
- Stubs for the four pillars, evidence fusion, storage, Zeek ingestion and the
|
||
Gitea-based updater.
|
||
- English/Portuguese documentation, CI/release workflows and `scripts/check.sh`.
|
||
- Deterministic smoke tests and a bilingual UI check.
|
||
|
||
## Next
|
||
|
||
1. **Pillar 1 — beaconing.** Implement the Rayleigh/Schuster periodogram on
|
||
event timestamps, add generalized Lomb–Scargle only when a real `y` exists,
|
||
and ship golden fixtures with fixed expected values.
|
||
2. **Pillar 2 — persistent sessions.** Detect long connections that never
|
||
produce a short interval, with explicit thresholds and no overlap with
|
||
pillar 1.
|
||
3. **Real Zeek parser.** Read `conn.log`, `dns.log`, `ssl.log` and protocol logs
|
||
with bounded memory, path confinement and deterministic ordering.
|
||
4. **Evidence record.** Emit a JSON record per alert with inputs, intermediate
|
||
values, code version and dataset hash.
|
||
|
||
## Later
|
||
|
||
- Pillar 3 — deterministic protocol anomalies, including identity and
|
||
lateral-movement features.
|
||
- Pillar 4 — bounded, symmetric fusion with reproducible weights.
|
||
- DuckDB/Parquet storage behind the optional `duckdb` feature, with a seven-day
|
||
TTL and an export command.
|
||
- Desktop dataset view, alert detail with evidence, and scheduled `serve` runs.
|
||
- NetFlow/IPFIX as a documented degraded mode and Suricata EVE JSON as an
|
||
optional secondary input.
|
||
- Signed release metadata, SBOM and reproducible builds.
|
||
|
||
## Non-goals
|
||
|
||
- Opaque AI scoring that cannot explain an alert.
|
||
- A required cloud service or telemetry pipeline.
|
||
- Python in the shipped runtime.
|
||
- Treating flow records as equivalent to full Zeek protocol logs.
|
||
- Automatic desktop self-update.
|
||
|
||
## Versioning
|
||
|
||
The project follows SemVer 2.0.0. `0.x` means the API and detection output may
|
||
change between minor versions. A `1.0.0` release will require stable evidence
|
||
format, documented thresholds and a migration path for stored data.
|