Lucas RayanandClaude Sonnet 5
1b974bb90d
Acauã: Network Detection & Threat Hunting, heuristic analysis over a rolling 7-day window using deterministic math (time series, graph theory, information theory) instead of opaque ML models. Third product in the Ciberfauna ecosystem, alongside Guará and Sabiá. Follows the ecosystem's established conventions: OpenWolf project memory, bilingual PT-BR/EN docs and UI, Gitea Actions CI/CD on the same self-hosted runners, Conventional Commits, SemVer, logo and productName handling, MIT OR Apache-2.0 licensing. Architecture decision (made with the project owner after a dedicated consultation, not the original blueprint's suggested stack): Rust throughout, not Python/FastAPI/React. Most of the statistics (Bowley skew, MADM, Shannon entropy, PCR, Z-score, novel-edge detection, pivot chains) reduces to SQL over an embedded DuckDB/Parquet store; only the spectral analysis and graph centrality need host-language code, and both have workable Rust crates. Documented in full, including six corrections to the original blueprint's math (Rayleigh/Schuster instead of a degenerate Lomb-Scargle over bare timestamps, an explicit sentinel for Bowley skew's Q3=Q1 case, Jensen-Shannon instead of unbounded KL, a dedicated long-connection detector, JA4 vs. JA4+ licensing caution, deterministic per-alert evidence), in docs/architecture.md. Skeleton only: crates/acaua-core has the four detection pillars, fusion, storage, zeek log parsing and the updater as typed stubs that compile and return a clear "skeleton" status rather than real detection logic — that is separate, future work. crates/acaua-cli has serve/analyze/doctor/update. apps/gui is a minimal Tauri shell. Also already includes the one-click desktop self-update mechanism shared with Guará and Sabiá (AppImage/.deb/Windows installer), even with no release published yet, for consistency across the ecosystem. No Gitea repository exists for this project yet; this is a local-only commit. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
1.9 KiB
1.9 KiB
Security policy
English · Português
Acauã is defensive software, but it processes hostile input: packet captures, Zeek logs and flow records may be malformed on purpose. Treat every dataset as untrusted.
Reporting a vulnerability
Do not open a public issue with exploit details. Open a minimal issue asking for a private channel, or contact the maintainer through the Gitea profile listed on the repository. Include the affected version, the input shape and a minimal reproduction when a private channel is available.
Scope and threat model
- Input parsing: a malformed log line must not panic the daemon, exhaust memory or escape the configured data directory.
- Path handling: dataset paths are resolved and confined to the configured root; symbolic links are not followed outside it.
- API exposure:
servebinds to127.0.0.1by default. Exposing it on a network interface is an explicit operator decision and needs a reverse proxy with authentication. - Evidence integrity: alert evidence must be reproducible from the same input and code version. Silent nondeterminism is a correctness and security issue.
- Updates: the CLI checks Gitea Releases, downloads over HTTPS and verifies SHA-256 before replacing the binary. The desktop app does not update itself.
- Privacy: there is no telemetry. Retention defaults to seven days of normalized events; the operator is responsible for local law and policy.
Out of scope
- Vulnerabilities in third-party Zeek, Suricata, Tauri or operating-system packages that are already fixed upstream.
- Attacks that require the operator to disable the documented security controls
(for example, running
serveas root on a public interface). - Detection quality claims: the pillars are not implemented in this skeleton.
Supported versions
Only the latest 0.1.x line is supported while the project is pre-alpha. There
is no long-term support branch yet.