Lucas RayanandClaude Sonnet 5
c64bbbf775
Pillar 1 v1.1 (shipped earlier) flagged benign browsing bursts as beaconing: on short captures, grid periods longer than the observed span never complete a cycle, so significance saturates to 1 and the score sticks at exactly 0.5. v1.2 caps the grid at a third of the observed span, requires a minimum number of completed cycles, and excludes protocols that are periodic by nature (NTP, DNS, mDNS, ICMP). Validated against 300 seeds per scenario: false positives on bursty traffic drop from the 290-300/300 that v1.1 produced to 0/300, with every beacon-detection scenario scoring unchanged. Add Pillar 2 (persistent/long-lived sessions, with Zeek's fragmented TCP sessions rejoined after a 5-minute gap), Pillar 3 (DNS tunneling via Shannon-entropy information volume per subdomain per hour; the Jensen-Shannon divergence was measured and does not separate tunnels from benign CDN subdomains, so it stays in the evidence at zero weight instead of in the score), and Pillar 4 (deterministic noisy-OR fusion across the three pillars). The fusion formula was validated against 8 labeled real-traffic vectors (IoT-23, CTU-Normal) with tolerance <= 1e-4. A known limitation is kept, not hidden: a benign Philips HUE bulb's strict periodic polling and a 21.9h session score it above three real C2 hosts. No weight or threshold was tuned to mask this; it is documented in the architecture docs instead. Also fixes real bugs found along the way: ingest_dir's partition count summed file names instead of distinct dates, DuckDB errors were counted as bad rows, /api/alerts always returned an empty list regardless of the last analysis, and the dashboard still claimed every pillar was unimplemented. Restores four design corrections that were missing from docs/architecture.md (KL to Jensen-Shannon, the persistent-session detector, the JA4 licensing boundary, and deterministic reduction order), and catalogs the public datasets used for validation (IoT-23, CTU-Normal, Mendeley DTQBC) with their licenses and SHA-256 checksums under research/validation/. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
96 lines
2.7 KiB
Markdown
96 lines
2.7 KiB
Markdown
# Terminal
|
||
|
||
**English** · [Português](pt-BR/cli.md)
|
||
|
||
The `acaua` binary serves both as the CLI command runner and the background daemon.
|
||
This page describes the commands available in the engine.
|
||
|
||
```text
|
||
acaua <command> [options]
|
||
|
||
Commands:
|
||
serve Start the API and embedded web dashboard
|
||
analyze Analyze a Zeek log directory
|
||
doctor Check the local environment
|
||
update Check for available releases
|
||
```
|
||
|
||
## `acaua serve`
|
||
|
||
Starts the HTTP API and the embedded web dashboard.
|
||
|
||
```bash
|
||
acaua serve --bind 127.0.0.1:8787 --data-dir .acaua
|
||
```
|
||
|
||
| Option | Default | Meaning |
|
||
|---|---|---|
|
||
| `--bind` | `127.0.0.1:8787` | Listen address |
|
||
| `--data-dir` | `.acaua` | Store and runtime files |
|
||
|
||
The default bind is loopback-only. Exposing the daemon on a network requires a
|
||
reverse proxy with authentication. The API is documented in
|
||
[architecture.md](architecture.md#api).
|
||
|
||
## `acaua analyze`
|
||
|
||
```bash
|
||
acaua analyze /var/log/zeek/current
|
||
acaua analyze /var/log/zeek/current --json
|
||
```
|
||
|
||
Validates the target directory, ingests `conn.log` and `dns.log` traffic into Parquet partitions,
|
||
and runs threat detection algorithms across pillars 1–4. The human-readable output reports summary metrics,
|
||
individual alerts, and the `hosts:` ranking section (top 10 by priority score):
|
||
|
||
```text
|
||
diretório: /var/log/zeek/current
|
||
logs lidos: 2
|
||
registros: 10450
|
||
alertas: 2
|
||
[0.850] Beaconing detected: 192.168.1.50:any -> 198.51.100.1:443 (period ~14400s, score 0.850)
|
||
[0.600] Persistent session: 192.168.1.50 -> 198.51.100.1:443 (6.0h, score 0.600)
|
||
hosts:
|
||
[0.784] 192.168.1.50 0.850/0.600/0.000
|
||
estado: ok
|
||
```
|
||
|
||
## `acaua doctor`
|
||
|
||
```bash
|
||
acaua doctor
|
||
acaua doctor --json
|
||
```
|
||
|
||
Runs environment checks:
|
||
- `zeek`: verifies `zeek --version` or detects containerized execution (`ACAUA_RUNTIME=container`).
|
||
- `curl`: confirms HTTP download availability.
|
||
- `duckdb`: confirms dynamic linkage against `libduckdb.so` in runtime.
|
||
- `research`: verifies that the research workspace remains isolated.
|
||
|
||
## `acaua update`
|
||
|
||
```bash
|
||
acaua update
|
||
```
|
||
|
||
Queries the Gitea Releases API, compares the latest tag against the running
|
||
version, and prints upgrade instructions (`docker compose pull && docker compose up -d`
|
||
when running inside a container).
|
||
|
||
## Exit codes
|
||
|
||
| Code | Meaning |
|
||
|---|---|
|
||
| `0` | Success |
|
||
| `1` | Runtime error (invalid path, query error, I/O error) |
|
||
| `2` | Invalid command-line usage (clap) |
|
||
|
||
## Environment
|
||
|
||
| Variable | Meaning |
|
||
|---|---|
|
||
| `ACAUA_RUNTIME` | Set to `container` inside Docker images to adapt service checks |
|
||
| `DUCKDB_LIB_DIR` | Path to directory containing `libduckdb.so` when compiling natively |
|
||
| `LD_LIBRARY_PATH` | Shared library load path for `libduckdb.so` outside standard paths |
|