Lucas RayanandClaude Sonnet 5
c64bbbf775
Pillar 1 v1.1 (shipped earlier) flagged benign browsing bursts as beaconing: on short captures, grid periods longer than the observed span never complete a cycle, so significance saturates to 1 and the score sticks at exactly 0.5. v1.2 caps the grid at a third of the observed span, requires a minimum number of completed cycles, and excludes protocols that are periodic by nature (NTP, DNS, mDNS, ICMP). Validated against 300 seeds per scenario: false positives on bursty traffic drop from the 290-300/300 that v1.1 produced to 0/300, with every beacon-detection scenario scoring unchanged. Add Pillar 2 (persistent/long-lived sessions, with Zeek's fragmented TCP sessions rejoined after a 5-minute gap), Pillar 3 (DNS tunneling via Shannon-entropy information volume per subdomain per hour; the Jensen-Shannon divergence was measured and does not separate tunnels from benign CDN subdomains, so it stays in the evidence at zero weight instead of in the score), and Pillar 4 (deterministic noisy-OR fusion across the three pillars). The fusion formula was validated against 8 labeled real-traffic vectors (IoT-23, CTU-Normal) with tolerance <= 1e-4. A known limitation is kept, not hidden: a benign Philips HUE bulb's strict periodic polling and a 21.9h session score it above three real C2 hosts. No weight or threshold was tuned to mask this; it is documented in the architecture docs instead. Also fixes real bugs found along the way: ingest_dir's partition count summed file names instead of distinct dates, DuckDB errors were counted as bad rows, /api/alerts always returned an empty list regardless of the last analysis, and the dashboard still claimed every pillar was unimplemented. Restores four design corrections that were missing from docs/architecture.md (KL to Jensen-Shannon, the persistent-session detector, the JA4 licensing boundary, and deterministic reduction order), and catalogs the public datasets used for validation (IoT-23, CTU-Normal, Mendeley DTQBC) with their licenses and SHA-256 checksums under research/validation/. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
50 lines
3.3 KiB
Markdown
50 lines
3.3 KiB
Markdown
# Changelog
|
|
|
|
**English** · [Português](CHANGELOG.pt-BR.md)
|
|
|
|
Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow SemVer.
|
|
|
|
## [Unreleased]
|
|
|
|
### Added
|
|
- **Pillar 1 (v1.2):** Rayleigh/Schuster periodogram with grid bounded by the observed span ($T \le \text{span}/3$), regularity gating, and infrastructure exclusions (NTP, mDNS/LLMNR/NBNS, SSDP, non-TCP/UDP).
|
|
- **Pillar 2 (v1.0):** Persistent TCP session detector with inactivity chaining (gaps $\le 3600$s without SYN), logarithmic duration scoring, and PCR / failed attempt metrics in evidence.
|
|
- **Pillar 3 (v1.0):** DNS subdomain information capacity detector ($I = H \times C$ bits/h) to identify high-entropy tunnels, with Jensen-Shannon Divergence (JSD) recorded in evidence.
|
|
- **Pillar 4 (v1.0):** Per-host weighted noisy-OR fusion ($w_1=w_2=w_3=0.75$) with deterministic evidence linkage, ranking hosts in `acaua analyze` human output via the `hosts:` section.
|
|
- **Zeek `dns.log` ingestion:** Daily Hive Parquet partitioning for DNS queries with deterministic column mapping by TSV header.
|
|
- **Parquet storage schema (v1.2):** 15-column schema for `conn.log` supporting `conn_state`, `history`, `orig_pkts`, `resp_pkts`, `orig_ip_bytes`, `resp_ip_bytes`.
|
|
- **In-memory alert reporting:** Web daemon `/api/alerts` route now serves alerts from the most recent analysis run.
|
|
|
|
### Changed
|
|
- **Breaking (0.x):** Pillar 1 formula v1.2 modifies scores and changes `Alert.id` generation to reflect the corrected bounded grid and session-based aggregation.
|
|
- Distribution pivoted to 100% Docker and docker-compose (server daemon and web dashboard); native binary tarballs and desktop installers are discontinued.
|
|
- DuckDB is now a mandatory runtime dependency, dynamically linked against the official prebuilt `libduckdb.so` (v1.5.6) with fixed SHA-256 via `scripts/fetch-libduckdb.sh`.
|
|
- Upgraded workspace MSRV to Rust 1.88 (required by `duckdb ~1.10506.1`).
|
|
- Upgraded container runtime and base image to Debian 13 trixie.
|
|
|
|
### Fixed
|
|
- Fixed critical false positives in short captures where period candidates exceeded the observed span.
|
|
- Corrected partition counting in `ingest_dir` to take the union of partition dates instead of summing file counts.
|
|
- DuckDB execution errors are now tracked in `files_failed` instead of miscounted as bad rows.
|
|
- Updated `doctor` check status from "skeleton" to "ok" / "degraded".
|
|
- Graceful shutdown on `SIGTERM` when running as PID 1 in container environments.
|
|
|
|
### Removed
|
|
- Tauri desktop application (`apps/gui/src-tauri`) and associated desktop build scripts.
|
|
- Self-update flag (`acaua update --apply`) and in-place binary overwrite. Updates are now handled via image pulls (`docker compose pull`).
|
|
|
|
## [0.1.0] - 2026-10-31
|
|
|
|
### Added
|
|
- Rust workspace with `acaua-core` and `acaua-cli`.
|
|
- CLI skeleton with `serve`, `analyze`, `doctor` and `update [--apply]`.
|
|
- Axum API skeleton with health, status, alerts, analyze and update-check routes.
|
|
- Embedded vanilla UI and Tauri desktop shell.
|
|
- Deterministic pillar, fusion, storage, Zeek and updater stubs with smoke tests.
|
|
- English/Portuguese documentation, CI/release workflows and local check script.
|
|
|
|
### Notes
|
|
- The four mathematical pillars are not implemented.
|
|
- The Zeek parser and DuckDB storage are stubs.
|
|
- No release artifact has been published.
|