Lucas RayanandClaude Sonnet 5
c64bbbf775
Pillar 1 v1.1 (shipped earlier) flagged benign browsing bursts as beaconing: on short captures, grid periods longer than the observed span never complete a cycle, so significance saturates to 1 and the score sticks at exactly 0.5. v1.2 caps the grid at a third of the observed span, requires a minimum number of completed cycles, and excludes protocols that are periodic by nature (NTP, DNS, mDNS, ICMP). Validated against 300 seeds per scenario: false positives on bursty traffic drop from the 290-300/300 that v1.1 produced to 0/300, with every beacon-detection scenario scoring unchanged. Add Pillar 2 (persistent/long-lived sessions, with Zeek's fragmented TCP sessions rejoined after a 5-minute gap), Pillar 3 (DNS tunneling via Shannon-entropy information volume per subdomain per hour; the Jensen-Shannon divergence was measured and does not separate tunnels from benign CDN subdomains, so it stays in the evidence at zero weight instead of in the score), and Pillar 4 (deterministic noisy-OR fusion across the three pillars). The fusion formula was validated against 8 labeled real-traffic vectors (IoT-23, CTU-Normal) with tolerance <= 1e-4. A known limitation is kept, not hidden: a benign Philips HUE bulb's strict periodic polling and a 21.9h session score it above three real C2 hosts. No weight or threshold was tuned to mask this; it is documented in the architecture docs instead. Also fixes real bugs found along the way: ingest_dir's partition count summed file names instead of distinct dates, DuckDB errors were counted as bad rows, /api/alerts always returned an empty list regardless of the last analysis, and the dashboard still claimed every pillar was unimplemented. Restores four design corrections that were missing from docs/architecture.md (KL to Jensen-Shannon, the persistent-session detector, the JA4 licensing boundary, and deterministic reduction order), and catalogs the public datasets used for validation (IoT-23, CTU-Normal, Mendeley DTQBC) with their licenses and SHA-256 checksums under research/validation/. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
1.2 KiB
1.2 KiB
Espaço de pesquisa
English · Português
Este diretório serve só para validação científica. Ele não faz parte do produto Acauã, não é compilado pelo Cargo e nunca entra em um artefato de release.
Use-o para gerar fixtures reproduzíveis, comparar implementações com bibliotecas de referência e rodar notebooks dos quatro pilares de detecção. O motor Rust continua sendo o único runtime usado em produção.
Scripts de validação e referências de datasets estão em validation/:
validation/datasets.tsv: URLs de datasets públicos, arquivos, licenças e checksums SHA-256.validation/p1v12sim.py: simulação e validação do Pilar 1 v1.2 (Rayleigh/Schuster).validation/p2real.py: validação do encadeamento de sessões TCP persistentes.validation/p3sim.py,p3hourly.py,p3real.py: análise de capacidade de informação em túneis DNS.validation/mkpcap_idle.py: gerador de fixture sintético para divisão TCP por inatividade.
cd research
python3 -m venv .venv
. .venv/bin/activate
pip install -e .
jupyter lab
O ambiente Python é isolado do workspace. Adicionar uma dependência aqui não a adiciona ao binário distribuído.