ciberfauna/acaua
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity
Files
c64bbbf775f2981d6f637544717d31bf2f88ad4b
acaua/CHANGELOG.md
T
Lucas RayanandClaude Sonnet 5 c64bbbf775 feat: implement Pillars 2-4 and fix a production false-positive in Pillar 1 
Pillar 1 v1.1 (shipped earlier) flagged benign browsing bursts as
beaconing: on short captures, grid periods longer than the observed
span never complete a cycle, so significance saturates to 1 and the
score sticks at exactly 0.5. v1.2 caps the grid at a third of the
observed span, requires a minimum number of completed cycles, and
excludes protocols that are periodic by nature (NTP, DNS, mDNS,
ICMP). Validated against 300 seeds per scenario: false positives on
bursty traffic drop from the 290-300/300 that v1.1 produced to 0/300,
with every beacon-detection scenario scoring unchanged.

Add Pillar 2 (persistent/long-lived sessions, with Zeek's fragmented
TCP sessions rejoined after a 5-minute gap), Pillar 3 (DNS tunneling
via Shannon-entropy information volume per subdomain per hour; the
Jensen-Shannon divergence was measured and does not separate tunnels
from benign CDN subdomains, so it stays in the evidence at zero
weight instead of in the score), and Pillar 4 (deterministic
noisy-OR fusion across the three pillars).

The fusion formula was validated against 8 labeled real-traffic
vectors (IoT-23, CTU-Normal) with tolerance <= 1e-4. A known
limitation is kept, not hidden: a benign Philips HUE bulb's strict
periodic polling and a 21.9h session score it above three real C2
hosts. No weight or threshold was tuned to mask this; it is
documented in the architecture docs instead.

Also fixes real bugs found along the way: ingest_dir's partition
count summed file names instead of distinct dates, DuckDB errors
were counted as bad rows, /api/alerts always returned an empty list
regardless of the last analysis, and the dashboard still claimed
every pillar was unimplemented.

Restores four design corrections that were missing from
docs/architecture.md (KL to Jensen-Shannon, the persistent-session
detector, the JA4 licensing boundary, and deterministic reduction
order), and catalogs the public datasets used for validation
(IoT-23, CTU-Normal, Mendeley DTQBC) with their licenses and SHA-256
checksums under research/validation/.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
2026-11-01 00:28:54 -03:00

3.3 KiB
Raw Blame History

Changelog

English · Português

Format based on Keep a Changelog; versions follow SemVer.

[Unreleased]

Added

  • Pillar 1 (v1.2): Rayleigh/Schuster periodogram with grid bounded by the observed span (T \le \text{span}/3), regularity gating, and infrastructure exclusions (NTP, mDNS/LLMNR/NBNS, SSDP, non-TCP/UDP).
  • Pillar 2 (v1.0): Persistent TCP session detector with inactivity chaining (gaps $\le 3600$s without SYN), logarithmic duration scoring, and PCR / failed attempt metrics in evidence.
  • Pillar 3 (v1.0): DNS subdomain information capacity detector (I = H \times C bits/h) to identify high-entropy tunnels, with Jensen-Shannon Divergence (JSD) recorded in evidence.
  • Pillar 4 (v1.0): Per-host weighted noisy-OR fusion (w_1=w_2=w_3=0.75) with deterministic evidence linkage, ranking hosts in acaua analyze human output via the hosts: section.
  • Zeek dns.log ingestion: Daily Hive Parquet partitioning for DNS queries with deterministic column mapping by TSV header.
  • Parquet storage schema (v1.2): 15-column schema for conn.log supporting conn_state, history, orig_pkts, resp_pkts, orig_ip_bytes, resp_ip_bytes.
  • In-memory alert reporting: Web daemon /api/alerts route now serves alerts from the most recent analysis run.

Changed

  • Breaking (0.x): Pillar 1 formula v1.2 modifies scores and changes Alert.id generation to reflect the corrected bounded grid and session-based aggregation.
  • Distribution pivoted to 100% Docker and docker-compose (server daemon and web dashboard); native binary tarballs and desktop installers are discontinued.
  • DuckDB is now a mandatory runtime dependency, dynamically linked against the official prebuilt libduckdb.so (v1.5.6) with fixed SHA-256 via scripts/fetch-libduckdb.sh.
  • Upgraded workspace MSRV to Rust 1.88 (required by duckdb ~1.10506.1).
  • Upgraded container runtime and base image to Debian 13 trixie.

Fixed

  • Fixed critical false positives in short captures where period candidates exceeded the observed span.
  • Corrected partition counting in ingest_dir to take the union of partition dates instead of summing file counts.
  • DuckDB execution errors are now tracked in files_failed instead of miscounted as bad rows.
  • Updated doctor check status from "skeleton" to "ok" / "degraded".
  • Graceful shutdown on SIGTERM when running as PID 1 in container environments.

Removed

  • Tauri desktop application (apps/gui/src-tauri) and associated desktop build scripts.
  • Self-update flag (acaua update --apply) and in-place binary overwrite. Updates are now handled via image pulls (docker compose pull).

[0.1.0] - 2026-10-31

Added

  • Rust workspace with acaua-core and acaua-cli.
  • CLI skeleton with serve, analyze, doctor and update [--apply].
  • Axum API skeleton with health, status, alerts, analyze and update-check routes.
  • Embedded vanilla UI and Tauri desktop shell.
  • Deterministic pillar, fusion, storage, Zeek and updater stubs with smoke tests.
  • English/Portuguese documentation, CI/release workflows and local check script.

Notes

  • The four mathematical pillars are not implemented.
  • The Zeek parser and DuckDB storage are stubs.
  • No release artifact has been published.
Reference in new issue View Git Blame Copy Permalink