Files
acaua/apps/gui/ui/index.html
T
Lucas RayanandClaude Sonnet 5 c64bbbf775 feat: implement Pillars 2-4 and fix a production false-positive in Pillar 1
Pillar 1 v1.1 (shipped earlier) flagged benign browsing bursts as
beaconing: on short captures, grid periods longer than the observed
span never complete a cycle, so significance saturates to 1 and the
score sticks at exactly 0.5. v1.2 caps the grid at a third of the
observed span, requires a minimum number of completed cycles, and
excludes protocols that are periodic by nature (NTP, DNS, mDNS,
ICMP). Validated against 300 seeds per scenario: false positives on
bursty traffic drop from the 290-300/300 that v1.1 produced to 0/300,
with every beacon-detection scenario scoring unchanged.

Add Pillar 2 (persistent/long-lived sessions, with Zeek's fragmented
TCP sessions rejoined after a 5-minute gap), Pillar 3 (DNS tunneling
via Shannon-entropy information volume per subdomain per hour; the
Jensen-Shannon divergence was measured and does not separate tunnels
from benign CDN subdomains, so it stays in the evidence at zero
weight instead of in the score), and Pillar 4 (deterministic
noisy-OR fusion across the three pillars).

The fusion formula was validated against 8 labeled real-traffic
vectors (IoT-23, CTU-Normal) with tolerance <= 1e-4. A known
limitation is kept, not hidden: a benign Philips HUE bulb's strict
periodic polling and a 21.9h session score it above three real C2
hosts. No weight or threshold was tuned to mask this; it is
documented in the architecture docs instead.

Also fixes real bugs found along the way: ingest_dir's partition
count summed file names instead of distinct dates, DuckDB errors
were counted as bad rows, /api/alerts always returned an empty list
regardless of the last analysis, and the dashboard still claimed
every pillar was unimplemented.

Restores four design corrections that were missing from
docs/architecture.md (KL to Jensen-Shannon, the persistent-session
detector, the JA4 licensing boundary, and deterministic reduction
order), and catalogs the public datasets used for validation
(IoT-23, CTU-Normal, Mendeley DTQBC) with their licenses and SHA-256
checksums under research/validation/.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
2026-11-01 00:28:54 -03:00

168 lines
6.3 KiB
HTML
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<!doctype html>
<html lang="pt-BR">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Acauã</title>
<link rel="icon" href="/logo.png">
<link rel="stylesheet" href="/app.css">
</head>
<body>
<div class="app">
<aside class="sidebar">
<div class="brand">
<img class="logo" src="/logo.png" alt="">
<div>
<strong>Acauã</strong>
<small>caça a ameaças em rede</small>
</div>
</div>
<div class="side-title">Navegação</div>
<nav class="nav" aria-label="Navegação principal">
<button type="button" class="nav-item active" data-target="overview">
<span class="nav-icon">◈</span>
<span><span class="nav-label">Visão geral</span><span class="nav-sub">painel e estado</span></span>
</button>
<button type="button" class="nav-item" data-target="alerts">
<span class="nav-icon">◎</span>
<span><span class="nav-label">Alertas</span><span class="nav-sub">evidências recentes</span></span>
</button>
<button type="button" class="nav-item" data-target="analysis">
<span class="nav-icon">⌁</span>
<span><span class="nav-label">Análise</span><span class="nav-sub">dataset Zeek</span></span>
</button>
<button type="button" class="nav-item" data-target="settings">
<span class="nav-icon">⚙</span>
<span><span class="nav-label">Configurações</span><span class="nav-sub">idioma e tema</span></span>
</button>
</nav>
<div class="side-foot">
<div class="status-row">
<span id="connection" class="pill"><span class="dot"></span><span id="connectionText">Conectando…</span></span>
<span class="pill muted">pré-lançamento</span>
</div>
<div class="status-row">
<span id="version" class="mono" data-i18n-skip>—</span>
<button id="updateBtn" type="button" class="link-btn">checar atualização</button>
</div>
</div>
</aside>
<main class="main">
<header class="topbar" id="overview">
<div>
<p class="eyebrow">Acauã</p>
<h1>Caça a ameaças em rede</h1>
<p class="sub">Pesquisa determinística, sem IA opaca</p>
</div>
<button id="settingsBtn" type="button" class="icon-btn" aria-label="Configurações" title="Configurações">⚙</button>
</header>
<section class="notice">
<strong>Estado atual.</strong>
<span>Ingestão de conn.log e dns.log do Zeek, armazenamento Parquet/DuckDB e os pilares 1 a 4 em versão inicial, validados com tráfego público real. Ainda não: ingestão contínua automática, alertas persistidos entre reinícios, movimentação lateral e sessões UDP.</span>
</section>
<section class="notice">
<strong>Uso autorizado.</strong>
<span>Use somente em redes próprias ou com autorização explícita. Nenhum pacote é enviado para fora.</span>
</section>
<section class="pillars" aria-label="Pilares de detecção">
<article class="card">
<span class="card-kicker">Pilar 1</span>
<h2>Beaconing</h2>
<p>Periodograma de Rayleigh/Schuster com grade limitada ao intervalo observado.</p>
<span class="tag">versão inicial</span>
</article>
<article class="card">
<span class="card-kicker">Pilar 2</span>
<h2>Sessões persistentes</h2>
<p>Sessões TCP longas, inclusive as que o Zeek divide por inatividade.</p>
<span class="tag">versão inicial</span>
</article>
<article class="card">
<span class="card-kicker">Pilar 3</span>
<h2>Anomalias de protocolo</h2>
<p>Volume de informação (entropia de Shannon) em subdomínios DNS.</p>
<span class="tag">versão inicial</span>
</article>
<article class="card">
<span class="card-kicker">Pilar 4</span>
<h2>Fusão de evidências</h2>
<p>Prioridade por host com evidência por alerta.</p>
<span class="tag">versão inicial</span>
</article>
</section>
<section class="panel" id="analysis">
<div class="panel-head">
<div>
<h2>Analisar dataset</h2>
<p class="hint">Aponte para um diretório de logs Zeek ou para um dataset local.</p>
</div>
<button id="refreshBtn" type="button" class="btn">Atualizar status</button>
</div>
<div class="field-row">
<label class="field">
<span>Diretório de logs</span>
<input id="datasetPath" type="text" placeholder="/var/log/zeek/current" autocomplete="off" spellcheck="false">
</label>
<button id="analyzeBtn" type="button" class="btn primary">Analisar</button>
</div>
<pre id="output" class="output">Nenhuma análise executada.</pre>
</section>
<section class="panel" id="alerts">
<div class="panel-head">
<div>
<h2>Alertas recentes</h2>
<p class="hint">Cada alerta carrega a evidência determinística que o sustenta.</p>
</div>
</div>
<ul id="alertList" class="alert-list">
<li class="empty">Nenhum alerta ainda. Analise um diretório de logs do Zeek.</li>
</ul>
</section>
<footer class="foot">
<span>Acauã · pré-lançamento</span>
<span class="mono">MIT OR Apache-2.0</span>
</footer>
</main>
</div>
<dialog id="settingsDlg" aria-labelledby="settingsTitle">
<form method="dialog">
<div class="dialog-head">
<h2 id="settingsTitle">Configurações</h2>
<button type="button" id="closeSettings" class="icon-btn" aria-label="Fechar configurações" title="Fechar">×</button>
</div>
<label class="field">
<span>Idioma</span>
<select id="langSel">
<option value="auto">Auto</option>
<option value="pt">Português</option>
<option value="en">English</option>
</select>
</label>
<div class="field">
<span>Tema</span>
<div class="segmented" id="themePick">
<button type="button" data-theme-pick="auto">Auto</button>
<button type="button" data-theme-pick="light">Claro</button>
<button type="button" data-theme-pick="dark">Escuro</button>
</div>
</div>
<menu>
<button type="button" id="doneSettings" class="btn primary">Fechar</button>
</menu>
</form>
</dialog>
<script type="module" src="/app.js"></script>
</body>
</html>