Lucas RayanandClaude Sonnet 5
c64bbbf775
Pillar 1 v1.1 (shipped earlier) flagged benign browsing bursts as beaconing: on short captures, grid periods longer than the observed span never complete a cycle, so significance saturates to 1 and the score sticks at exactly 0.5. v1.2 caps the grid at a third of the observed span, requires a minimum number of completed cycles, and excludes protocols that are periodic by nature (NTP, DNS, mDNS, ICMP). Validated against 300 seeds per scenario: false positives on bursty traffic drop from the 290-300/300 that v1.1 produced to 0/300, with every beacon-detection scenario scoring unchanged. Add Pillar 2 (persistent/long-lived sessions, with Zeek's fragmented TCP sessions rejoined after a 5-minute gap), Pillar 3 (DNS tunneling via Shannon-entropy information volume per subdomain per hour; the Jensen-Shannon divergence was measured and does not separate tunnels from benign CDN subdomains, so it stays in the evidence at zero weight instead of in the score), and Pillar 4 (deterministic noisy-OR fusion across the three pillars). The fusion formula was validated against 8 labeled real-traffic vectors (IoT-23, CTU-Normal) with tolerance <= 1e-4. A known limitation is kept, not hidden: a benign Philips HUE bulb's strict periodic polling and a 21.9h session score it above three real C2 hosts. No weight or threshold was tuned to mask this; it is documented in the architecture docs instead. Also fixes real bugs found along the way: ingest_dir's partition count summed file names instead of distinct dates, DuckDB errors were counted as bad rows, /api/alerts always returned an empty list regardless of the last analysis, and the dashboard still claimed every pillar was unimplemented. Restores four design corrections that were missing from docs/architecture.md (KL to Jensen-Shannon, the persistent-session detector, the JA4 licensing boundary, and deterministic reduction order), and catalogs the public datasets used for validation (IoT-23, CTU-Normal, Mendeley DTQBC) with their licenses and SHA-256 checksums under research/validation/. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
89 lines
2.5 KiB
Rust
89 lines
2.5 KiB
Rust
use acaua_core::{doctor, fusion, pillar1, pillar2, pillar3, pillar4, storage, zeek, AcauaError};
|
|
|
|
#[test]
|
|
fn pillar1_returns_a_skeleton_score() {
|
|
let input = pillar1::BeaconingInput {
|
|
timestamps: vec![1.0, 2.0, 3.0],
|
|
proto: "tcp".to_string(),
|
|
};
|
|
let score = pillar1::score(&input).unwrap();
|
|
assert_eq!(score.observations, 3);
|
|
assert_eq!(score.status, "insufficient_data");
|
|
}
|
|
|
|
#[test]
|
|
fn pillar2_counts_long_connections_without_panicking() {
|
|
let input = pillar2::SessionInput {
|
|
sessions: vec![
|
|
pillar2::SessionCandidate {
|
|
start_ts: 1000.0,
|
|
end_ts: 1001.0,
|
|
duration: 1.0,
|
|
parts: 1,
|
|
orig_bytes: 10,
|
|
resp_bytes: 20,
|
|
},
|
|
pillar2::SessionCandidate {
|
|
start_ts: 2000.0,
|
|
end_ts: 2400.0,
|
|
duration: 400.0,
|
|
parts: 1,
|
|
orig_bytes: 100,
|
|
resp_bytes: 200,
|
|
},
|
|
],
|
|
failed_attempts: 0,
|
|
};
|
|
let score = pillar2::score(&input).unwrap();
|
|
assert_eq!(score.longest_session_seconds, 400.0);
|
|
assert_eq!(score.status, "ok");
|
|
}
|
|
|
|
#[test]
|
|
fn pillar3_handles_empty_dns_input() {
|
|
let scores = pillar3::score(&pillar3::ProtocolInput::default()).unwrap();
|
|
assert!(scores.is_empty());
|
|
}
|
|
|
|
#[test]
|
|
fn pillar4_fuses_three_inputs() {
|
|
let score = pillar4::score("10.0.0.1", &pillar4::FusionInput::default()).unwrap();
|
|
assert_eq!(score.terms.len(), 3);
|
|
assert_eq!(score.formula_version, "1.0");
|
|
assert_eq!(score.score, 0.0);
|
|
}
|
|
|
|
#[test]
|
|
fn fusion_returns_no_alerts_yet() {
|
|
let hosts = fusion::fuse(&[]).unwrap();
|
|
assert!(hosts.is_empty());
|
|
}
|
|
|
|
#[test]
|
|
fn storage_reports_the_reserved_backend() {
|
|
let store = storage::Storage::open(std::env::temp_dir()).unwrap();
|
|
let summary = store.summary().unwrap();
|
|
assert_eq!(summary.ttl_days, 7);
|
|
assert_eq!(summary.records, 0);
|
|
}
|
|
|
|
#[test]
|
|
fn zeek_rejects_a_missing_directory() {
|
|
let error =
|
|
zeek::analyze_dir("/definitely/not/a/zeek/directory", std::env::temp_dir()).unwrap_err();
|
|
assert!(matches!(error, AcauaError::InvalidInput(_)));
|
|
}
|
|
|
|
#[test]
|
|
fn zeek_classifies_known_logs() {
|
|
assert_eq!(zeek::classify_log("dns.log"), zeek::ZeekLogKind::Dns);
|
|
assert_eq!(zeek::classify_log("other.log"), zeek::ZeekLogKind::Unknown);
|
|
}
|
|
|
|
#[test]
|
|
fn doctor_reports_checks() {
|
|
let report = doctor::run();
|
|
assert!(!report.checks.is_empty());
|
|
assert!(report.status == "ok" || report.status == "degraded");
|
|
}
|