Lucas RayanandClaude Sonnet 5
c64bbbf775
Pillar 1 v1.1 (shipped earlier) flagged benign browsing bursts as beaconing: on short captures, grid periods longer than the observed span never complete a cycle, so significance saturates to 1 and the score sticks at exactly 0.5. v1.2 caps the grid at a third of the observed span, requires a minimum number of completed cycles, and excludes protocols that are periodic by nature (NTP, DNS, mDNS, ICMP). Validated against 300 seeds per scenario: false positives on bursty traffic drop from the 290-300/300 that v1.1 produced to 0/300, with every beacon-detection scenario scoring unchanged. Add Pillar 2 (persistent/long-lived sessions, with Zeek's fragmented TCP sessions rejoined after a 5-minute gap), Pillar 3 (DNS tunneling via Shannon-entropy information volume per subdomain per hour; the Jensen-Shannon divergence was measured and does not separate tunnels from benign CDN subdomains, so it stays in the evidence at zero weight instead of in the score), and Pillar 4 (deterministic noisy-OR fusion across the three pillars). The fusion formula was validated against 8 labeled real-traffic vectors (IoT-23, CTU-Normal) with tolerance <= 1e-4. A known limitation is kept, not hidden: a benign Philips HUE bulb's strict periodic polling and a 21.9h session score it above three real C2 hosts. No weight or threshold was tuned to mask this; it is documented in the architecture docs instead. Also fixes real bugs found along the way: ingest_dir's partition count summed file names instead of distinct dates, DuckDB errors were counted as bad rows, /api/alerts always returned an empty list regardless of the last analysis, and the dashboard still claimed every pillar was unimplemented. Restores four design corrections that were missing from docs/architecture.md (KL to Jensen-Shannon, the persistent-session detector, the JA4 licensing boundary, and deterministic reduction order), and catalogs the public datasets used for validation (IoT-23, CTU-Normal, Mendeley DTQBC) with their licenses and SHA-256 checksums under research/validation/. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
2.7 KiB
2.7 KiB
Terminal
English · Português
The acaua binary serves both as the CLI command runner and the background daemon.
This page describes the commands available in the engine.
acaua <command> [options]
Commands:
serve Start the API and embedded web dashboard
analyze Analyze a Zeek log directory
doctor Check the local environment
update Check for available releases
acaua serve
Starts the HTTP API and the embedded web dashboard.
acaua serve --bind 127.0.0.1:8787 --data-dir .acaua
| Option | Default | Meaning |
|---|---|---|
--bind |
127.0.0.1:8787 |
Listen address |
--data-dir |
.acaua |
Store and runtime files |
The default bind is loopback-only. Exposing the daemon on a network requires a reverse proxy with authentication. The API is documented in architecture.md.
acaua analyze
acaua analyze /var/log/zeek/current
acaua analyze /var/log/zeek/current --json
Validates the target directory, ingests conn.log and dns.log traffic into Parquet partitions,
and runs threat detection algorithms across pillars 1–4. The human-readable output reports summary metrics,
individual alerts, and the hosts: ranking section (top 10 by priority score):
diretório: /var/log/zeek/current
logs lidos: 2
registros: 10450
alertas: 2
[0.850] Beaconing detected: 192.168.1.50:any -> 198.51.100.1:443 (period ~14400s, score 0.850)
[0.600] Persistent session: 192.168.1.50 -> 198.51.100.1:443 (6.0h, score 0.600)
hosts:
[0.784] 192.168.1.50 0.850/0.600/0.000
estado: ok
acaua doctor
acaua doctor
acaua doctor --json
Runs environment checks:
zeek: verifieszeek --versionor detects containerized execution (ACAUA_RUNTIME=container).curl: confirms HTTP download availability.duckdb: confirms dynamic linkage againstlibduckdb.soin runtime.research: verifies that the research workspace remains isolated.
acaua update
acaua update
Queries the Gitea Releases API, compares the latest tag against the running
version, and prints upgrade instructions (docker compose pull && docker compose up -d
when running inside a container).
Exit codes
| Code | Meaning |
|---|---|
0 |
Success |
1 |
Runtime error (invalid path, query error, I/O error) |
2 |
Invalid command-line usage (clap) |
Environment
| Variable | Meaning |
|---|---|
ACAUA_RUNTIME |
Set to container inside Docker images to adapt service checks |
DUCKDB_LIB_DIR |
Path to directory containing libduckdb.so when compiling natively |
LD_LIBRARY_PATH |
Shared library load path for libduckdb.so outside standard paths |