Lucas RayanandClaude Sonnet 5
c64bbbf775
Pillar 1 v1.1 (shipped earlier) flagged benign browsing bursts as beaconing: on short captures, grid periods longer than the observed span never complete a cycle, so significance saturates to 1 and the score sticks at exactly 0.5. v1.2 caps the grid at a third of the observed span, requires a minimum number of completed cycles, and excludes protocols that are periodic by nature (NTP, DNS, mDNS, ICMP). Validated against 300 seeds per scenario: false positives on bursty traffic drop from the 290-300/300 that v1.1 produced to 0/300, with every beacon-detection scenario scoring unchanged. Add Pillar 2 (persistent/long-lived sessions, with Zeek's fragmented TCP sessions rejoined after a 5-minute gap), Pillar 3 (DNS tunneling via Shannon-entropy information volume per subdomain per hour; the Jensen-Shannon divergence was measured and does not separate tunnels from benign CDN subdomains, so it stays in the evidence at zero weight instead of in the score), and Pillar 4 (deterministic noisy-OR fusion across the three pillars). The fusion formula was validated against 8 labeled real-traffic vectors (IoT-23, CTU-Normal) with tolerance <= 1e-4. A known limitation is kept, not hidden: a benign Philips HUE bulb's strict periodic polling and a 21.9h session score it above three real C2 hosts. No weight or threshold was tuned to mask this; it is documented in the architecture docs instead. Also fixes real bugs found along the way: ingest_dir's partition count summed file names instead of distinct dates, DuckDB errors were counted as bad rows, /api/alerts always returned an empty list regardless of the last analysis, and the dashboard still claimed every pillar was unimplemented. Restores four design corrections that were missing from docs/architecture.md (KL to Jensen-Shannon, the persistent-session detector, the JA4 licensing boundary, and deterministic reduction order), and catalogs the public datasets used for validation (IoT-23, CTU-Normal, Mendeley DTQBC) with their licenses and SHA-256 checksums under research/validation/. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
Research workspace
English · Português
This directory is for scientific validation only. It is not part of the Acauã product, is not compiled by Cargo, and is never included in a release artifact.
Use it to generate reproducible fixtures, compare implementations against reference libraries, and run notebooks for the four detection pillars. The Rust engine must remain the only runtime used in production.
Validation scripts and dataset references are located in validation/:
validation/datasets.tsv: public dataset URLs, filenames, licenses, and SHA-256 checksums.validation/p1v12sim.py: simulation and validation for Pillar 1 v1.2 (Rayleigh/Schuster).validation/p2real.py: persistent TCP session chaining validation.validation/p3sim.py,p3hourly.py,p3real.py: DNS tunnel information capacity analysis.validation/mkpcap_idle.py: synthetic fixture generator for idle TCP splitting.
cd research
python3 -m venv .venv
. .venv/bin/activate
pip install -e .
jupyter lab
The Python environment is isolated from the workspace. Adding a dependency here does not add it to the shipped binary.