CyberMoranda CIDS - Current Progress

Project: CyberMoranda CIDS Full Form: Cognitive Intrusion Detection System Current Stage: MVP → Evaluation & Generalization Development Environment: Android + Termux + Rust CIDS ka main idea CIDS ka basic idea simple hai: «Attacker ko ek single request se judge nahi karna, balki uske behavior aur sequence ko samajhna.» Example: Normal Request ↓ Reconnaissance ↓ Admin probing ↓ Payload testing ↓ Attack chain ↓ Risk increases ↓ Response becomes stronger Isliye CIDS ka focus sirf "bad request block karo" nahi hai. CIDS ka goal hai: Think Before You Act. Core pipeline — Complete Current architecture: HTTP Request ↓ Event Normalizer [✓] ↓ SecurityEvent [✓] ↓ Session Context [✓] ↓ Behavior Correlation [✓] ↓ Security Signals [✓] ↓ Risk Engine [✓] ↓ Risk Confidence [✓] ↓ Risk Decay [✓] ↓ Policy Engine [✓] ↓ Adaptive Enforcement [✓] ↓ Cognitive Delay / Sticky Trap [✓] ↓ Containment / Deception [✓] Ab tak kya-kya build ho chuka hai Detection & Intelligence Standardized Security Event model Event normalization Telemetry pipeline Session tracking Behavioral correlation Security signals Explainable risk verdict Risk scoring Risk confidence Temporal risk decay Response CIDS ab situation ke according response change kar sakta hai: Observe ↓ Tarpit ↓ Contain ↓ Deception Iske saath: Cognitive delay Sticky Trap Containment Deception Time-wasting Rehabilitation after risk decay bhi implemented hain. Behavioral intelligence CIDS isolated events ke bajay sequences ko analyze karta hai. Examples: robots.txt → admin Recon → Admin transition detect ho sakta hai. Multiple different JA4 fingerprints Fingerprint rotation anomaly detect ho sakti hai. Browser User-Agent + Scanner-like JA4 Possible fingerprint spoofing detect ho sakti hai. Compound behavior bhi analyze hota hai, jaise: Recon + Admin probing + Payload fuzzing Isse overall risk increase ho sakta hai. JA4 TLS fingerprinting CIDS mein JA4 fingerprint inspection ka prototype bhi add ho chuka hai. Currently CIDS: suspicious/scanner-like JA4 identify karta hai Browser UA + suspicious JA4 mismatch detect karta hai Session ke andar JA4 rotation detect karta hai Fingerprint anomalies ko behavioral signals ke saath correlate karta hai Important: JA4 ko standalone proof nahi maana gaya hai. Ye behavioral context ka ek signal hai. Deterministic Replay Framework Ek important testing system bhi ban chuka hai. Ab attack scenarios ko manually repeat karne ki zarurat nahi. Replay framework mein: predefined events timestamps expected decision expected verdict isolated sessions virtual/deterministic timing assertion checking available hain. Isse hum reproduce kar sakte hain: Same input ↓ Same timeline ↓ Same CIDS behavior Ye debugging aur regression testing ke liye important hai. FP/FN Evaluation System CIDS ke liye proper evaluation framework bhi ban gaya hai. Metrics: True Positive True Negative False Positive False Negative Precision Recall F1 False Positive Rate False Negative Rate Response Alignment Exact Decision Matching Evaluation do levels par hota hai: Step Level + Scenario Level Frozen baseline Ek baseline dataset create kiya gaya: 10 scenarios / 20 steps Isme benign, suspicious aur hostile behavior included hai. Initial baseline performance: Precision: 71.43% Recall: 71.43% F1: 71.43% FPR: 15.38% FNR: 28.57% Iteration-1 tuning ke baad: Steps: 20/20 exact TP: 7 TN: 13 FP: 0 FN: 0 Precision: 100% Recall: 100% F1: 100% FPR: 0% FNR: 0% Scenario level par bhi: 10/10 exact FP: 0 FN: 0 Lekin ek important lesson: 100% baseline score ka matlab real-world 100% accuracy nahi hai. Kyuki tuning baseline scenarios ke around hui thi. Isi wajah se holdout testing ki gayi. Holdout testing — Reality check Holdout mein 6 naye scenarios aur 16 steps the. Result: Precision: 50% Recall: 33.33% F1: 40% FPR: 7.69% FNR: 66.67% Pehle ye disappointing lag sakta hai. Lekin actually ye useful result tha. Holdout ne prove kiya ki baseline par perfect score ke bawajood model mein generalization gaps hain. Holdout se mile 3 main problems Problem 1 — Legitimate admin workflow Realistic flow: / ↓ /login ↓ /admin ↓ /admin CIDS second "/admin" ko suspicious samajh raha hai. Current reason: "is_clean_second_admin_refresh" bahut strict hai aur sirf very specific history ko clean refresh maanta hai. Problem 2 — Unknown sensitive path Holdout: /.aws/credentials CIDS ne miss kar diya. Current sensitive path detection mein limited hardcoded paths hain: /.env /.git /config /backup /wp-admin Isliye unseen sensitive paths ka detection weak hai. Problem 3 — SQL Injection variant Holdout payload: username=admin'--&password=foo Current SQLi detection mainly in patterns ko check karta hai: ' or 1=1 union Isliye ye SQLi variant miss ho gaya. Ek important problem jo actually problem nahi nikli Humein doubt tha ki fast legitimate browsing: /home /docs /pricing /contact /blog ko CIDS attack samajh sakta hai. Holdout mein ye scenario pass hua. Isliye is logic ko unnecessary modify nahi karna hai. Current Iteration-2 status Iteration 1: Baseline ↓ Tuning ↓ 100% frozen-baseline result ↓ Git commit Complete. Current Iteration 2: Holdout failures ↓ Root causes identified ↓ SQLi variant identified ← NEXT ↓ Admin workflow fix ↓ Sensitive-path generalization ↓ Regression testing ↓ Holdout retest SQLi payload already identified hai: username=admin'--&password=foo Uske liye surgical detector improvement ready hai, lekin abhi code change apply nahi kiya gaya hai. Git checkpoint Iteration-1 tuning ka commit: 6b7c29 feat(eval): add FP/FN evaluation harness, baseline corpus, and iteration-1 risk tuning Current approach: Frozen baseline ↓ Iteration-2 changes ↓ cargo test ↓ Baseline regression ↓ Holdout evaluation ↓ Review ↓ New commit Purane working baseline ko directly modify nahi karna. Current mindset CIDS ab sirf features add karne ka project nahi raha. Ab real engineering phase hai: «"Kya CIDS unseen behavior ko bhi correctly understand kar sakta hai?"» Is stage par: False Positive ko kam karna bhi important hai. Aur: False Negative ko kam karna bhi. Sirf detection badha dena enough nahi hai, kyunki overly aggressive detection legitimate users ko bhi block kar sakti hai. Goal hai: Better Detection + Lower False Positives + Correct Response Level + Explainability Abhi exactly kahan khade hain CIDS MVP [✓] Core Detection [✓] Session Intelligence [✓] Behavior Correlation [✓] Risk Engine [✓] Confidence [✓] Risk Decay [✓] Policy Engine [✓] Adaptive Enforcement [✓] Sticky Trap [✓] Deception [✓] Replay Framework [✓] JA4 Prototype [✓] Evaluation Harness [✓] Frozen Baseline [✓] Holdout Benchmark [✓] Iteration-2 Generalization 🔄 Next technical task SQLi variant detection improve karna. Uske baad: legitimate multi-step admin workflow phir: generalized sensitive-path detection. Har change ke baad: cargo test ↓ Baseline regression ↓ Holdout ↓ Only then commit One-line project status «CyberMoranda CIDS ka core MVP aur adaptive defense architecture complete hai; ab project feature-building se nikal kar evidence-based detection tuning aur generalization phase mein hai.»