feat: twelve research-anchored techniques (REP-012..REP-024, Tier A)

[404SecNotFound]

PR 2 of 3. Stacked on #4 (docs), so review that first or read this diff alone; it is self-contained code.

Takes the catalog from 11 to 23 techniques. Every entry is anchored to a peer-reviewed paper with measured results.

What each one adds that nothing else covers

New	Anchor	Distinct from
REP-012 jittered + fleet callback	BAYWATCH DSN 2016, UVA ACSAC 2023	REP-001 is fixed-interval and trips any periodicity test. This widens jitter and spreads a rare callback across a fleet, so the period exists only in the aggregate
REP-013 self-propagating spread	PORTFILER IEEE CNS 2021	REP-003 is one source sweeping many hosts. This grows the distinct source count geometrically per generation
REP-014 cryptomining	MineShark NDSS 2025, MineHunter ACSAC 2021	Long-lived, low-rate, ~1:1 byte ratio. Neither a callback (many short sessions) nor exfil (large and asymmetric)
REP-015 low-throughput DNS exfil	Nadler et al. 2019	REP-004 runs at 20-200 q/s. This runs at queries per hour, under the thresholds REP-004 trips
REP-017 DoH bypass	CIRA-CIC-DoHBrw-2020	The signal is an absence: resolver traffic stops as TLS to a DoH resolver starts
REP-018 login chain	Hopper USENIX Sec 2021	REP-007 is failure volume, REP-011 is one user in two countries. Neither models a path with a mid-path credential switch
REP-019 stealth scan	TRW IEEE S&P 2004	Same shape as REP-002/003, parameterized to stay under thresholds. The negative control
REP-020 newly registered domain	PREDATOR CCS 2016	REP-008 is novel IP per host. This is org-wide domain novelty
REP-021 inbound perimeter scan	IMC 2024	Every existing scan technique is outbound. This is the direction a real perimeter mostly logs
REP-022 multi-stage IDS alert chain	Wilkens KCSM, ALERTPRO, AACT	REP-009 is a rate spike with no ordering. This is kill-chain ordered on a held pair, buried in noise
REP-023 TLS 1.3 flow-only C2	RAID 2024	Emits no handshake metadata at all, so a JA3-dependent rule gets nothing
REP-024 proxy relay	NDSS residential proxy	Models a host used as infrastructure, not as attacker or target

Benign look-alikes are a correctness requirement here

Bilot et al. (USENIX Sec 2025) found eight state-of-the-art provenance IDS not deployment-ready despite near-perfect published results. A plan that emits only the malicious pattern lets any rule score perfectly and teaches the operator nothing. So REP-012 ships a benign periodic destination, REP-014 a bursty long session, REP-015 a same-volume low-cardinality parent, REP-018 an admin star, REP-023 high-variance browsing, and REP-024 a sanctioned proxy with an identical pattern. Tests assert each control is present.

Three unverified questions from the docs, now settled by reading the code

1. One plan CAN span two render paths. render() dispatches per record on (log_type, subtype), so REP-017 and REP-018 needed no design change.
2. Inbound orientation works. _traffic_forward already reads src_intf/dst_intf from extra, so REP-021 reverses the interface pair with no profile change. Confirmed in emitted CEF: src=192.0.2.1 deviceInboundInterface=port1 ... deviceOutboundInterface=port2.
3. No new render path was needed for any of the twelve.

Two bugs the existing safety tests caught

• test_builder_never_exceeds_max_events runs every technique at max_events=10. REP-018 had no cap and produced 25. Fixed.
• REP-013's spread factor was max(1, fanout // 6), which is 1 at the low preset, so the infected population never grew and the technique degenerated into a slow REP-003. Now floored at 2.

Notable decisions

• scanner_external pool on 192.0.2.0/24, the one IANA documentation range no pool used. REP-021's ceiling is 508 addresses. That is a safety constraint, not a tuning limit: the IMC study observed 465,251 unique scanners and this cannot represent that. When the ceiling binds, the run summary says capped rather than silently emitting fewer sources, and a test asserts no shipped preset hits it.

• REP-022's stage key is engine-internal and never rendered. Real FortiOS has no such field, and emitting it would hand the answer to the detection under test. A test proves the chain is still recoverable from rendered CEF via attack-name order and ascending severity. Verified by hand:

  TCP.Port.Scan → HTTP.Unix.Shell.IFS.RCE → Log4j RCE / PHPUnit RCE → Web.Server.Password.Files.Access → Generic.Web.Shell.Access, on one held pair, noise on other pairs.

• REP-016 is intentionally absent. It needs dns:dns-response, and a DGA entry with no NXDOMAIN in it would be worse than no entry. Coming in PR 3.

Verification

427 tests pass, up from 325. 101 new: each technique's distinguishing property, plus cross-cutting determinism, time ordering, three-vendor render parity, and synthetic-address-only assertions. ruff, black, mypy clean. replicant list renders all 23; end-to-end CEF spot-checked for REP-021 and REP-022.

Note on CI

The Shell job is failing on the base branch too, on a docs-only diff that does not touch scripts/. main was green on 2026-07-23 and bash -n scripts/install.sh passes locally. It looks like the Docker Hub pull of the pinned koalaman/shellcheck:v0.11.0 image, not a code regression. Being confirmed separately; flagging rather than merging past it silently.