Skip to content

v0.8.0 — Analytics and statistics

Choose a tag to compare

View all tags
@MichalPlanetaDev MichalPlanetaDev released this 06 Jul 13:42
· 21 commits to main since this release
v0.8.0
e4c3cb7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.8.0 — Analytics and statistics

Tickline v0.8.0 adds deterministic Python analytics for validated investigation bundles.

Added

  • Strict schema-version-1 investigation-bundle parsing and validation.
  • Duplicate-key, unknown-field, unsigned-integer, digest, timestamp, session, evidence-chain, trusted-head, and summary consistency checks.
  • Deterministic overall, session, command-type, rejection-code, and target-tick statistics.
  • Verified multi-investigation baseline construction.
  • Duplicate archive and candidate-in-baseline protection.
  • Baseline minimum, maximum, mean, median, median absolute deviation, and explicit zero-MAD tolerance values.
  • Explainable outlier findings using modified z-scores or explicit zero-MAD tolerances.
  • Stable finding severity and ordering.
  • Human review dispositions for confirmed anomalies, expected behavior, false positives, and findings requiring more context.
  • Review rationales, reviewer identifiers, UTC timestamps, and optional evidence-record references.
  • Deterministic schema-version-1 JSON reports.
  • Command-line report generation with baseline, candidate, review, threshold, timestamp, stdout, and file-output options.
  • Repository-local scripts/tickline-analytics.sh launcher.
  • Analytics architecture, methodology, trust-boundary, report-contract, and limitation documentation.
  • Python tests covering validation, statistics, baselines, outliers, reviews, reports, CLI behavior, and launcher execution.

Verification

Run from the repository root:

bash scripts/check-local.sh
bash scripts/check-unity.sh

The repository gate covers documentation validation, normal C++ tests, sanitizer tests, Python tests, Go tests and vet, developer-console version verification, and the Docker smoke build.

The Unity gate executes the EditMode suite through the WSL-compatible disposable Windows project mirror.

The Python analytics suite includes 46 tests.

Security and trust boundary

The native C++ implementation remains authoritative for evidence-chain verification, deterministic replay, investigation storage, and bundle export.

Python analytics operate only on bundles that pass strict structural and consistency validation. Analytics do not execute authoritative commands, modify evidence, repair invalid input, or replace manual investigation.

Automated outlier findings are not final determinations. Review metadata preserves the distinction between an unusual observation, an expected workload, a false positive, and a confirmed anomaly.

Limitations

  • The analytics layer does not prove malicious intent or evidence authorship.
  • No machine-learning model is trained or executed.
  • Baselines must be selected with appropriate operational context.
  • Workload and environment differences are not normalized automatically.
  • Correlation and statistical distance do not establish causality.
  • No production monitoring, alerting, remote analytics service, authentication, encryption, digital signatures, or key management is included.
  • Collision validation and production anti-cheat deployment remain out of scope.
Assets 2
Loading