Skip to content

Roadmap

Jump to bottom
Mohhudib edited this page Jun 20, 2026 · 8 revisions

Roadmap

Open — v2.3.0 and beyond

#51 — Integration Test Suite

tests/integration/ has 7 live end-to-end test files (test_live_canary.py, test_live_containment.py, test_live_sim_detections.py, test_live_akira_pipeline.py, test_live_autonomous_agent.py, test_live_autonomous_lockbit.py, test_live_silent_encryption.py) that spin up the full stack (agent → backend → Celery → WebSocket → alert). Unit suite (234 tests, 89% coverage) is passing.

#52 — Exception Management UI

A settings page to manage the whitelist without editing code:

  • Add/remove whitelisted processes, paths, extensions
  • Toggle rules on/off
  • Persist changes to backend config API

#55 — Dependabot Security Alerts

Review and resolve remaining moderate Dependabot vulnerability alerts (transitive frontend dependencies).

Alert Correlation Engine

Group related events across time windows — connect entropy spikes, canary touches, and extension renames into a single correlated incident rather than separate alerts.

Multi-Host Event Aggregation

Aggregate events from multiple endpoints into a single SIEM view.

Dependabot PRs — Major Breaking Versions (Do Not Auto-Merge)

PR Upgrade Risk
#38 Vite 5 → 8 BREAKING — review manually
#42 Tailwind 3 → 4 BREAKING config format — review manually
#43 react-router-dom 6 → 7 BREAKING API — review manually
#37 openai >=1.30 → >=2.38 BREAKING — review manually

Completed

v2.2.0 (2026-06-09)

  • ✅ LockBit/Qilin speed gap closed — Signal 6 (hyper-fast unlink burst: ≥20 del/sec + 5+ files → +15 score) pushes LockBit/Qilin from score 60 → 75 (≥ SCORE_BLOCK); __handle_unlink now calls blocked_pids.update() at kernel level; _handle_behavior entropy gate relaxed (or ev.score >= 70) to handle families that delete files faster than the 1 ms perf poll
  • ✅ Celery update_host_risk race fixed — removed duplicate call from events.py; update_host_risk.delay() now fires at end of auto_ack_containment and auto_ack_by_event after DB commit
  • ✅ FacetRail toggle — sliders button in query bar toggles the filter panel; X button inside the rail also closes it
  • ✅ DetailFlyout conditional mount — only renders when an alert is selected; was always mounted showing blank third column
  • ✅ PDF/JSON export hardened — ΔH header replaced with ASCII Entr (WinAnsiEncoding fix); triggerDownload keeps object URL alive 5 s (Firefox download race fix)
  • ✅ Full 6-family simulation suite validated — WannaCry, LockBit 5.0, Akira, DarkSide, Qilin, DFS Canary all contained; results posted in Discussion #70
  • ✅ Apache 2.0 license added — dual MIT / Apache-2.0 licensing documented
  • ✅ Three-axis evaluation complete — Efficacy (Recall 1.000, FPR 0.000, N=30), Efficiency (MTTD ~150ms, overhead 1.70µs/op, N=30), Robustness (all 4 layers necessary, Holm p=0.001, N=15); archived under docs/evaluation/

v2.1.1 (2026-06-08)

  • ✅ eBPF IGNORE_COMMS enforcement — _handle_write and _handle_exec now check comm in IGNORE_COMMS before any flagging or containment; fixes Docker stack being SIGKILLed during live testing
  • ✅ Docker image — alembic.ini not found — Dockerfile.backend now copies alembic.ini into the image; backend no longer crash-loops on startup
  • ✅ Alembic migration path resolution — migration config resolved to absolute paths; startup reliable regardless of launch directory
  • ✅ Simulation import safety guard — tightened to negative-lookahead regex so agent.monitor_ebpf import is no longer incorrectly blocked
  • ✅ cgroup v2 network isolation — Stage 3 containment now scopes iptables DROP to a dedicated cgroup v2 node (not UID-wide), preventing over-isolation of other processes

v2.1.0 (2026-06-07)

  • ✅ GitHub Projects board — "R-Sentry Roadmap" with Backlog/In Progress/Review/Done columns; all 5 issues linked
  • ✅ Milestones — v2.1.0 (CI/Docs/Security) and v2.2.0 (Feature Completeness) created with due dates
  • ✅ eBPF Phase 3 — full 5-syscall behavioral detection system — proc_profile BPF map, BPF LSM canary blocking (-EPERM in nanoseconds), blocked_pids velocity burst, entropy verification on behavior events
  • ✅ 4-prefix canary system — AAA_, aaa_, ZZZ_, zzz_ naming prefixes; 4× surface area
  • ✅ Ransomware family profiling — LockBit 5.0 (16-char ext, two-pass), Akira (.akiracrypt, intermittent), ESXi (.vmdk/.vmx/.vmem)
  • ✅ Markov disabled in eBPF mode — proc_profile BPF map replaces Markov repositioner in eBPF backend
  • ✅ GitHub Actions CI — backend lint (ruff F-series), Docker build, landing page deploy, Dependabot auto-merge
  • ✅ Ruff linting — 25 F401/F841 violations fixed; ruff config in pyproject.toml
  • ✅ Coverage gate — 75% minimum enforced in CI for entropy/lineage/adaptive
  • ✅ Pinned action versions — all GitHub Actions use exact commit SHA pins (supply chain security)
  • ✅ Alembic database migrations — versioned schema with backend/migrations/versions/0001_initial_schema.py; replaces create_all on startup
  • ✅ Ransomware detection benchmark — scripts/benchmark_ransomware.py for Akira/Qilin/LockBit 5.0 latency and accuracy
  • ✅ Test suite expanded to 234 passing tests — 89% coverage; backend routers, AI analyst, Celery tasks, containment pipeline all covered
  • ✅ Documentation overhaul — README badges, CODE_WALKTHROUGH simulations/tests sections, all 11 wiki pages refreshed

v2.0.0 (2026-06-03)

  • ✅ SIEM Dashboard redesign — Kibana-style: TopBar, StatusBar, FacetRail, MetricsStrip, AlertsHistogram, AlertsTable, DetailFlyout, EventDetailModal
  • ✅ D3 v7 force-directed filesystem graph — Obsidian-style node graph in DetailFlyout; zoom/drag/tooltip; selected path pulled to center
  • ✅ React 19 upgrade — index.js → index.jsx, Recharts 2.12.7 React 19 compatible, all hooks updated
  • ✅ Vite 5 migration — replaces CRA; fixes all 26 npm security alerts; npm run build → frontend/dist/
  • ✅ Node.js 22 in CI and Docker build
  • ✅ Attack simulations — sim_lockbit.py, sim_akira.py, sim_qilin.py + shared sim_common.py engine
  • ✅ LockBit 5.0 evaluation — tests/test_lockbit.py 4-metric (files<3, latency<500ms, FP=0%, coverage=100%) — ALL TARGETS MET
  • ✅ 3D cinematic landing page — deployed at https://mohhudib.github.io/hybrid-rsentry/
  • ✅ CORS fix — client.js uses relative paths for Vite proxy compatibility

v1.4.0 and earlier

  • ✅ Full detection pipeline (canary → entropy → extension detection → lineage → Markov → containment)
  • ✅ Tree-aware auto-containment (entire process tree, two-sweep enumeration, 48 files evidence)
  • ✅ dpkg hash verification in lineage scorer (416 K hashes, SHA-256 LRU cache)
  • ✅ Ransomware extension detection (.enc, .locked, .wcry, etc.)
  • ✅ Multi-provider AI fallback chain (Cerebras → NVIDIA/Groq key 1 → key 2)
  • ✅ Live WebSocket dashboard with 3 Redis channels
  • ✅ AI PENDING state + ai_analysis_update WebSocket message
  • ✅ AI results cached in Redis (24h) for forensic export
  • ✅ PDF forensic export with host-aware sections and SHA-256 integrity footer
  • ✅ Auto-containment pipeline (SIGSTOP → evidence → iptables → SIGKILL)
  • ✅ Auto-acknowledgment (containment complete + AI benign classification)
  • ✅ Markov chain adaptive canary repositioning with _is_safe_target() guard
  • ✅ Canary git corruption prevention (.gitignore, _validate_watch_path(), _is_safe_target())
  • ✅ Exception/whitelist system with smart /tmp filter
  • ✅ start.sh one-command startup + test_event.sh pipeline test
  • ✅ Full documentation (README, Wiki, CHANGELOG, CONTRIBUTING, CLAUDE.md)
  • ✅ Security audit completed (removed python-jose, parameterised DB credentials, hardened all entry points)

Clone this wiki locally