Risk Engine

Risk Engine

The displayed risk level is not produced solely by AI. A deterministic rule engine computes a level from observable signals first; the optional Ollama opinion can only escalate it, never lower it.

The rules

• executable launched from a temporary directory (/tmp, /var/tmp, /dev/shm);
• executable outside the standard system directories;
• executable marked (deleted) by the kernel (binary removed from disk after launch);
• empty command line while a real executable is present (kernel threads are never affected);
• process listening on all network interfaces (0.0.0.0);
• unusual volume of distinct external connections (more than 10);
• match against a blacklist pattern from --config (immediate "high");
• SHA256 fingerprint differing from the known reference (with --check-integrity);
• abnormally high CPU or RAM vs the process baseline (with --baseline, from 3 samples, z-score > 2).

Every triggered rule is traced by name — in the Security panel of the HTML, the report and the CSV — never an opaque score.

Combining with the AI opinion

If Ollama is available, its opinion is combined by escalation only: the final level is the higher of the two. Underestimating a risk is considered worse than overestimating it. A divergence between the two opinions is flagged explicitly (a "diverging opinions" badge), never hidden.

Risk levels: low, medium, high, unknown.

Whitelist / blacklist configuration

Pass a YAML or JSON file with --config (no pyyaml dependency — plain YAML lists are parsed natively):

whitelist:
  - "/usr/local/go/*"   # fnmatch patterns accepted
  - "code helper"        # otherwise, substring match (name, exe or cmdline)
  - "ollama"
blacklist:
  - "cryptominer"
  - "/tmp/unknown_*"

• A whitelist match neutralizes only the path signals (temporary directory / outside standard directories). Network, integrity and "deleted executable" signals always stay active — a whitelist must not blind the engine.
• A blacklist match forces the "high" level immediately, with an explicit named signal.
• Patterns are case-insensitive and matched against the process name, executable path and command line.

Honest scope

This rule engine is an educational and triage-assistance tool, not an antivirus or an EDR. It has no signature database, performs no behavioral analysis over time, and can miss a real threat just as it can flag a false positive (e.g. a legitimate dev tool launched from /tmp — that is exactly what the whitelist is for). Use it as a starting point for investigation, not as a final verdict.