v0.1.0

CTAL v0.1.0 release notes

Purpose

This is the initial research and demonstration release of the Cloud Threat Anomaly Lab
(CTAL): an open-source, explainable cloud-security anomaly detection lab built on synthetic
data. It exists to make detection methods inspectable and benchmarks reproducible.

CTAL is not a complete SIEM, is not production-ready, and has not been validated
on real enterprise environments. It uses no employer, client, or production data.

Major capabilities

• Provider-neutral synthetic cloud-security event schema and deterministic generator.
• Six labeled synthetic threat scenarios.
• Explainable rule-based detector with per-rule reasons.
• Robust statistical detector (median/MAD in log space) with always and risk-gated
  baseline update policies.
• Optional Isolation Forest detector with frozen holdout inference and empirical percentile
  calibration.
• Event-, incident-, and scenario-level evaluation.
• Detector benchmark, baseline-policy ablation, and four-method ML holdout benchmark.
• Local Streamlit investigation dashboard with demo and analyze modes.
• Reproducible, byte-stable committed demo artifacts and an artifact manifest.

Architecture summary

A layered pipeline: schema validation → identifier-independent chronological ordering →
label-free feature projection → detectors (rule, statistical, Isolation Forest) →
evaluation → reports → dashboard. Ground-truth labels are read only by the evaluation
package, only after detection. See architecture.md.

Quick start

python -m venv .venv
source .venv/bin/activate        # Windows: .venv\Scripts\activate
pip install -e ".[ml,ui]"

ctal --version
ctal detect --input datasets/demo.jsonl --out reports/demo-alerts.jsonl \
  --summary reports/demo-detection-summary.json --threshold 25
ctal benchmark --input datasets/demo.jsonl --out reports/demo-benchmark.json \
  --markdown reports/demo-benchmark.md --threshold 25
ctal dashboard --demo

Full command reference: reproducibility.md.

Detector comparison summary (committed synthetic demo, threshold 25)

These figures describe one synthetic evaluation dataset at one threshold. They do not
establish production performance, and no detector is universally best — the methods answer
different questions.

Rule-based detector

• 11 true-positive anomalous events
• 1 false-positive normal event
• 3 false-negative anomalous events
• 91.7% precision
• 78.6% event-level recall
• 100% incident-level recall
• 100% scenario-level recall

Statistical detector

• Identifies the volumetric bulk-download scenario.
• Does not detect semantic-only scenarios that fall outside its two numeric metrics (request
  velocity and transfer volume).

Baseline-policy ablation result

On the four-event bulk-download incident, per-event statistical scores were:

• always policy: 70, 70, 50, 50
• risk-gated policy: 70, 70, 70, 70

Aggregate threshold metrics were unchanged between the two policies. Under the always
policy the attacker's own escalating events contaminate the online baseline, so later events
score lower; the risk-gated policy withholds high-risk events from the baseline, and the
scores stop decaying. This is consistent with reduced baseline contamination on this
dataset; it does not establish production effectiveness.

Isolation Forest distribution-shift result

Trained on a separate normal-only baseline and frozen, then evaluated on the committed
synthetic dataset (threshold 25):

• 78.6% event-level recall
• 6.6% precision
• 50% incident-level recall
• 50% scenario-level recall
• 156 false positives under the committed cross-population synthetic holdout

Stated precisely:

Isolation Forest matched the rule-based detector's event-level recall on the committed
synthetic evaluation dataset, but it did not match rule-based incident-level or
scenario-level recall and produced substantially more false positives under the
cross-population synthetic holdout distribution shift.

Do not summarize this as "ML matched the rule detector overall." It did not.

Dashboard overview

A local Streamlit app with two modes: demo (packaged synthetic artifacts) and
analyze (upload your own synthetic JSONL). It presents overview metrics, a filterable
alert table, alert detail, an activity timeline, and the committed benchmark and
baseline-ablation visualizations. Uploads are validated and held in memory only. It is a
local analysis and demonstration tool — deliberately not a SIEM.

Privacy model

• No external network or AI-service calls during detection, evaluation, or the dashboard.
• All bundled data is synthetic.
• Dashboard uploads are held in memory only; nothing is persisted or transmitted.
• The browser never triggers model deserialization.

Model-artifact warning

Trained Isolation Forest models are pickle-compatible joblib artifacts. Loading a pickle
executes code chosen by whoever produced the file, so load only model artifacts from
trusted sources. CTAL never commits or packages binary model files, and the dashboard's
Isolation Forest mode requires a trusted server-local artifact supplied by the operator.

Reproducibility statement

Committed reports are byte-reproducible from the committed datasets, except for informational
processing_duration_ms timing fields. Committed datasets reproduce semantically but not
byte-for-byte, because the generator assigns random UUID identifiers. Line endings are LF, so
artifact hashes are identical across platforms. Verify with:

python scripts/artifact_manifest.py
python scripts/validate_release.py

See reproducibility.md and
release/v0.1.0-artifact-manifest.json.

Limitations

• Synthetic data only; no production validation.
• No live cloud ingestion, persistent storage, incident inference, or automatic response.
• Statistical cold start; two numeric metrics only.
• Online-baseline contamination/staleness tradeoff.
• Isolation Forest distribution-shift sensitivity.
• Contextual ML observations are analyst hints, not exact attribution.

Upgrade notes

This is the initial release (0.1.0). There is no prior version to upgrade from.