Skip to content

v0.4.0

Choose a tag to compare

View all tags
@lifeqsoll lifeqsoll released this 25 Sep 15:28
· 15 commits to main since this release
v0.4.0
a780e74

SysSpectogram v0.4.0

Linux hybrid host IDS: CNN + Isolation Forest, perimeter/Telegram SOAR-lite, live web / Mini App, and a Rust integrity agent.

What's new

  • Fuse risk — host ML + agent IF (ensemble.host_weight / agent_weight)
  • Profile packs — shareable tar.gz baselines (profiles pack / pull / install)
  • Load budgets — lite (small VPS) / full (large VDS); env SYSSPECTOGRAM_LOAD_PROFILE
  • FIM — optional sha256 path watches (full)
  • Flow lite — /proc/net/tcp heuristic (full)
  • Console unlock — TG /unlock + Mini App gate (stolen .env alone cannot kill/ban)
  • eBPF — optional execve / openat via clang BPF + Aya loader (attach needs root; on Arch setcap alone is not enough)

Assets

File Purpose
profile-generic-linux-v1.tar.gz Baseline host + agent-IF pack
profile-generic-linux-v1.tar.gz.sha256 Integrity check (required by profiles pull/install) 
python -m sysspectogram profiles pull \
  --url https://github.com/lifeqsoll/SysSpectogram/releases/download/v0.4.0/profile-generic-linux-v1.tar.gz \
  --out /tmp/p.tar.gz \
  --sha256 a8402315fec15ed9dd602f78dcbb8b59c680768d7f904e46175dd22d3abb20b4

python -m sysspectogram profiles install /tmp/p.tar.gz \
  --dest artifacts/profiles/generic-linux \
  --sha256 a8402315fec15ed9dd602f78dcbb8b59c680768d7f904e46175dd22d3abb20b4

Quick start

pip install -e ".[dev]"
cd agent && cargo build --release && cd ..
python -m sysspectogram guard --model artifacts/real_v3 --telegram --dry-run
# eBPF agent:
# sudo -E ./agent/target/release/sysspectogram-agent --mode ebpf --socket "$XDG_RUNTIME_DIR/sysspectogram-agent.sock"

Docs

Assets 4
Loading