Continuousbehaviouralscoring
Watch the session, accumulate weighted evidence, decay it over time, and check each request synchronously.
Roughly thirty weighted heuristics run over everything the session does. They span reconnaissance and enumeration, credential access, exploitation, privilege escalation, persistence and pivoting, and each one carries a weight that says how much it contributes when it fires.
The score decays exponentially, on a 180-second half-life in the current configuration. This is deliberate. Risk is not a ratchet: a single transient anomaly should not carry a session into deception twenty minutes later, and a session that goes quiet should drift back down. Weights and the threshold T are configuration, not code.
Cumulative scoring misses one whole class of attack. A single SQL injection, a deserialisation payload, an SSRF, a path traversal. These can finish before any behaviour has accumulated at all. So request-level checks run synchronously alongside the score, and either path can reach the threshold.
- PTY stream
- HTTP request stream
- Process spawns
- Filesystem events
- Prior from L0
- Live risk score
- Fired heuristics with weights
- Threshold crossing
Rules this layer holds to
Each of these is written down because relaxing it would be locally convenient and globally wrong.
T is set conservatively high on purpose. A legitimate user who is silently converted keeps working against fabricated data without knowing it, which is a worse failure than a block they can see.