Continuousbehaviouralscoring

Roughly thirty weighted heuristics run over everything the session does. They span reconnaissance and enumeration, credential access, exploitation, privilege escalation, persistence and pivoting, and each one carries a weight that says how much it contributes when it fires.

The score decays exponentially: the site's model uses a 180-second half-life, the gateway defaults to 120 seconds with T at 80. This is deliberate. Risk is not a ratchet: a single transient anomaly should not carry a session into deception twenty minutes later, and a session that goes quiet should drift back down. Weights and the threshold T are configuration, not code.

Cumulative scoring misses one whole class of attack. A single SQL injection, a deserialisation payload, an SSRF, a path traversal. These can finish before any behaviour has accumulated at all. So request-level checks run synchronously alongside the score, and either path can reach the threshold.

In this build there are six heuristics, not thirty. System reconnaissance (uname, ps, ip, netstat, ls) weighs 8, and asking who you are and who else is here (whoami, id, groups, w, last, getent) weighs 12. Privilege is weighed by what it is for: checking what sudo allows or hunting for setuid programs 15, running one command as root 20, becoming root (sudo -i, sudo su, su, a setuid bit) 30. Files are weighed by what they give away, whichever program reads them: system identity such as /etc/hostname 5, accounts and history such as /etc/passwd 15, credentials such as /etc/shadow, SSH private keys and cloud credentials 35, each file counting on its own. One request-level check covers path traversal and sensitive paths, and benign activity carries a negative weight. Every command the session enters adds its full weight, repeats included, so the score is the sum of what it ran, less decay; the same command seen again by the process observer doesn't count twice. SQL injection, deserialisation and SSRF checks are designed, not built. Process and filesystem activity is sampled from outside the container every one and two seconds, so a process that lives under a second can be missed.