mirror of
https://github.com/ParrotXray/Mantis.git
synced 2026-08-24 19:00:27 +09:00
ParrotXray
46a69dd49c
* refactor: Rename project from NetGuardia to Mantis * fix: convert mantis-frontend from tracked files to submodule * wip * feat: Suricata integration stabilization and config unification Fix a series of bugs in the Suricata daemon integration and unify configuration so users interact only with config.toml. * docs: sur-001-c1 Suricata integration stabilization findings
75 lines
2.3 KiB
TOML
75 lines
2.3 KiB
TOML
# Mantis Research State
|
|
# Updated: 2026-05-21
|
|
|
|
[[epics]]
|
|
id = "nids-v1"
|
|
title = "Mantis NIDS v1 — Research Prototype"
|
|
status = "active"
|
|
description = """
|
|
End-to-end NIDS combining eBPF/AF_XDP packet capture, LSTM autoencoder ML inference,
|
|
Suricata daemon integration (49 000+ ET Open rules), and a Next.js monitoring frontend.
|
|
Target: demonstrate joint ML+Rule detection superiority over single-method baselines.
|
|
"""
|
|
|
|
[[themes]]
|
|
id = "backend-detection"
|
|
epic = "nids-v1"
|
|
status = "active"
|
|
description = """
|
|
ML pipeline, Suricata daemon mode, fusion layer, and alert broadcast.
|
|
Rule engine (vectorscan) fully replaced by Suricata 8 daemon + veth mirror.
|
|
Fusion engine correlates ML anomaly scores with Suricata EVE JSON alerts.
|
|
Next: TLS/JA3 analysis, XDP auto-block active response.
|
|
"""
|
|
|
|
[[themes]]
|
|
id = "backend-infra"
|
|
epic = "nids-v1"
|
|
status = "active"
|
|
description = """
|
|
GeoIP, logging, eBPF statistics, HTTP API, WebSocket delivery.
|
|
Fixed: GeoIP thread explosion (semaphore), maxminddb debug flood.
|
|
Pending: account system (SQLite app.db), full REST API with auth.
|
|
"""
|
|
|
|
[[themes]]
|
|
id = "frontend"
|
|
epic = "nids-v1"
|
|
status = "active"
|
|
description = """
|
|
Next.js dashboard, detection page, WebSocket provider, config alignment.
|
|
Aligned with UnifiedAlert API (source/severity as lowercase strings).
|
|
Open: dashboard counters never reset (accumulate forever).
|
|
"""
|
|
|
|
[[themes]]
|
|
id = "tls-analysis"
|
|
epic = "nids-v1"
|
|
status = "planned"
|
|
description = """
|
|
Encrypted traffic analysis without decryption.
|
|
Suricata EVE tls events -> JA3 hash whitelist + cert anomaly rules + beacon detection.
|
|
No ML model required initially; extend with classifier if FP rate is too high.
|
|
Addresses the blind spot where Suricata rules cannot inspect TLS payload.
|
|
"""
|
|
|
|
[[themes]]
|
|
id = "active-response"
|
|
epic = "nids-v1"
|
|
status = "planned"
|
|
description = """
|
|
XDP-layer automatic IP blocking triggered by high-confidence FusionEngine alerts.
|
|
BPF_MAP_TYPE_LRU_HASH in ingress XDP program; userspace inserts src_ip on alert.
|
|
TTL-based expiry via background tokio task.
|
|
Demonstrates sub-microsecond response latency (key academic differentiator).
|
|
"""
|
|
|
|
[[themes]]
|
|
id = "account-system"
|
|
epic = "nids-v1"
|
|
status = "parked"
|
|
description = """
|
|
SQLite-backed accounts, sessions, persistent whitelist/blacklist.
|
|
Deprioritised; not required for research evaluation.
|
|
"""
|