Project: CyberMoranda CIDS
Full Form: Cognitive Intrusion Detection System
Current Stage: MVP → Evaluation & Generalization
Development Environment: Android + Termux + Rust
- CIDS ka main idea
CIDS ka basic idea simple hai:
«Attacker ko ek single request se judge nahi karna, balki uske behavior aur sequence ko samajhna.»
Example:
Normal Request
↓
Reconnaissance
↓
Admin probing
↓
Payload testing
↓
Attack chain
↓
Risk increases
↓
Response becomes stronger
Isliye CIDS ka focus sirf "bad request block karo" nahi hai.
CIDS ka goal hai:
Think Before You Act.
- Core pipeline — Complete
Current architecture:
HTTP Request
↓
Event Normalizer [✓]
↓
SecurityEvent [✓]
↓
Session Context [✓]
↓
Behavior Correlation [✓]
↓
Security Signals [✓]
↓
Risk Engine [✓]
↓
Risk Confidence [✓]
↓
Risk Decay [✓]
↓
Policy Engine [✓]
↓
Adaptive Enforcement [✓]
↓
Cognitive Delay / Sticky Trap [✓]
↓
Containment / Deception [✓]
- Ab tak kya-kya build ho chuka hai
Detection & Intelligence
- Standardized Security Event model
- Event normalization
- Telemetry pipeline
- Session tracking
- Behavioral correlation
- Security signals
- Explainable risk verdict
- Risk scoring
- Risk confidence
- Temporal risk decay
Response
CIDS ab situation ke according response change kar sakta hai:
Observe
↓
Tarpit
↓
Contain
↓
Deception
Iske saath:
- Cognitive delay
- Sticky Trap
- Containment
- Deception
- Time-wasting
- Rehabilitation after risk decay
bhi implemented hain.
- Behavioral intelligence
CIDS isolated events ke bajay sequences ko analyze karta hai.
Examples:
robots.txt → admin
Recon → Admin transition detect ho sakta hai.
Multiple different JA4 fingerprints
Fingerprint rotation anomaly detect ho sakti hai.
Browser User-Agent
+
Scanner-like JA4
Possible fingerprint spoofing detect ho sakti hai.
Compound behavior bhi analyze hota hai, jaise:
Recon
+
Admin probing
+
Payload fuzzing
Isse overall risk increase ho sakta hai.
- JA4 TLS fingerprinting
CIDS mein JA4 fingerprint inspection ka prototype bhi add ho chuka hai.
Currently CIDS:
- suspicious/scanner-like JA4 identify karta hai
- Browser UA + suspicious JA4 mismatch detect karta hai
- Session ke andar JA4 rotation detect karta hai
- Fingerprint anomalies ko behavioral signals ke saath correlate karta hai
Important:
JA4 ko standalone proof nahi maana gaya hai.
Ye behavioral context ka ek signal hai.
- Deterministic Replay Framework
Ek important testing system bhi ban chuka hai.
Ab attack scenarios ko manually repeat karne ki zarurat nahi.
Replay framework mein:
- predefined events
- timestamps
- expected decision
- expected verdict
- isolated sessions
- virtual/deterministic timing
- assertion checking
available hain.
Isse hum reproduce kar sakte hain:
Same input
↓
Same timeline
↓
Same CIDS behavior
Ye debugging aur regression testing ke liye important hai.
- FP/FN Evaluation System
CIDS ke liye proper evaluation framework bhi ban gaya hai.
Metrics:
- True Positive
- True Negative
- False Positive
- False Negative
- Precision
- Recall
- F1
- False Positive Rate
- False Negative Rate
- Response Alignment
- Exact Decision Matching
Evaluation do levels par hota hai:
Step Level
+
Scenario Level
- Frozen baseline
Ek baseline dataset create kiya gaya:
10 scenarios / 20 steps
Isme benign, suspicious aur hostile behavior included hai.
Initial baseline performance:
Precision: 71.43%
Recall: 71.43%
F1: 71.43%
FPR: 15.38%
FNR: 28.57%
Iteration-1 tuning ke baad:
Steps: 20/20 exact
TP: 7
TN: 13
FP: 0
FN: 0
Precision: 100%
Recall: 100%
F1: 100%
FPR: 0%
FNR: 0%
Scenario level par bhi:
10/10 exact
FP: 0
FN: 0
Lekin ek important lesson:
100% baseline score ka matlab real-world 100% accuracy nahi hai.
Kyuki tuning baseline scenarios ke around hui thi.
Isi wajah se holdout testing ki gayi.
- Holdout testing — Reality check
Holdout mein 6 naye scenarios aur 16 steps the.
Result:
Precision: 50%
Recall: 33.33%
F1: 40%
FPR: 7.69%
FNR: 66.67%
Pehle ye disappointing lag sakta hai.
Lekin actually ye useful result tha.
Holdout ne prove kiya ki baseline par perfect score ke bawajood model mein generalization gaps hain.
- Holdout se mile 3 main problems
Problem 1 — Legitimate admin workflow
Realistic flow:
/
↓
/login
↓
/admin
↓
/admin
CIDS second "/admin" ko suspicious samajh raha hai.
Current reason:
"is_clean_second_admin_refresh" bahut strict hai aur sirf very specific history ko clean refresh maanta hai.
Problem 2 — Unknown sensitive path
Holdout:
/.aws/credentials
CIDS ne miss kar diya.
Current sensitive path detection mein limited hardcoded paths hain:
/.env
/.git
/config
/backup
/wp-admin
Isliye unseen sensitive paths ka detection weak hai.
Problem 3 — SQL Injection variant
Holdout payload:
username=admin'--&password=foo
Current SQLi detection mainly in patterns ko check karta hai:
' or
1=1
union
Isliye ye SQLi variant miss ho gaya.
- Ek important problem jo actually problem nahi nikli
Humein doubt tha ki fast legitimate browsing:
/home
/docs
/pricing
/contact
/blog
ko CIDS attack samajh sakta hai.
Holdout mein ye scenario pass hua.
Isliye is logic ko unnecessary modify nahi karna hai.
- Current Iteration-2 status
Iteration 1:
Baseline
↓
Tuning
↓
100% frozen-baseline result
↓
Git commit
Complete.
Current Iteration 2:
Holdout failures
↓
Root causes identified
↓
SQLi variant identified ← NEXT
↓
Admin workflow fix
↓
Sensitive-path generalization
↓
Regression testing
↓
Holdout retest
SQLi payload already identified hai:
username=admin'--&password=foo
Uske liye surgical detector improvement ready hai, lekin abhi code change apply nahi kiya gaya hai.
- Git checkpoint
Iteration-1 tuning ka commit:
6b7c29
feat(eval): add FP/FN evaluation harness,
baseline corpus, and iteration-1 risk tuning
Current approach:
Frozen baseline
↓
Iteration-2 changes
↓
cargo test
↓
Baseline regression
↓
Holdout evaluation
↓
Review
↓
New commit
Purane working baseline ko directly modify nahi karna.
- Current mindset
CIDS ab sirf features add karne ka project nahi raha.
Ab real engineering phase hai:
«"Kya CIDS unseen behavior ko bhi correctly understand kar sakta hai?"»
Is stage par:
False Positive ko kam karna bhi important hai.
Aur:
False Negative ko kam karna bhi.
Sirf detection badha dena enough nahi hai, kyunki overly aggressive detection legitimate users ko bhi block kar sakti hai.
Goal hai:
Better Detection
+
Lower False Positives
+
Correct Response Level
+
Explainability
- Abhi exactly kahan khade hain
CIDS MVP [✓]
Core Detection [✓]
Session Intelligence [✓]
Behavior Correlation [✓]
Risk Engine [✓]
Confidence [✓]
Risk Decay [✓]
Policy Engine [✓]
Adaptive Enforcement [✓]
Sticky Trap [✓]
Deception [✓]
Replay Framework [✓]
JA4 Prototype [✓]
Evaluation Harness [✓]
Frozen Baseline [✓]
Holdout Benchmark [✓]
Iteration-2 Generalization 🔄
Next technical task
SQLi variant detection improve karna.
Uske baad:
legitimate multi-step admin workflow
phir:
generalized sensitive-path detection.
Har change ke baad:
cargo test
↓
Baseline regression
↓
Holdout
↓
Only then commit
One-line project status
«CyberMoranda CIDS ka core MVP aur adaptive defense architecture complete hai; ab project feature-building se nikal kar evidence-based detection tuning aur generalization phase mein hai.»
Top comments (0)