Skip to content

CHANGELOG.md

Latest commit

 

History

History
110 lines (89 loc) · 5.67 KB

CHANGELOG.md

File metadata and controls

110 lines (89 loc) · 5.67 KB
Raw

Changelog

All notable changes to Qute are documented here. Format follows Keep a Changelog.

[0.2.0] — 2026-04-21

Added

NVIDIA Ising QEC integration

  • IsingDecoder class in quantum/noise.py — 3D CNN pre-decoder for surface-code quantum error correction
  • decode_surface() — full Stim detector → PyMatching → corrected logical pipeline
  • Verified: D=7, p=0.003, N=20k → 28.6% LER improvement, 37.4× syndrome density reduction
  • Verified: D=7, p=0.005, N=100k → 26.6% LER improvement, 27.1× SDR
  • Ising QEC Benchmark section in Quantum tab with distance/variant/p/shots controls
  • NVIDIA Ising-Decoding source vendored at vendor/ising_decoding_code/ for portability
  • scripts/download_ising_models.py for model weight download

Feature vector redesign

  • Replaced network-centric 16-dim vector with syslog-aware threat-signal vector
  • New dimensions: IP privateness, process risk classification, message pattern keywords (fail/auth/exploit/scan), repeat source detection, temporal anomaly
  • Kernel/nmap/masscan added to network process set for port scan detection
  • sev_hi threshold lowered to 0.60 for firewall/scan processes
  • Verified: SSH brute force events score 14/16 non-zero dimensions

Demo dataset

  • 100 synthetic syslog events with verified ground truth labels (data/samples/)
  • 6 attack types: SSH brute force, privilege escalation, port scan, lateral movement, benign routine, benign auth
  • 45 anomalous / 55 benign, fixed seed=42 (reproducible), temporally coherent
  • 80 high-confidence / 20 medium-confidence labels

Quantum circuit improvements

  • 16→4 feature compression via weighted composite aggregation (severity, process, message, context)
  • Runtime GPU/CPU backend selection — no rebuild required
  • Variable seed in numpy simulation for genuine run-to-run variance
  • backend parameter threaded through run_vqc → QuantumRunner → BenchmarkComparator

Classical detection head

  • Replaced severity threshold with 16-dim weighted linear classifier
  • Threshold optimised: F1=0.989, Acc=99%, FPR=1.8% on demo dataset
  • Zero false negatives across all attack types

GPU support

  • GPU build stage in Dockerfile using nvidia/cuda:12.5.0-runtime-ubuntu22.04
  • docker-compose.yml GPU deployment block with NVIDIA Container Toolkit integration
  • Runtime backend toggle in Quantum tab UI (CPU optimal at 4 qubits, GPU ready for scaling)
  • Tested: RTX 2080 Ti, CUDA-Q 0.14.0

Syslog listener

  • Live TCP/UDP syslog listener on port 5514
  • Persistent state across container restarts via app_settings DuckDB table
  • restore_from_settings() auto-restores listener on startup
  • Schema migration v2 for app_settings table

UI — investigation flow

  • Investigation state concept tracking events, rules, benchmark results across tabs
  • Sidebar replaced with live investigation status panel
  • Context banners on each tab showing workflow position and cross-tab navigation
  • Rules tab: Pattern Analysis section with event clusters (by process, by source IP, uncovered high-severity)
  • Rules tab: event source reordered — High severity first (operational), Random last (exploratory)
  • Benchmark tab: Demo mode with one-click synthetic dataset benchmark
  • Benchmark tab: "Compare both" mode showing clean vs noisy quantum performance
  • Benchmark tab: corpus summary panel before running
  • Benchmark tab: noise mode selector (clean / noisy / compare both) with depolarising probability slider
  • Report tab: restructured as 4-section investigation summary (Telemetry / Rules / Benchmark / Export)
  • Settings tab: Ising decoder status with dependency checks

Benchmark improvements

  • multi_run_benchmark() with mean/std aggregation across N runs
  • Module-level IsingDecoder singleton — model loaded once per process
  • classical_predictions and quantum_predictions returned in report for per-attack-type breakdown
  • noise_enabled and backend runtime parameters on BenchmarkComparator and multi_run_benchmark

Fixed

  • IsingCNN state dict key mismatch (Sequential → nested IsingCNN.net module)
  • Three Ising decoder bugs: ReLU→GELU, wrong trainX source, missing pre_L logical frame correction
  • apply_depolarising_noise_numpy hardcoded seed removed (genuine variance now)
  • IsingDecoder.decode() clarified as no-op for VQC counts (CNN designed for surface code syndromes)
  • runner.py _get_feature_vector was truncating to N_QUBITS=4 before compression
  • comparator.py benchmark tab column bleed into Ingest tab (Rules tab column context fixed)
  • Syslog listener double-bind on Streamlit rerun (restore_from_settings idempotency guard)
  • rsyslog conflict with Python syslog listener (rsyslog removed from Dockerfile CMD)
  • ISING_MODEL_DIR now uses Path(__file__).resolve().parent for local/Docker portability

Changed

  • QUTE_QUANTUM_BACKEND default changed from cpu to nvidia in .env.example and docker-compose.yml
  • Requirements: added torch, pymatching, safetensors, stim, bcrypt
  • Dockerfile: added vendor/ COPY step to both CPU and GPU stages
  • Port 5514 exposed as both TCP and UDP in Dockerfile and docker-compose.yml

[0.1.0] — 2026-04-19

Added

  • Initial scaffold: DuckDB schema, ECS normaliser, syslog/CEF/JSON parsers
  • Classical LLM rule generation via Ollama → pySigma (KQL, SPL, Yara-L)
  • Quantum harness: VQC and QSVM circuits via CUDA-Q with numpy fallback
  • Benchmark comparator with accuracy/F1/FPR/latency/efficacy metrics
  • Streamlit UI: 6 tabs (Ingest, Rules, Quantum, Benchmark, Report, Settings)
  • Live syslog listener (TCP/UDP)
  • UI authentication (bcrypt password hashing)
  • OTel tracing integration
  • Docker deployment (CPU stage)
  • Apache 2.0 license