Omniculus — Roadmap

Phased plan. Each phase is independently useful and builds on the last.

Phase 0 — Foundation ✅ (done)

  • Project scaffold, synthetic data generator, NetworkX graph core.
  • Four explainable detections (brute force, lateral movement, known-bad contact, connection anomaly).
  • Human-in-the-loop decision support + audit log.
  • Feedback loop that retunes thresholds from dispositions.
  • End-to-end demo + passing test suite.

Phase 1 — Detection quality (next)

Driven by what the Phase 0 demo exposed: - Alert correlation & dedup. Collapse repeated known_bad_contact events for the same (host, indicator) into one investigation. Sits between detect and investigate. - Behavioral baselines. Replace global thresholds (e.g. lateral-movement host count) with per-entity normal profiles. Directly fixes the false-positive rate seen in the demo. - Evaluation harness. Precision / recall / time-to-detect computed against the synthetic ground-truth labels; a regression gate for detection changes.

Phase 2 — Graph analytics

  • Attack-path discovery — shortest/likely paths from an entry point to crown jewels across the fusion graph.
  • Centrality & community detection — find pivot hosts and lateral clusters.
  • Temporal graph — model how the attack graph evolves over a time window.

Phase 3 — ML & game theory

  • ML anomaly models — isolation forest / autoencoder over behavioral baselines, complementing (not replacing) explainable rules.
  • Game-theoretic monitoring allocator — Stackelberg / SUQR model to allocate limited analyst attention against an adaptive adversary. See GAME_THEORY.md.
  • Adversarial curriculum — a learning attacker finds detection gaps in the lab; coverage adapts; measure improvement per round.

Phase 4 — Realistic data & validation

  • Public dataset replay — CICIDS, UNSW-NB15, DARPA OpTC for ground-truthed benchmarking.
  • Adversary emulation — Atomic Red Team / CALDERA against an isolated lab range to generate ATT&CK-mapped activity.
  • Purple-team loop — human red team findings folded back into detections.

Phase 5 — Scale & interface

  • Neo4j backend option for production-scale graphs (behind existing query helpers).
  • Investigation UI — timeline + graph pivoting for analysts.
  • Streaming ingestion — move from batch to incremental graph updates.

Phase 6 — Productization (omniculus.com)

  • Public site explaining the platform and its responsible-by-design stance.
  • Docs site, quickstart, and a sandboxed demo running on synthetic data only.
  • Decide license / open-source posture (see IDEAS.md).

Non-goals (kept off the roadmap on purpose)

  • Autonomous response/actuation without a human.
  • Ingestion of data the operator is not authorized to analyze.
  • Any deployment against production infrastructure not owned by the operator.