TS-PHOL Malware & Strategy Workbench

Local dev URL: http://localhost:3000 (run npm run dev)

PoC mode (malware-only UI/domain) is now default. To disable and re-enable legacy domains: VITE_MALWARE_POC_MODE=0 npm run dev.

What problem this solves

Automated Reasoning (AR) systems often face a tradeoff between expressiveness (how complex the rules can be) and tractability (how fast the system can reason). Standard Higher-Order Logics are often undecidable or exponential in complexity.

TS-PHOL (Tractable Stratified Probabilistic Higher-Order Logic) solves this by:

1. Enforcing PTIME Complexity: Using a restricted logical fragment that guarantees polynomial-time inference.
2. Neuro-Symbolic Composition: Seamlessly combining low-level Machine Learning (ML) probabilistic signals with high-level symbolic rules.
3. Machine-Checkable Proofs: Generating structured, low-burden logical explanations for every decision, ensuring human trust and auditability.

5-Minute Walkthrough

1. Configure Scenario: Go to the Scenario tab. In malware mode, adjust the endpoint count or edit endpoint parameters (defender telemetry, suspicious behavior intensity, responder capacity, telemetry gaps).
2. Inspect ML Signals: Switch to the ML Signals tab to see raw probability predictions from the neural layer.
3. Run Inference: Click the Run Inference button in the header. Watch the progress bar as the system moves from World State to Final Decision.
4. Inspect Proof: Go to the Proof tab. Select a decision to see its derivation tree. Hover over nodes to see which endpoints triggered specific rules.
5. What-If Analysis: In the Inference tab, adjust the p_attack threshold slider to see how containment recommendations change under different risk tolerances.

Glossary

• Stratum: A logical layer in the reasoning hierarchy. Higher strata depend on lower ones, preventing cycles and ensuring tractability.
• Grounded Fact: A concrete instance of a predicate where variables are replaced by actual entities (e.g., Vulnerable(Endpoint_1)).
• PTIME: Polynomial Time. A complexity class ensuring the system remains fast even as the problem space (number of endpoints/zones) grows.
• Range Restriction: A safety property ensuring every variable in a rule's head also appears in its body, preventing the creation of infinite new entities.

Maintainability

The project is split into:

• src/engine/tsphol.ts: Core inference and validation logic.
• src/hooks/useInference.ts: State management and inference orchestration.
• src/components/: Reusable UI components (Map, Decision Card, Onboarding).
• src/types.ts: Centralized type definitions.

Alignment to AR-ML Malware Deception Proposal

This workbench already contains the core architectural skeleton required by the proposal:

1. Observation layer (ML signals): per-host probabilistic telemetry can be represented by p_attack / p_success and additional host features.
2. Reasoning layer (AR + symbolic rules): stratified TS-PHOL rules convert low-level signals into high-level behavior hypotheses.
3. Decision layer (deception orchestration): Execute(...) rules map recognized behavior to runtime deception ploys with proof traces.

To make this alignment explicit, the project now includes a Malware Deception (AR-ML) domain preset with deception-oriented rules such as Execute(FakeReadResponse, z) and Execute(ProcessMirror, z).

Recommended Next Refactors

• Replace synthetic zone generation with API-call sequence ingestion (ETW/Sysmon/eBPF traces).
• Add a behavior ontology: FileDiscovery, CredentialAccess, LateralMovement, mapped to ATT&CK techniques.
• Extend validator checks to include contradiction constraints between simultaneous deception ploys.
• Add utility-based optimization to choose maximal-gain conflict-free deception bundles per host.
• Export machine-checkable proof artifacts for SOC and forensics workflows.

Malware-First Refactor (Implemented)

The workbench now includes malware-native pipeline components in addition to legacy zone simulation:

• Observation engine: API event ingestion and rolling-window feature extraction (src/engine/observation/apiSequenceObservation.ts).

• Behavior hypotheses: ATT&CK-like behavior abstraction (FileDiscovery, CredentialAccess, Collection).

• Playbook planner: utility-based, conflict-aware ploy selection (src/engine/planner/playbookPlanner.ts).

• Contradiction validator: detects mutual-exclusion and contradictory deception claims (src/engine/planner/deceptionValidator.ts).

• Hook integration: malware inference cycles track telemetry-driven orchestration (hosts, apiEvents, behaviorHypotheses, activePlaybook, inferenceCycles).

• Malware-native inference path: MalwareInferenceEngine reasons directly from hosts + behavior hypotheses without requiring zone-grounding.

• Telemetry adapters: observation supports adapter pattern (ReplayTelemetryAdapter) for progressive migration to ETW/Sysmon/eBPF sources.

• Malware benchmark harness: MalwareBenchmark measures event-volume runtime/fact/firing/depth characteristics for research reporting.

• Temporal conflict checks: runtime now validates selected ploys against previous cycle ploys to block unsafe rapid contradiction switches.

• Sysmon ingestion path: malware mode can now ingest offline Sysmon JSONL batches for host-state refresh in addition to synthetic replay streams.

• Richer behavior mapping: observation now infers LateralMovement and Exfiltration motifs from API patterns, not only discovery/credential collection.

• Improved temporal safety: deception-mode switches are now blocked with explicit cooldown windows across inference cycles.

• Artifact portability: latest inference cycle artifact can be exported as JSON for SOC/offline analysis.

• Telemetry quality gate: ingestion now validates/normalizes incoming events and tracks drop reasons for malformed telemetry.

• Policy-driven safety controls: malware mode exposes runtime orchestration policy controls (cooldown, per-host ploy cap, churn window).

• Policy profiles: malware UI supports conservative/balanced/aggressive presets for quick orchestration posture switching.

• Telemetry provenance summary: malware panel displays source mix and duplicate suppression metrics.

• Expanded benchmarking metrics: malware benchmark now reports p50/p95 latency and contradiction-rejection rate in addition to runtime/facts/firings/proof depth.

• Provenance signing: exported malware cycle artifacts now include a local WebCrypto ECDSA signature and hash chaining (previousIntegrity) for stronger attestation.

Status Against Malware Abstract

Implemented

• API-sequence style observation and host/process feature extraction.
• Behavior-to-deception orchestration with utility scoring.
• Conflict checking and rejection rationale surfaced in the runtime playbook.

Partially Implemented

• Malware mode is host-native in UI and inference, and PoC mode now defaults to malware-only domain lock for demo/research packaging (VITE_MALWARE_POC_MODE opt-out only for legacy compatibility).
• Telemetry ingestion supports replay/JSONL, HTTP NDJSON streams, and an ETW-native bridge adapter path for live collector integration.
• Card labels now avoid legacy abbreviations and use analyst-facing terms; malware cards use SOC-native metric shorthand: TC (Telemetry Confidence), MI (Malware Intensity), DS (Deception Surface), BC (Business Criticality), plus Threat/Contain bars.

Research-grade alignment gates (enforced)

• PoC mode MUST default to malware-only with explicit opt-out (VITE_MALWARE_POC_MODE=0) and locked domain selector in PoC mode.
• CI MUST execute ETW adapter contract tests (npm run test:malware:etw) alongside existing malware engine and pipeline tests.
• CI MUST enforce abstract compliance score floor (MALWARE_MIN_ABSTRACT_COMPLIANCE_SCORE=90).

Abstract-alignment acceptance criteria

• Malware card labels MUST never render legacy shorthand (A/E/S/V, Atk/Suc) and must use analyst-facing terms (TC/MI/DS/BC, Threat/Contain) in malware mode.
• CI MUST pass benchmark:malware:large-replay and benchmark:malware:scenario-families runtime and density thresholds.
• Orchestration policy MUST enforce cooldown, per-host ploy cap, action-churn, and mode-switch budgets in temporal validation.

Malware Evaluation Command

• Run npm run benchmark:malware to produce event-volume scaling records for malware-mode inference/planning and enforce p95/rejection budgets via env thresholds.

• Run npm run benchmark:malware:replay to evaluate pipeline behavior on the included Sysmon JSONL replay dataset (data/sample-sysmon.jsonl).

• Run npm run benchmark:malware:stress to execute a large synthetic replay stress run with runtime budget enforcement.

  • Tune stress realism with MALWARE_STRESS_HOST_COUNT, MALWARE_STRESS_PROCESS_COUNT, and MALWARE_STRESS_HOT_HOST_RATIO.

• Run npm run benchmark:malware:replay-suite to compare behavior across benign/mixed/malicious/noisy replay datasets.

• Run npm run benchmark:malware:large-replay to evaluate runtime + hypothesis density on a large synthetic replay corpus and enforce thresholds.

• Run npm run benchmark:malware:scenario-families to test low-and-slow exfiltration, credential bursts, admin-noise, and mixed-campaign synthetic families.

• Run npm run eval:malware:quality to compute planner-reject, action-stability, temporal-violation, and FP/FN rates (fails if thresholds are not met).

  • Supports strict env tuning, including MALWARE_MIN_STABILITY_SAMPLES, to avoid passing stability on undersampled hosts.

• Run npm run eval:malware:calibration to enforce deterministic replay calibration checks (hosts/hypotheses/execute facts) including noisy telemetry samples.

  • By default, this now also runs a synthetic broad-coverage calibration pass; tune with MALWARE_REQUIRE_SYNTHETIC_CALIBRATION, MALWARE_SYNTH_CALIBRATION_HOST_COUNT, and MALWARE_SYNTH_CALIBRATION_SEQUENCES.

• Run npm run test:malware to execute deterministic pipeline sanity checks for planning and temporal safety constraints.

• Run npm run test:malware:engines to unit-check observation motifs, planner output, inference execute-facts, and dataset JSONL validity.

• Run npm run test:malware:artifact to execute self-test verification of integrity, signature validation, and chain linkage for artifacts.

• Run npm run test:malware:artifact:cli to run end-to-end artifact verification through the CLI path with trust-level enforcement.

• Run npm run verify:malware:artifact -- <artifact.json> [previous-artifact.json] to validate integrity, signature, and chain linkage for exported cycle artifacts.

• Run npm run check:bundle:size after build to enforce frontend bundle-size budget locally (default MAX_BUNDLE_JS_BYTES=1000000).

• Run npm run check:abstract:alignment to verify abstract-alignment documentation and ensure card labels avoid legacy abbreviations.

• Run npm run report:abstract:compliance to generate a weighted compliance score report (0-100) against the abstract-alignment PoC checklist; it now subtracts penalty for known open gaps and fails if below MALWARE_MIN_ABSTRACT_COMPLIANCE_SCORE (default 90).