Capabilities and Workflows - Magnum-Insignia/nagahana GitHub Wiki

Capabilities & Operational Workflows

1. Live Threat Forecasting Workflow

During active operations, NagaHana ingests continuous streaming network updates:

  1. Event State Update: Incoming network records trigger an incremental state update in the CVG-AE and TSTCT modules.
  2. Periodic Forecaster Cadence: On designated time cadences or priority triggers, TAAFT initiates energy refinement over active entity tokens and adversary slots.
  3. Trajectory Generation: The Forecaster simulates distinct attack routes across forward time steps into the future.
  4. Actionable Outputs:
    • $P_{\text{inf}}(k)$ Hazard Curves: Non-decreasing curve displaying the probability of compromise over time.
    • Target Attribution & Lead Time: Identified compromised devices, anticipated next targets, and estimated lead time prior to objective execution.
    • D3FEND Advice: Actionable defensive measures ranked by net risk reduction and operational disruption cost.

2. Forensic Replay & Counterfactual Analysis

When investigating past incidents or analyzing recorded packet captures:

  1. Full Timeline Reconstruction: Replays network state progression step-by-step, pinpointing the initial intrusion vector (Patient Zero).
  2. Kill-Chain Narrative: Maps observed events directly to the MITRE ATT&CK framework with confidence intervals.
  3. Counterfactual Simulation: Analysts can test counterfactual scenarios (e.g., "If the affected workstation had been isolated at 14:20, would exfiltration have succeeded?"), providing evidence for incident debriefs and architectural hardening.

3. Early Warning Indicators & Critical Slowing Down

Leveraging statistical physics principles, NagaHana tracks early-warning signals that precede network transitions:

  • Thermodynamic Metrics: Free energy, ensemble entropy, and heat capacity calculated over network state distributions.
  • Critical Slowing Down: Measures rising variance, lag-1 autocorrelation, and spectral density anomalies that indicate an infrastructure approaching operational phase changes or coordinated disruption.