credkellar/brutal-force-re repository overview

⁠Brutal-Force-RE

A defensive brute-force reverse-engineering lab. It studies how password-guessing attacks work — with synthetic traces only, in a chamber that executes nothing — so defenders can spot the patterns and shut them down. Lab use only.

⁠Architecture

One CLI (main.py), one package (brutalforce_re/), zero dependencies — pure Python standard library. A trace flows through the pipeline in order:

1. Intake — a synthetic attack trace (IP, user, password, timestamp, user-agent) is loaded.
2. Gate check (gates.py) — the requested action must be defensive analysis; every live-attack action is HOLD.
3. Chamber telemetry (sandbox.py, the sandbox-api port) — records the trace without executing anything: FS diff none, network 0.
4. Honeypot classification (honeypot.py, the honeyroot-x port) — aggregates by IP/user/password and labels the pattern: spraying / hammering / stuffing / dictionary.
5. ML labelling (mlx.py) — a from-scratch Markov estimator + kNN classifier gives a second, independent label. No ML libraries.
6. Tactic matching (tactics.py) — matched IDs from the 44-tactic taxonomy (guessing, execution, target, evasion), each with detection signals and a mitigation.
7. Keyspace math (keyspace.py) — search space, entropy bits, expected time-to-exhaust, birthday bound.
8. Routing record (runtime.py) — SLM-first routing with escalation on low confidence; CPU/GPU real-sim, TPU/NPU/LPU/DPU plainly stubbed.
9. Archive (compressor.py) — CDC chunking + SHA-256 dedup + zlib for trace archives, roundtrip-verified; the AWS KMS layer is a local stub labelled SIM.
10. Carbon 4 DECIDE (carbon4.py) — Gemini Carbon 4 Extended Thinking runs MAP → MODEL → STRESS → DECIDE; it can only tighten a decision, never loosen one.
11. Video plan (flowvideo.py) — Google Flow turns the verdict into a 4-track explainer plan. Plan only — live generation is HOLD.
12. Metrics + verdict (metrics.py) — counters, risk distribution and classifications out as JSON / Prometheus; chamber_executed stays 0.

⁠The brains

• Gemini Carbon 4 Extended Thinking — the DECIDER (above).
• Muse (Meta Model API, MODEL_API_KEY, names-only) — advisor only. It can never override a HOLD gate.

⁠HOLD gates

Six named gates permanently refuse live actions: attacking a real target, running a live credential attack, executing chamber samples, generating live video, spending real funds, and removing a HOLD. Neither brain can override them.

⁠Run it

docker pull credkellar/brutal-force-re
docker run --rm credkellar/brutal-force-re

The container entry runs the demo + self-checks: CHECKS 49/49. Other commands: tactics, keyspace, analyze, metrics, serve (visual test UI on 127.0.0.1:8765).

⁠Links

• GitHub: https://github.com/credkellar/Brutal-Force-RE⁠