IN PROGRESSSecurity Analyticsosa.rounakneema.in

OSA

Offline Security Auditor
GOOFFLINE-SECZERO-DEPS
// Problem

Security analytics in air-gapped environments is extremely difficult without heavy runtime dependencies like ELK or Splunk.

// Solution

Single-binary offline security auditor with built-in statistical detection engines (Z-Score & Markov Chains) — no runtime dependencies required.

// Overview

OSA (Offline Security Auditor) is an air-gapped security analytics engine compiled as a single Go binary. It performs log ingestion and statistical anomaly detection without any runtime dependencies, making it ideal for isolated secure zones. It supports real-time streaming and historical batch analysis. Detection engines include Z-Score analysis for statistical outliers and Markov Chain models for behavioral sequential deviations. It reduced false positives by 38% in tests compared to baseline methods.

// Breakdown
01
Core Innovation

Zero-dependency single binary architecture — runs anywhere Go compiles to (<200ms latency).

02
Detection Engines

Statistical anomaly detection using Z-Score, Probability Matrices, and Markov Chains.

03
Log Pipeline

Dual-mode log ingestion pipeline supporting historical backfill and real-time monitoring across 5 sources.

04
Target Use Case

High-security isolated air-gapped environments where cloud SIEMs are inaccessible.

// At a Glance
Binary Deps
0
Latency
<200ms
Detection
3 Engines
Deploy
Air-Gapped
// Tech Stack
GoZ-ScoreMarkov ChainsProbability MatricesLog Ingestion
bash
➜~./osa --analyze --mode offline --log /var/log/auth.log
[*] Loading log patterns...
[*] Initializing Markov chain transition matrix...
[!] ANOMALY Detected (Z-Score: 4.2): Auth Spike
└── Source: 192.168.1.105 (User: admin)
[+] Markov Chain: Deviation from standard transition matrix
[*] Report generated → analysis_report.json