mostlylucid.botdetection 7.5.5

• net10.0

  • AngleSharp (>= 1.4.0)
  • HNSW (>= 26.4.177)
  • MathNet.Numerics (>= 5.0.0)
  • MessagePack (>= 3.1.7)
  • Microsoft.Data.Sqlite (>= 10.0.8)
  • Microsoft.Recognizers.Text (>= 1.8.13)
  • Microsoft.Recognizers.Text.DateTime (>= 1.8.13)
  • Microsoft.Recognizers.Text.Sequence (>= 1.8.13)
  • Mostlylucid.Common (>= 0.0.0-alpha.0.1714)
  • Mostlylucid.Ephemeral (>= 2.6.3)
  • Mostlylucid.Ephemeral.Atoms.Batching (>= 2.6.3)
  • Mostlylucid.Ephemeral.Atoms.KeyedSequential (>= 2.6.3)
  • Mostlylucid.Ephemeral.Atoms.SlidingCache (>= 2.6.3)
  • Mostlylucid.Ephemeral.Atoms.Taxonomy (>= 2.6.3)
  • Mostlylucid.StyloFlow.Core (>= 2.6.1)
  • Mostlylucid.StyloFlow.Retrieval.Core (>= 2.6.1)
  • NSec.Cryptography (>= 25.4.0)
  • SQLitePCLRaw.bundle_e_sqlite3 (>= 3.0.3)
  • System.IO.Hashing (>= 10.0.8)
  • System.Numerics.Tensors (>= 10.0.8)
  • VYaml (>= 1.3.0)

6.5.0

Remote-mode dashboard + new binaries:

- stylobot-ui (Stylobot.Ui): dashboard host that reads everything from a remote
 stylobot gateway's /api/v1/* over HTTP. Designed to be hosted inside a network
 as a viewer with local-only access. Configurable via StyloBot:Source:Pull:Type
 (rest|local) and StyloBot:Source:Live:Type (signalr|none).

- stylobot-all (Stylobot.All): YARP gateway + detection + dashboard in one
 process. One container, simplest deployment.

- stylobot (Console gateway) --enable-api flag: opts into the /api/v1/* REST
 surface + SignalR invalidation hub at /api/v1/hub. Off by default to preserve
 the small-surface posture. Fails fast at startup if no StyloBot:ApiKeys are
 configured.

- 10 new /api/v1/* endpoints: clusters, labels, approvals, endpoint-pins,
 sessions, useragents/search, investigate (+ shape-search + presets), bdf
 export, config manifests, fingerprints (+ unabsorbed counts).

- IConfigEditorService, IFingerprintReader, IBotClusterReader interfaces
 extracted from concrete classes so remote HTTP-backed adapters can substitute.

- SignalR live-feed relay: stylobot-ui opens a HubConnection to the gateway's
 /api/v1/hub and forwards invalidation beacons into the local hub so browsers
 refresh on detection events end-to-end.

- CLI: -d / --daemon shorthand for the start subcommand;
 --output-config <file> dumps the effective BotDetectionOptions to disk in
 appsettings.json shape for editing.

- Naming: ResolveDisplayName falls through to FingerprintNameComposer so
 humans always get a derived display name ("Chrome on Windows (US:abcd)")
 even when the metastable identity layer is off.

- AOT: sidecar publishes at 37MB (down from 131MB self-contained-single-file)
 after the VYaml + TypedResults + RequestDelegateGenerator work; Console
 gateway with --enable-api publishes at 59MB AOT.

See CHANGELOG.md for the full 6.5.0 entry.

---

3.5.0

UI Components, Dashboard Enhancements & Hardening:

New Sb* Tag Helpers (Mostlylucid.BotDetection.UI):
- <sb-badge>: Inline bot/human badge with risk colouring
- <sb-confidence>: Confidence score bar or text display
- <sb-gate>: Conditional rendering based on bot detection result
- <sb-honeypot>: Honeypot form field insertion
- <sb-human>: Show content only for verified humans
- <sb-risk>: Risk level display
- <sb-risk-pill>: Compact risk pill/badge
- <sb-signal>: Individual signal display
- <sb-summary>: Full detection summary (inline or card variant)

New View Components:
- SbBadgeViewComponent, SbConfidenceViewComponent, SbSummaryViewComponent
- Card and Default views for SbSummary
- Standalone CSS: sb-components.css

SignatureOnlyPaths:
- New BotDetectionOptions.SignatureOnlyPaths property
- Paths compute visitor HMAC signature without running the 27-detector pipeline
- Dashboard automatically registers its BasePath as signature-only
- Enables "Your Detection" panel to look up cached results from real page visits

Dashboard Improvements:
- Embed mode: pass ?embed=1 to hide the brand header (for iframe embedding)
- /api/me sentinel endpoint: returns current visitor's cached detection
- Client-side retry: fetchMeWithRetry polls api/me when initial data is null
- General API rate limiting (60 req/min per IP) on all dashboard endpoints
- Authorization failure logging

Security & Hardening:
- SignalR hub auth: OnConnectedAsync enforces same auth as dashboard middleware
- Dashboard auth warning: logs when no AuthorizationFilter/RequireAuthorizationPolicy configured
- SafeJson: all @Html.Raw() JSON blocks escape </ to prevent script-tag breakout (XSS defence-in-depth)
- Removed Html.Raw for emoji rendering in ViewComponents (defence-in-depth)
- Thread-safe mutation of SignatureOnlyPaths via lock
- Rate limiting expanded from diagnostics-only to all API endpoints (60 req/min per IP)
- Rate limiter cleanup threshold lowered from 1000 to 500 entries
- Rate limiter hard cap (10,000 entries) prevents memory exhaustion under distributed attacks
- User-Agent sanitization: email addresses stripped from UA strings before SignalR broadcast

Demo Application:
- ComponentsController with Gating, Honeypot, and Index views
- ComponentDemo Razor Page for interactive component testing
- New _Layout, _ViewImports, _ViewStart for Demo views

Documentation:
- New ui-components.md: full reference for all 11 Sb* tag helpers with usage examples
- Path Configuration section in configuration.md (ExcludedPaths, SignatureOnlyPaths, PathOverrides)
- Dashboard API: /api/me endpoint, embed mode (?embed=1), rate limiting details
- Security: SignalR hub auth, dashboard auth warning, SafeJson escaping

---

1.2.0

Enhanced Detection Pipeline & Security Layer:

Security Detection:
- SecurityToolContributor: Detects penetration testing tools (SQLMap, Nikto, Nmap, Burp Suite, etc.)
- ProjectHoneypotContributor: HTTP:BL IP reputation lookups via DNS with test mode simulation
- Pattern fetching from digininja/scanner_user_agents and OWASP CoreRuleSet
- Honeypot test mode: Use <test-honeypot:harvester|spammer|suspicious> markers for testing

AI Detection Improvements:
- HeuristicLateContributor: Post-AI refinement layer that runs after LLM for final classification
- Improved LLM prompt for better accuracy with smaller models
- Fixed localhost IP detection - no longer incorrectly flagged as datacenter IP
- Default LLM model upgraded to gemma3:4b for better reasoning

Demo Enhancements:
- Interactive bot simulator with 20+ preconfigured bot types
- Custom User-Agent input field for testing arbitrary UA strings
- UA Only policy for fast User-Agent-only detection testing
- Honeypot simulator buttons for testing Project Honeypot integration
- Security scanner buttons (Nikto, Nessus, Nmap, Burp Suite, Acunetix)

Production Security Defaults:
- ResponseHeaders.Enabled defaults to false (never leak detection details)
- EnableTestMode defaults to false
- Detection results flow downstream only via HttpContext.Items

New Documentation:
- security-tools-detection.md - Comprehensive security tool detection guide
- project-honeypot.md - HTTP:BL integration and testing guide
- Updated ai-detection.md with HeuristicLate contributor details

Integration Tests:
- Production security defaults verification
- Honeypot test mode simulation tests
- Contributor registration tests

New SignalKeys:
- SecurityToolDetected, SecurityToolName, SecurityToolCategory
- HoneypotChecked, HoneypotListed, HoneypotThreatScore, HoneypotVisitorType
- HoneypotTestMode (for test mode simulation)

---

1.0.0

🎉 First Stable Release!

Bot detection middleware for ASP.NET Core with multi-signal detection,
AI-powered classification with continuous learning, and full observability.

Key Features:
- Multi-signal detection: User-Agent, headers, IP ranges, behavioral analysis, client-side fingerprinting
- AI-powered classification: Heuristic model (<1ms) with optional LLM escalation
- Continuous learning: Heuristic weights adapt over time based on detection feedback
- Composable policies: Separate detection (WHAT) from action (HOW)
- Stealth responses: Throttle, challenge, or honeypot bots without revealing detection
- Auto-updated threat intel: isbot patterns and cloud IP ranges
- Full observability: OpenTelemetry traces and metrics

Breaking Changes from Preview:
- Default LLM model changed from gemma3:1b to gemma3:4b (better reasoning)
- Default LLM timeout increased from 2000ms to 5000ms
- ONNX provider removed in favor of Heuristic provider (faster, no external dependencies)

Migration Guide:
- Replace "Provider": "Onnx" with "Provider": "Heuristic" in config
- Update Ollama model if using LLM escalation: gemma3:4b recommended

---

0.5.0-preview2

Composable Action Policy System:
- Named action policies separate from detection policies
- Built-in: block, throttle, challenge, redirect, logonly
- BlockActionPolicy: Configurable status codes, messages, headers
- ThrottleActionPolicy: Jitter, risk-scaling, exponential backoff, stealth mode
- ChallengeActionPolicy: CAPTCHA, JavaScript, proof-of-work challenges
- RedirectActionPolicy: Honeypot, tarpit, error page with templates
- LogOnlyActionPolicy: Shadow mode, debug headers, metrics
- IActionPolicyFactory for configuration-based creation
- IActionPolicyRegistry for runtime policy lookup
- Custom action policies via IActionPolicy interface
- [BotAction("policy-name")] attribute for endpoint overrides
- ActionPolicyName property on detection policies and transitions

---

0.5.0-preview1

Policy-Based Detection:
- Named policies with configurable detectors per endpoint
- Path-based resolution with glob patterns (/api/*, /admin/**)
- Built-in: default, strict, relaxed, allowVerifiedBots
- Transitions based on risk thresholds and signals
- Per-policy weight overrides
- Actions: Allow, Block, Challenge, Throttle, EscalateToAi

Management Endpoints & Attributes:
- MapBotPolicyEndpoints() for CRUD and testing
- [BotPolicy("strict")] attribute for controllers/actions
- [BotDetector("UserAgent,Header")] for inline ad-hoc detection
- [SkipBotDetection] to bypass detection
- Policy simulation endpoint for testing transitions

Response Headers & TagHelpers:
- Configurable response headers (X-Bot-Risk-Score, X-Bot-Policy)
- <bot-detection-result /> TagHelper for client-side JS integration
- Full JSON result via Base64-encoded header option

Throttling with Jitter:
- Configurable base delay, max delay, jitter percent
- ScaleByRisk option for risk-proportional delays
- DelayResponse to slow bots at TCP level
- Custom throttle messages and challenge types

Blackboard Architecture:
- Event-driven detection with evidence aggregation
- Wave-based parallel execution
- Trigger conditions (WhenSignalExists, WhenRiskExceeds)
- Circuit breakers per detector
- Early exit for high-confidence detections

Pattern Reputation System:
- BotScore, Support, State tracking with time decay
- Online EMA updates, state machine (Neutral → Suspect → ConfirmedBad)
- Manual overrides never auto-downgrade
- Drift detection for bot/human ratio changes

Fast/Slow Path:
- Fast path: sync detectors (<100ms)
- Slow path: async AI/learning via LearningEventBus

New Interfaces:
- IContributingDetector, ILearningEventHandler, IPatternReputationCache
- IPolicyRegistry, IPolicyEvaluator

SQLite Pattern Store, comprehensive documentation

---

0.0.5-preview1

Client-Side Fingerprinting:
- BotDetectionTagHelper for fingerprint collection JS
- Signed token system prevents spoofing
- Detects headless browsers, automation markers

Inconsistency Detection:
- Catches UA/header mismatches
- Cross-signal contradiction detection

Risk Assessment:
- RiskBand enum (Low, Elevated, Medium, High)
- GetRiskBand(), ShouldChallengeRequest(), GetRecommendedAction()

Session-Level Behavioral Analysis:
- Multi-identity tracking (IP, fingerprint, API key, user)
- Anomaly detection (spikes, new paths, timing)

---

0.0.4-preview1

- ONNX-based detection (1-10ms latency)
- Source-generated regex for performance
- OpenTelemetry metrics integration
- YARP reverse proxy integration

---

0.0.3-preview2: Security fixes (ReDoS, CIDR validation)
0.0.3-preview1: Documentation improvements
0.0.2-preview1: Background updates, SQLite storage
0.0.1-preview1: Initial release