Skip to content
HookProbe Docs

Changelog

Changelog

All notable changes to HookProbe are documented here.

[6.1.0] - 2026-03 (Current)

Added

  • Brain Module (core/brain/) — Shared hardware detection and unified inference API
    • hw_detect.py: Auto-detects 13 NPU/accelerator types (Hailo-8L, Intel NPU, Coral, RK3588, Jetson, Apple M4, etc.)
    • inference_bridge.py: Tier-aware inference routing (Sentinel → Nexus)
    • engines/llama_engine.py: Local LLM via llama-cpp-python (Q4 quantization)
  • hookprobe-ctl CLI — Platform control tool with hw-info, brain-info, version, status
  • Benchmark Suite — JSON output for automated comparison pages (469K classifications/sec on ARM64)
  • Comparison Pages — /compare/vs-wazuh/, /compare/vs-suricata/, /compare/vs-crowdsec/
  • Automation Dashboard — /admin/automation showing timer health, AI costs, SEO stats
  • SEO Overhaul — 32 docs pages with expanded meta descriptions, OG tags, TechArticle JSON-LD
  • Docs Sitemap — Auto-generated by Starlight, robots.txt for all subdomains

Fixed

  • C-3: Feature extractor or operator dropping 0.0 values (corrupted benign IP vectors)
  • H-4: baseline_profiler.py ClickHouse POST enforcement
  • H-5: ai-provider.sh temp file leak (added trap EXIT cleanup)
  • H-6: seo-outreach.sh SQL injection via unescaped ARRAY literal
  • Blog \n bug: 27 posts had literal \n in HTML content (root cause: escape_sql)
  • AEGIS exit code: run_scan() now accepts exit 1/2 as valid finding codes
  • Outreach timer: Fixed JSON parsing for AI responses with markdown fences
  • Zod v3.25: Pinned zod/sitemap/zod-to-json-schema for Starlight 0.31 compatibility

Security

  • Security headers on all 8+ cached nginx locations (HSTS, X-Content-Type-Options)
  • JSON-LD </script> escape (defense-in-depth via \u003c)
  • Sitemap error returns 503 (not cacheable 200)
  • Sitemap regex tightened + rate limited
  • Docs CSP allows PostHog analytics
  • Dashboard auth pages: noindex, nofollow
  • Blog search pages: noindex (prevents thin content indexation)

Product Integration

  • Guardian: hydra_lite.py wired with core/brain/ (hw_detect + inference_bridge)
  • Fortress: Containerfile.hydra includes core/brain/, HIP config fields added
  • Sentinel: Hardware detection in startup banner and heartbeat

[6.0.0] - 2026-02

Added

  • Aegis (Zig + eBPF) kernel-level XDP packet intake engine
    • Comptime-generated protocol parsers for zero-overhead L7 classification
    • In-kernel Shannon entropy computation for encrypted payload detection
    • 32-byte feature vector extraction per packet for downstream ML inference
    • BPF ring buffer (16 MB) for zero-copy Aegis-to-Napse communication
  • Napse (Mojo AI) userspace intent classification engine
    • SIMD-vectorized Bayesian intent classifier: P(M|x) = P(x|M) * P(M) / P(x)
    • HMM kill chain tracker with Viterbi decoding (recon -> exploit -> install -> C2)
    • Autotuning Bayesian priors based on rolling network baseline
    • Intent classes: c2, exfiltration, reconnaissance, lateral_movement, privilege_escalation, scanning, anomalous, benign
  • New ClickHouse tables: aegis_observations, napse_intents, napse_flows
  • Napse output format: intents.json and flows.json (replacing legacy log formats)
  • POD-006/POD-007 split: Aegis (kernel intake) and Napse (AI classification) as separate pods

Changed

  • Replaced legacy unified NAPSE container with split Aegis + Napse architecture
  • Detection pipeline now flows: Aegis XDP -> Ring Buffer -> Napse Mojo -> ClickHouse
  • QSecBit scoring updated for Bayesian intent-based inputs (confidence-weighted)
  • Container names updated: ids-aegis, ids-napse (replacing fts-napse)
  • CPU allocation: Aegis on core 0 (kernel), Napse on cores 1-2 (SIMD inference)
  • RAM reduced: Aegis 1GB + Napse 4GB (was 6GB for unified container)
  • Monitoring metrics updated: aegis_* and napse_intents_* replace legacy metric names

Removed

  • Legacy unified NAPSE container (replaced by Aegis + Napse split)
  • Legacy log formats (conn.log, dns.log, http.log, ssl.log, files.log, notice.log)
  • Legacy ClickHouse tables: napse_conn, napse_alerts
  • Legacy XDP loader init container (Aegis manages its own XDP lifecycle)

Performance

  • Packet intake: >10 Mpps (Aegis XDP, up from ~5 Mpps)
  • Classification latency: <500 microseconds (Napse, down from ~1ms)
  • Memory footprint: ~450MB total (down from ~1.2GB)
  • Startup time: <1 second (down from ~2 seconds)
  • Max throughput: ~15 Gbps (up from ~10 Gbps)

[5.1.0] - 2026-01

Added

  • Neural Synaptic Encryption (NSE)
  • Witness Verification (anti-hallucination BLS)
  • Energy-aware routing
  • Adaptive polymorphism (BURST/SWARM/GHOST modes)

Changed

  • Improved QSecBit formula with energy component
  • Enhanced NEURO weight evolution

[5.0.0] - 2025-12

Added

  • Cortex architecture integration
  • Unified systemd services
  • Auto-repair provisioning
  • Auto-update with rollback
  • hookprobe-ctl unified CLI
  • XDP/eBPF DDoS mitigation with auto NIC detection
  • Energy monitoring (RAPL + per-PID)
  • GDPR compliance by default
  • Hot Shot Mode (power preferences)

Changed

  • Simplified installation (single bootstrap script)
  • Improved QSecBit scoring
  • Better network direction awareness
  • Enhanced documentation

Fixed

  • Memory leaks in long-running deployments
  • XDP compatibility with more NICs
  • Mesh reconnection stability

[4.5.0] - 2025-09

Added

  • dnsXai v3 with CNAME uncloaking
  • Fortress VLAN segmentation
  • OpenFlow SDN integration
  • Fleet management (Nexus)

Changed

  • Improved ML model accuracy
  • Reduced false positives
  • Better resource usage

[4.0.0] - 2025-06

Added

  • DSM consensus protocol
  • BLS signature aggregation
  • Microblock gossip
  • Checkpoint finalization
  • HTP file transfer extension

Changed

  • Major architecture refactor
  • New 7-POD structure
  • Improved mesh connectivity

[3.5.0] - 2025-03

Added

  • Guardian product tier
  • WiFi hotspot creation
  • Mobile network trust detection
  • L2-L7 layer detector

Changed

  • Better Raspberry Pi support
  • Improved power efficiency

[3.0.0] - 2024-12

Added

  • HTP protocol v1
  • NEURO neural resonance
  • Proof-of-Sensor-Fusion
  • TER generation
  • Weight evolution

Changed

  • Complete protocol redesign
  • New security model

[2.5.0] - 2024-09

Added

  • QSecBit v2 with component scoring
  • VictoriaMetrics integration
  • Grafana dashboards
  • Alert notifications

Changed

  • Improved detection accuracy
  • Better logging

[2.0.0] - 2024-06

Added

  • Multi-tier product structure
  • Sentinel, Guardian, Fortress, Nexus
  • Basic mesh networking
  • NAPSE engine integration (replaced legacy IDS)

Changed

  • Major codebase restructure
  • New installation system

[1.0.0] - 2024-03

Added

  • Initial release
  • Basic IDS integration
  • QSecBit v1
  • Simple dashboard
  • Container deployment

Version Naming

HookProbe follows semantic versioning:

  • Major (X.0.0): Breaking changes, new architecture
  • Minor (0.X.0): New features, backward compatible
  • Patch (0.0.X): Bug fixes, security patches

Support Status

VersionStatusSupport Until
6.xActiveCurrent
5.xSecurity fixes2027-02
4.xEnd of life2026-06
< 4.0End of life-

Upgrade Path

Terminal window
# Check current version
hookprobe-ctl version


# Update to latest
sudo hookprobe-ctl update

For major version upgrades, see the migration guides in the documentation.