Redarc

Automated vulnerability scanner with a Bayesian risk engine.
Most scanners tell you what's open. Redarc tells you what's getting worse.

---

Point it at a network range. Redarc discovers live hosts, scans ports, fingerprints running services against a custom signature database, matches them to known CVEs from the NVD, and produces a composite risk score using Bayesian inference. Scores update with each scan — a host that's been vulnerable for six months scores higher than one found yesterday with the same CVE.

Network range → Host discovery → Port scan → Service fingerprint
    → CVE matching → Bayesian risk scoring → Dashboard + trends

---

How it works

The scan pipeline runs as a Celery task chain — each phase executes independently, reports progress over WebSocket, and stores partial results even if a later phase fails.

01_DISCOVERY    nmap -sn            → find live hosts         [0-15%]
02_PORT_SCAN    nmap -sS            → enumerate open ports    [15-40%]
03_FINGERPRINT  custom probes       → identify services       [40-60%]
04_CVE_LOOKUP   NVD CPE matching    → find known vulns        [60-80%]
05_RISK_SCORE   Bayesian model      → score each host         [80-95%]
06_COMPLETE     mark done           → push final results      [100%]

Progress streams in real-time. No polling.

_{↑ A completed scan of an external host — phase indicators, host results, risk scores, and a live log feed.}

---

The Risk Model

CVSS gives you severity per-CVE. Redarc gives you risk per-host — the combination of how likely something is to get exploited and how bad it would be if it did.

Risk = P(exploitable) × P(impact) × 100

P(exploitable) factors in worst CVSS score, known exploit availability, patch status, and network exposure (internet vs. internal).

P(impact) combines service type weights (databases score higher than static file servers) with a configurable data sensitivity value per host.

When a host gets re-scanned, the previous score becomes a Bayesian prior. New evidence updates it:

posterior = (0.7 × new_evidence) + (0.3 × prior)

This means persistent risk accumulates. A host that's been vulnerable across six scans scores higher than one that just appeared — even with identical CVEs. Remediated risk decays gradually instead of snapping to zero.

Full model documentation with worked examples and sensitivity analysis: docs/RISK_MODEL.md

---

Dashboard

The main dashboard shows aggregate risk at a glance: average risk index, total hosts, scan success rate, and critical vulnerability count. The heatmap grid maps every host in the scanned subnet by risk intensity. The 30-day trend chart tracks how your overall risk posture is moving.

The activity log at the bottom ranks hosts by risk score — click any row to drill into the full host detail.

---

Scan Management

All scans in one place — filterable by status, target, and time. Each row shows host count, completion status, and timestamp. Start new scans from the top-right, and click through to any scan's detail view for full results.

---

Scan Comparison

Select any two scans of the same target and diff them:

The comparison engine computes delta metrics — new entry points (ports), vulnerability changes (CVEs added/resolved), threat surface shift (risk delta), and host retention rate. Below the summary, a per-host diff view shows exactly what changed: ports opened/closed, version changes, and risk score movement.

---

Architecture

┌─────────────┐     ┌──────────────────┐     ┌──────────────┐
│   Nuxt 3    │────▶│  Django / DRF    │────▶│ TimescaleDB  │
│   (SPA)     │◀────│  Daphne (ASGI)   │     │  (PG 16)     │
└─────────────┘     └────────┬─────────┘     └──────────────┘
     :3000           WS ▲    │ :8000              :5432
                        │    ▼
                   ┌─────────────┐         ┌──────────┐
                   │   Redis     │◀────────│  Celery  │
                   │  (broker +  │         │ Workers  │
                   │  channels)  │         │  (×4)    │
                   └─────────────┘         └──────────┘
                        :6379

Layer	Tech	Role
Frontend	Nuxt 3 + Vue 3 + TypeScript + Tailwind	SPA with ECharts visualizations, dark industrial UI
Backend	Django 5 + DRF + Daphne (ASGI)	REST API, WebSocket consumers, JWT auth
Tasks	Celery + Redis	Async scan pipeline, NVD sync scheduler
Database	TimescaleDB (PostgreSQL 16)	Hypertable for risk scores, time_bucket() for trends
Scanner	python-nmap + custom fingerprint engine	Host discovery, port scanning, service identification
Real-time	Django Channels	Sub-second scan progress over WebSocket

Design decisions, tradeoffs, and scaling notes: docs/ARCHITECTURE.md

---

Custom Fingerprint Engine

Goes beyond nmap's -sV by sending protocol-specific probes (HTTP, SSH, SMTP, MySQL, PostgreSQL, Redis, MongoDB) and matching responses against a curated signature database. Produces confidence scores (0.0–1.0) that feed directly into the risk model.

Port (open)
  ├─ Protocol guess (port number + nmap hint)
  ├─ Probe dispatch (HTTP GET, SSH banner, SMTP EHLO, etc.)
  ├─ Regex matching against signature DB
  ├─ Confidence scoring (version extraction → +43% boost)
  └─ CPE generation → cpe:2.3:a:{vendor}:{product}:{version}:...

Signatures are plain JSON — adding a new service doesn't require code changes or migrations.

Full probe documentation and comparison with nmap: docs/FINGERPRINT_ENGINE.md

---

Authentication

_{↑ The auth interface — terminal boot sequence on the left, credential form on the right. JWT-based with configurable token lifetime.}

---

Alert Configuration

Define notification triggers with logic-based rules — email on critical risk threshold, Slack webhook integration, terminal audio alerts. Rules are toggleable and evaluate against scan results automatically.

---

Quick Start

git clone https://github.com/yourusername/redarc.git
cd redarc
cp .env.example .env      # edit as needed

docker compose up --build

In another terminal:

docker compose exec backend python manage.py create_operator
docker compose exec backend python manage.py seed_demo

Service	URL
Frontend	http://localhost:3000
API	http://localhost:8001/api/v1/
TimescaleDB	localhost:5434
Redis	localhost:6381

The demo seed creates 17 hosts across two networks, 11 CVEs, and 4 completed scans with risk evolution data. Dashboard populates immediately.

First real scan

1. Log in at http://localhost:3000
2. Navigate to Scans → New Scan
3. Create a target (e.g. 192.168.1.0/24)
4. Start the scan — progress streams via WebSocket in real-time

Only scan networks you own or have explicit authorization to scan. See SECURITY.md.

---

Running Tests

# Backend tests
docker compose exec backend pytest -v

# Lint
docker compose exec backend ruff check .

# Frontend type check
docker compose exec frontend pnpm nuxi typecheck

---

Environment Variables

Variable	Default	Description
SECRET_KEY	—	Django secret key
DEBUG	True	Debug mode
DB_NAME	redarc	TimescaleDB database name
DB_USER / DB_PASSWORD	redarc	Database credentials
REDIS_URL	redis://redis:6379	Redis connection string
NVD_API_KEY	—	Optional. Higher NVD rate limits.
CELERY_CONCURRENCY	4	Worker thread count
SCAN_TIMEOUT	3600	Max scan duration (seconds)
JWT_ACCESS_LIFETIME	60	Access token expiry (minutes)

---

Known Issues / Roadmap

• NVD sync pulls ~250K CVEs on first run — takes a while
• Fingerprint signature DB is sparse (~30 patterns, 11 services)
• No rate limiting on API — single-operator V1
• WebSocket reconnect logic needs work on flaky connections
• Container runs as root for nmap raw sockets — needs capability tuning
• PDF report export planned for V2
• Alert rule execution engine partially scaffolded
• No UDP probes yet (DNS, SNMP)
• TLS certificate inspection not implemented

---

License

MIT