Two users, one account.
Which one did it?
An attacker and a legitimate user share a machine and a UID. Remove the one transient signal that reliably separates them, and ask whether an attribution is still defensible — or whether the method should refuse to answer.
The question
Linux Audit supplies process identity and destination. It does not
supply the client source port. ss supplies the
PID-to-source-port bridge — but only while the socket is open. It is a
transient observation.
So a calibration run can learn the timing relationship while that bridge exists. The evaluation run withholds it. The question is how much correct attribution coverage survives, and whether an uncertainty-aware rule correctly abstains instead of guessing wrong.
A stable null result is an acceptable outcome and may narrow or kill the timestamp direction entirely.
Why abstention is the point
Most attribution work optimises accuracy. This study treats refusing to decide as a first-class outcome, and measures a coverage/error frontier rather than a single number.
A method that answers every question wrongly some of the time is worse than one that answers fewer questions and knows which ones it cannot. In forensic use the second is the only defensible kind.
Where it stands
| stage | state |
|---|---|
| Protocol v1 | REVISE |
| Protocol v2 | REVISE |
| Protocol v3 | REVISE, then ACCEPT |
| Protocol v3.1 | REVISE |
| Protocol v3.2 | ACCEPT |
| Evidence-availability probe | MECHANISM_CREDIBLE |
| M1 schemas and integrity validator | ACCEPT · 91 tests |
| M2 Stage 1 freeze-manifest contract | open |
| Physical calibration runs | not authorized |
Repeated revision rounds before the current accepted protocol. Each REVISE was an independent review finding a real defect in the design — a freeze-order problem, a denominator error, a post-selection hazard — before any data was collected.
Evidence discipline
Every run produces an immutable bundle: canonical serialisation, hashed records, and a fail-closed validator that refuses anything it cannot verify.
The validator has an observed RED proof — a same-length raw-byte
mutation fails with RAW_INTEGRITY_MISMATCH, and a
coordinated laundering attempt fails with exactly the unique codes
RECORD_LOSS_UNACCOUNTED and
REJECT_REPORT_MISMATCH. A validator never observed
rejecting a tampered bundle would not be evidence of anything.
What this study taught the lab
Ground truth here is an independent action ledger — a record of what actually happened, written by something other than the system under observation. The study currently has to construct one.
A lab that runs its own attacks does not. That observation is why Ghalvera's see → attribute → retrieve loop exists: crossing the boundary yourself makes the ground truth real instead of assumed.
Not determined
- The probe covers one Fedora 44 ARM64 run. PID and port reuse, cross-request ambiguity, and other Linux or curl versions are untested.
- The stable link depends on
ss. Linux Audit alone is insufficient for the proposed method; this is a protocol constraint, not an empirical finding. - M1.2 is exercised against generated bundles only. It has not been tested against physical evidence.
- Protocol v3.2 contains a recorded P1-wrong wording contradiction. The contract maps it fail-closed to
INVALID_EXPERIMENT, and physical calibration stays blocked pending an erratum. - No empirical finding is claimed. Everything above is contract and protocol evidence.