Skip to content

mikeywhiston/AetherStream

Repository files navigation

AetherStream: Metadata Archival Framework

Status Focus Language

Overview

AetherStream is an automated data ingestion and forensic preservation suite developed to consolidate disparate intelligence sources. Originally built to power the backend logic of the Designated Safeguarding Network, the framework provides a professional-grade interface for metadata analysis, network and physical address reconnaissance, and the immutable archival of web-based assets.

The project was engineered to solve the problem of high-pressure data loss during live incident response. It transitions typical functionality into a structured intelligence platform aligned with the NIST Incident Response lifecycle.

Engineering and Architecture

Forensic Archival

The primary component of AetherStream is a headless archival engine. It utilizes Selenium and the Chrome DevTools Protocol to interact with the browser's printing and rendering pipeline at a low level. To ensure reliability across varied network conditions, the engine implements a mobile-basic pivot—dynamically modifying request headers and URLs to force a lightweight, stable version of the target document. This results in high-fidelity PDF artifacts suitable for long-term retention and forensic auditing.

In other words: this means that web-based evidence can be permanently preserved - despite any arbitrary security limitations that may be imposed on the evidence, via the use of an emulated browser client (selenium).

Exposure Telemetry

AetherStream integrates with distributed breach repositories to perform automated credential exposure audits. By ingesting PII metadata, the framework allows security teams to identify leaked credentials in the wild, facilitating the mitigation of unauthorized access vectors and identity theft.

Network Reconnaissance Modules

The framework includes specialized connectors for Layer-2 and Layer-7 telemetry:

MAC Vendor Analysis

AetherStream resolves OUI signatures to identify unauthorized hardware within a monitored perimeter. However, it does not consider locally-generated physical addresses which effectively anonymise the vendor - spitting potentially inaccurate results.

DNS Auditing

AetherStream ingests TXT, MX, and A records to detect infrastructure anomalies or domain hijacking attempts. This is a useful utility in order to quickly atomically fetch the DNS records of a particular domain.

IP Geolocation

AetherStream provides estimated locations based on provided IP address - resolving metadata inconsistencies and ensuring the location of threat actors and malicious clients are sourced accurately and without discrepancy.

NCSC Cyber Assessment Framework

NCSC CAF

This project is documented to demonstrate alignment with the Cyber Assessment Framework.

Objective B2 (Identity and Access Control)

Monitoring leaked credentials to prevent perimeter compromise.

Objective B3 (Data Security)

Ensuring the forensic integrity of data at rest through immutable archival.

Objective C1 (Security Monitoring)

Automating the detection of anomalous network metadata.

Professional and Ethical Mandate

AetherStream is maintained under a strict ethical framework. All research and data handling protocols prioritize the Principle of Least Privilege (PoLP) and follow the NCSC standards for responsible disclosure. The framework is a testament to the maturation of technical aptitude into professional cybersecurity discipline.

About

An automated data ingestion and forensic preservation suite developed to consolidate disparate intelligence sources.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

 
 
 

Contributors

Languages