ANPU // Field briefing · version 1.2
Asymmetric Navigation & Preparedness Utilities
ANPU is a free, open-source early-warning tool for the people who keep local infrastructure running: small utilities, facility operators, co-ops and civil defense volunteers. It watches many kinds of warning signs at once, learns what normal looks like for your own node, tells you in plain English when something stops looking normal, and grades its own accuracy as it runs.
RUNS ON ONE COMPUTERWORKS OFFLINENO DATA SENT ANYWHEREMIT LICENSE
What it watches
Big disruptions rarely start in one place. ANPU scores many weak signals together, so several small warning signs can add up to one clear alert.
Live today
Space weatherNOAA planetary K-index. Geomagnetic storms can degrade GPS and stress long power lines and transformers.
Exploited vulnerabilitiesCISA's catalog of flaws confirmed exploited in the wild, including the subset that hits industrial (ICS/OT) equipment.
Honey-PLC tripwireA decoy industrial controller on Modbus port 502. Every probe and write attempt is recorded and scored.
In development (simulated until a feed is connected)
PhysicalDark maritime transits, grid frequency deviation, GPS jamming.
CyberSCADA probes, internet routing (BGP) anomalies.
Economic & informationMarket volatility, media divergence, and an "information vacuum" flag for physical signs that appear before the news does.
How it works
A three-phase loop, running every 30 minutes on your own machine.
PHASE I
01. Reconnaissance
Learn what normal looks like
ANPU collects each signal every cycle and builds this node's own normal from the last 30 days, using an Isolation Forest model. There are no vendor signatures and no cloud service.
PHASE II
02. The Tripwire
Catch who comes looking
The Honey-PLC decoy pretends to be industrial equipment. Every connection is logged with its Modbus command, write attempts are flagged, and recent hits feed straight into the next score.
PHASE III
03. Evolution
Learn from the operator
You label each alert as a real threat or a false alarm. False alarms are kept out of the next retrain, real threats are saved as signatures, and the baseline is rebuilt daily.
Alert levels, in plain English
Every alert comes with its reasons, for example "Space weather is well above normal: 6.7 vs a typical ~3.4."
| NONE | Everything within its normal range. |
| WATCH | One signal is spiking, or the model sees an unusual combination that no single signal explains. |
| WARN | Two or more signals are spiking together, or the combined threat index is over its line. |
| ACT | A warning while the honeypot is being probed. |
It grades itself
A built-in scorecard so you can decide how far to trust it.
- Trust: precision and false alarms per week, from your own labels.
- Early warning: log a real-world event, and ANPU reports whether it warned you beforehand, and how early.
- Labyrinth: honeypot hits, repeat visitors and write attempts.
- Watching: uptime, feed freshness, model age and test results.
Where it stands
Honest status, version 1.2.
- Real: the NOAA and CISA feeds, the honeypot, the explanations, the operator labelling and the scorecard. 24 automated tests pass, including a replay of a real week of feed data that must raise no false alarms.
- Simulated: the signals tagged SIM. They keep the pipeline running until real feeds are connected, and must not be relied on.
- Next: more real feeds, alerts sent to email and chat tools, deeper honeypot "labyrinth" profiling, and a one-click installer for low-cost offline hardware.