Ghost Linking¶

DEVI can't always tell which resources belong together from IDs alone. Ghost Linking solves that using CIDR overlap and security group membership.

Note

We define the methodology for deducing non-explicit architectural boundaries across isolated cloud environments. The Ghost Linker infers hard edges (FlowsTo, Uses) across network partitions without requiring human-configured mapping hints.

The Cross-Cloud Disconnect¶

Native vendor APIs are regionally and structurally isolated. An AWS Transit Gateway rtb-0abc has no metadata connecting it to a GCP Cloud Router cr-us-east1. Without explicit attribution, calculating holistic network flow disruption is mathematically impossible.

We resolve this with a heuristic bipartite matching layer on top of the pkg/graph/ processing channel.

CIDR Overlap Heuristics¶

Network components frequently advertise identical routing ranges across vendors. Subnets, VPCs, and VNets map to an interval tree structure:

// pkg/engine/heuristics/ghost/interval.go
type Interval struct {
    Low  uint32 // IPv4 integer representation
    High uint32
}

type Node struct {
    Interval Interval
    Max      uint32
    CRN      string
    Left     *Node
    Right    *Node
}

When discover() finishes for a given cloud environment, the engine runs an intersection calculation against the interval tree. If two distinct clouds advertise BGP routes covering functionally identical Interval ranges, the engine deterministically constructs a FlowsTo edge bridging the two CRNs.

Behavioral Fingerprinting¶

Application layer routing (e.g., Lambda functions querying external Snowflake clusters) has no physical CIDR mapping. We infer these edges by analyzing structural metadata.

The engine uses Jaccard Similarity to evaluate textual environment mappings:

\[ J(A,B) = \frac{|A \cap B|}{|A \cup B|} \]

Where \(A\) is the tokenized environment variables of a compute context (e.g., DB_HOST, REDIS_URI), and \(B\) is the known physical ingress points of detected database clusters.

func JaccardSimilarity(env string, endpoint string) float64 {
    intersection := 0
    // implementation calculates exact substring overlap
    return float64(intersection) / float64(len(env) + len(endpoint) - intersection)
}

If the coefficient exceeds \(0.85\), the engine commits a speculative Uses edge to the BadgerDB Radix tree, flagged IsGhost: true. s.a.u treats ghost edges as blockers: destructive deletions halt until you confirm the connection topology.