{"id":4967,"date":"2026-01-29T01:47:11","date_gmt":"2026-01-29T01:47:11","guid":{"rendered":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/?p=4967"},"modified":"2026-01-29T03:09:19","modified_gmt":"2026-01-29T03:09:19","slug":"scythe-api-server","status":"publish","type":"post","link":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/?p=4967","title":{"rendered":"SCYTHE API Server"},"content":{"rendered":"\n<figure class=\"wp-block-audio\"><audio controls src=\"http:\/\/172-234-197-23.ip.linodeusercontent.com\/wp-content\/uploads\/2026\/01\/Building_the_Digital_Gods_Eye_View.mp3\"><\/audio><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>The RF hypergraph models network host relationships by representing individual hosts as nodes and their shared characteristics as hyperedges. This approach integrates traditional network scanning data, such as that provided by <strong>Nmap<\/strong>, into a spatial and signal-based visualization framework.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img data-opt-id=2023051484  fetchpriority=\"high\" decoding=\"async\" width=\"689\" height=\"585\" src=\"https:\/\/ml6vmqguit1n.i.optimole.com\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/172-234-197-23.ip.linodeusercontent.com\/wp-content\/uploads\/2026\/01\/image-5.png\" alt=\"\" class=\"wp-image-4969\" srcset=\"https:\/\/ml6vmqguit1n.i.optimole.com\/w:689\/h:585\/q:mauto\/f:best\/https:\/\/172-234-197-23.ip.linodeusercontent.com\/wp-content\/uploads\/2026\/01\/image-5.png 689w, https:\/\/ml6vmqguit1n.i.optimole.com\/w:300\/h:255\/q:mauto\/f:best\/https:\/\/172-234-197-23.ip.linodeusercontent.com\/wp-content\/uploads\/2026\/01\/image-5.png 300w\" sizes=\"(max-width: 689px) 100vw, 689px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">1. Modeling Network Hosts as Nodes<\/h3>\n\n\n\n<p>When a network host is discovered, it is added to the hypergraph store as a specialized node. The modeling process involves several key translations:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Node Identification:<\/strong> Each host is assigned a unique <code>node_id<\/code> derived from its IP address (e.g., <code>net_192_168_1_1<\/code>).<\/li>\n\n\n\n<li><strong>Pseudo-Geospatial Positioning:<\/strong> For visualization purposes, the system converts IP address octets into coordinates (latitude and longitude) to spread the hosts across a map view.<\/li>\n\n\n\n<li><strong>RF Metric Analogies:<\/strong> To maintain consistency with the RF model, network attributes are mapped to signal properties:\n<ul class=\"wp-block-list\">\n<li><strong>Frequency:<\/strong> A &#8220;pseudo-frequency&#8221; is calculated based on the number of open ports discovered on the host.<\/li>\n\n\n\n<li><strong>Power:<\/strong> Signal strength is estimated based on network activity levels, also derived from port counts.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Metadata:<\/strong> Nodes store rich technical details, including hostnames, operating systems, MAC addresses, and lists of active services.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2. Modeling Relationships via Hyperedges<\/h3>\n\n\n\n<p>The core of the hypergraph model lies in <strong>hyperedges<\/strong>, which connect groups of two or more nodes that share specific network relationships. The system automatically generates these based on two primary criteria:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Service-Based Relationships (<code>service_group<\/code>):<\/strong> The model groups hosts that are running the same network services (e.g., all hosts running <code>http<\/code> or <code>ssh<\/code>). These hyperedges carry metadata describing the relationship as a &#8220;shared service&#8221; and assign a signal strength value based on the number of nodes in the group.<\/li>\n\n\n\n<li><strong>Subnet-Based Relationships (<code>subnet_group<\/code>):<\/strong> The model identifies hosts belonging to the same <strong>\/24 subnet<\/strong>. It creates hyperedges to link these hosts, representing their topological proximity within the network infrastructure.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3. Integration and Discovery<\/h3>\n\n\n\n<p>These relationships are dynamically modeled through the <strong>Network Hypergraph Scan<\/strong> process. The server initiates an Nmap scan (e.g., a ping sweep or service discovery) and feeds the resulting structured data into the <code>RFHypergraphStore<\/code>. Once the hosts are added as nodes, the system executes logic to &#8220;create service hyperedges&#8221; and &#8220;create subnet hyperedges,&#8221; instantly forming the relational web of the network for visualization and metrics analysis.<\/p>\n\n\n\n<p>In the RF hypergraph model, subnet and service hyperedges are automatically generated through dedicated methods in the <code>RFHypergraphStore<\/code> following a network scan. This process organizes discovered network hosts into relational groups based on shared technical characteristics.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>1. Generation of Service Hyperedges<\/strong><\/h3>\n\n\n\n<p>The system identifies relationships between hosts running identical network applications through the <code>create_service_hyperedges<\/code> method.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Grouping Logic:<\/strong> The system iterates through all nodes in the store, filtering for those labeled as <code>network_host<\/code>. It then groups these nodes by the entries in their <code>services<\/code> list (e.g., all hosts running &#8220;http&#8221; or &#8220;ssh&#8221;).<\/li>\n\n\n\n<li><strong>Edge Creation:<\/strong> A hyperedge of the type <code>service_group<\/code> is created for every identified service that is shared by <strong>at least two nodes<\/strong>.<\/li>\n\n\n\n<li><strong>Metrics and Metadata:<\/strong> Each generated edge is assigned a <strong>signal strength<\/strong> starting at -60, which increases by 2 for every additional node in the group. The metadata includes a specific description of the relationship, such as &#8220;shared_http_service&#8221;.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>2. Generation of Subnet Hyperedges<\/strong><\/h3>\n\n\n\n<p>Hosts are also grouped based on their topological proximity within the network infrastructure using the <code>create_subnet_hyperedges<\/code> method.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Subnet Identification:<\/strong> The system extracts the IP address of each <code>network_host<\/code> and determines its <strong>\/24 subnet<\/strong> by grouping the first three octets (e.g., <code>192.168.1.x<\/code>).<\/li>\n\n\n\n<li><strong>Edge Creation:<\/strong> If <strong>two or more hosts<\/strong> belong to the same subnet, a hyperedge of type <code>subnet_group<\/code> is generated to link them.<\/li>\n\n\n\n<li><strong>Metrics and Metadata:<\/strong> These edges receive a <strong>signal strength<\/strong> starting at -50, increasing by 3 for every node in the group. The metadata explicitly labels the relationship as &#8220;same_subnet&#8221; and identifies the specific subnet range (e.g., <code>192.168.1.0\/24<\/code>).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>3. Automatic Triggering Process<\/strong><\/h3>\n\n\n\n<p>The generation of these hyperedges is typically integrated into the <strong>Network Hypergraph Scan<\/strong> workflow:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Discovery:<\/strong> The server initiates an <strong>Nmap scan<\/strong> against a target range.<\/li>\n\n\n\n<li><strong>Node Creation:<\/strong> Discovered hosts are converted into hypergraph nodes with metadata including their IP, hostname, and active ports\/services.<\/li>\n\n\n\n<li><strong>Relationship Building:<\/strong> Once all nodes are added, the server automatically calls <code>create_service_hyperedges()<\/code> and <code>create_subnet_hyperedges()<\/code> to populate the store with relational data before returning the final visualization to the user.<\/li>\n<\/ol>\n\n\n\n<p>This same automated logic is applied during specialized scans, such as the <code>quick-scan<\/code> for discovery or the <code>localhost<\/code> scan for internal services.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The RF hypergraph models network host relationships by representing individual hosts as nodes and their shared characteristics as hyperedges. This approach integrates traditional network scanning data, such as that provided by Nmap, into a spatial and signal-based visualization framework. 1. Modeling Network Hosts as Nodes When a network host is discovered, it is added to&hellip;&nbsp;<a href=\"https:\/\/172-234-197-23.ip.linodeusercontent.com\/?p=4967\" rel=\"bookmark\"><span class=\"screen-reader-text\">SCYTHE API Server<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":4969,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","footnotes":""},"categories":[14,10,7],"tags":[],"class_list":["post-4967","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-podcast","category-signal_scythe","category-the-truben-show"],"_links":{"self":[{"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=\/wp\/v2\/posts\/4967","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4967"}],"version-history":[{"count":2,"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=\/wp\/v2\/posts\/4967\/revisions"}],"predecessor-version":[{"id":4971,"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=\/wp\/v2\/posts\/4967\/revisions\/4971"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=\/wp\/v2\/media\/4969"}],"wp:attachment":[{"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4967"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4967"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4967"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}