DaLaw2/NetGuardia
1
0
Fork 0
mirror of https://github.com/DaLaw2/NetGuardia.git synced 2026-08-24 14:10:28 +09:00
Code Issues Packages Projects Releases Wiki Activity

feat: update to v9 ML model (10 classes, LAMB, 91.8% accuracy)

Browse Source 
- Update ONNX models + inference_config.json to v9
- Aggregator: replace Cryptomining with Bot + DNS Tunneling for immediate alerts
- SOAR: handle v9 class names (Malware, Web Attack, Bot, DNS Tunneling)
- Submodule net-guardia-trainer → v9 commit (3447472)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
DaLaw2 2026-04-07 03:27:26 +08:00
parent 82d2f53b4b
commit 7c28c7e6f2
7 changed files with 317 additions and 200 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
models/classifier.onnx
View File

Binary file not shown.

BIN
models/deep_autoencoder.onnx
View File

Binary file not shown.

217
models/full_config.json
View File

@ -1,12 +1,12 @@
{
"created_at": "2026-04-03T15:37:09.215359",
"created_at": "2026-04-07T02:27:17.281069",
"framework": "PyTorch",
"model_type": "MultiTaskModel",
"model": {
"deep_autoencoder": {
"file": "deep_autoencoder.onnx",
"input_dim": 33,
"encoding_dim": 24,
"input_dim": 31,
"encoding_dim": 12,
"ae_feature_names": [
"flow_duration",
"fwd_packets",
@ -37,18 +37,16 @@
"fwd_act_data_pkts",
"fwd_iat_std",
"bwd_iat_std",
"flow_iat_std",
"fwd_bwd_bytes_ratio",
"pkt_len_variance",
"fwd_iat_skewness"
"iat_cv"
],
"ae_threshold": 0.23287349939346313
"ae_threshold": 0.23011694848537445
},
"classifier": {
"file": "classifier.onnx",
"type": "MultiTaskModel",
"n_features": 34,
"n_classes": 7,
"n_features": 32,
"n_classes": 10,
"outputs": [
"anomaly",
"class_probs",
@ -84,10 +82,8 @@
"fwd_act_data_pkts",
"fwd_iat_std",
"bwd_iat_std",
"flow_iat_std",
"fwd_bwd_bytes_ratio",
"pkt_len_variance",
"fwd_iat_skewness",
"iat_cv",
"ae_anomaly_score"
]
}
@ -96,31 +92,31 @@
"ae_clip_params": {
"flow_duration": {
"lower": 0.0,
"upper": 70550165.55999511
"upper": 115669365.2
},
"fwd_packets": {
"lower": 1.0,
"lower": 0.0,
"upper": 120.0
},
"bwd_packets": {
"lower": 0.0,
"upper": 112.0
"upper": 126.0
},
"fwd_bytes": {
"lower": 0.0,
"upper": 21320.685742187383
"upper": 19557.400390625
},
"bwd_bytes": {
"lower": 0.0,
"upper": 78556.0
"upper": 85164.0
},
"flow_bytes_per_sec": {
"lower": 0.0,
"upper": 1457941.3831249783
"upper": 1627586.8125000005
},
"flow_pkts_per_sec": {
"lower": 0.0,
"upper": 30612.244140625
"upper": 23809.5234375
},
"fwd_win_bytes": {
"lower": 0.0,
@ -136,27 +132,27 @@
},
"bwd_pkt_len_mean": {
"lower": 0.0,
"upper": 690.0833129882812
"upper": 822.0007794189461
},
"fwd_iat_mean": {
"lower": 0.0,
"upper": 5468977.71249968
"upper": 54051113.24
},
"bwd_iat_mean": {
"lower": 0.0,
"upper": 5162028.484999921
"upper": 6912790.715000001
},
"flow_iat_mean": {
"lower": 0.0,
"upper": 166524640.0
"upper": 166521472.0
},
"pkt_len_mean": {
"lower": 0.0,
"upper": 1312.2810998535142
"upper": 957.2035284423835
},
"dst_port": {
"lower": 0.0,
"upper": 63375.0
"upper": 63005.0
},
"protocol": {
"lower": 0.0,
@ -164,15 +160,15 @@
},
"psh_flag_cnt": {
"lower": 0.0,
"upper": 1.0
"upper": 52.0
},
"ack_flag_cnt": {
"lower": 0.0,
"upper": 1.0
"upper": 107.0
},
"syn_flag_cnt": {
"lower": 0.0,
"upper": 1.0
"upper": 4.0
},
"fin_flag_cnt": {
"lower": 0.0,
@ -184,118 +180,106 @@
},
"pkt_len_std": {
"lower": 0.0,
"upper": 1051.5718536376853
"upper": 818.4579974365238
},
"fwd_pkt_len_std": {
"lower": 0.0,
"upper": 227.21978759765625
"upper": 256.8401712036142
},
"bwd_pkt_len_std": {
"lower": 0.0,
"upper": 777.4441128540009
"upper": 676.0667114257812
},
"fwd_seg_size_min": {
"lower": 0.0,
"upper": 1902198.5299999905
"upper": 1026743.0693750025
},
"fwd_act_data_pkts": {
"lower": 0.0,
"upper": 3.0
"upper": 12.0
},
"fwd_iat_std": {
"lower": 0.0,
"upper": 4873774.342499985
"upper": 6691987.085000001
},
"bwd_iat_std": {
"lower": 0.0,
"upper": 4677281.179999962
},
"flow_iat_std": {
"lower": 0.0,
"upper": 4679977.562499992
"upper": 5136363.065000001
},
"fwd_bwd_bytes_ratio": {
"lower": 0.0,
"upper": 1.0
},
"pkt_len_variance": {
"lower": 0.0,
"upper": 483294.3096875
},
"fwd_iat_skewness": {
"iat_cv": {
"lower": 0.0,
"upper": 0.0
}
},
"ae_scaler": {
"mean": [
553573.8261433974,
5.537481338484507,
4.545714712966507,
732.9122877032092,
1594.293060562387,
14524.457216310835,
408.40078292070046,
5041.6718942499765,
8858.56079223287,
293.4158400234335,
68.50546049610982,
48053.28191342106,
39629.174786987496,
2756276.585577172,
24.55453629422013,
13882.541797179327,
9.155290259001973,
0.02040285405796568,
0.04693573572753199,
0.009265432030886539,
0.005048852822986429,
1775639.8280735926,
5.542641564702501,
4.873551306800804,
673.3628917399571,
1776.7162625946232,
22595.98254433581,
457.7205079100132,
5370.204067202503,
9979.409366405764,
310.21111530262294,
64.0225296706552,
421007.8046985764,
74954.24060464761,
1927814.4699678936,
18.27810422291583,
10009.108501605231,
9.275900254913996,
0.6270530398000678,
1.4141691028300247,
0.08438195832759936,
0.0413846397252831,
0.0,
23.07985361268022,
2.8912962051498923,
10.050823938165351,
21807.221235950656,
0.027325504830147902,
47055.31297750816,
37633.95415201727,
49435.96380716072,
0.5572453787198782,
5243.747976892553,
20.458150398533718,
3.321724142251631,
13.033036407393814,
8569.843223681366,
0.21485243990919378,
94146.99057411935,
68775.38334652747,
0.47595050130443944,
0.0
],
"std": [
5769069.210865143,
12.731563443887879,
12.145072707978656,
2227.8956432424648,
7544.580451556596,
131574.08066204368,
3062.4073062866864,
11584.347904359805,
19321.807845687003,
456.85162824410736,
84.09080802725346,
457034.0398467031,
414969.2560970854,
21002348.667211507,
134.6784018236429,
20905.109391832277,
5.217401538588734,
0.13728916522249587,
0.21092403535986087,
0.09575684583550836,
0.07080745853335217,
12196313.175317517,
13.15004546194127,
13.245688945052057,
1969.9160973703263,
8250.018585629565,
161540.2407042193,
2518.5714986775442,
12103.605209582642,
20308.80085611352,
476.8868336260097,
95.72217224515282,
4199427.656867863,
616719.9756782106,
16437665.614047276,
97.4688620675193,
18194.33523865822,
5.182633726939228,
4.994559084102198,
10.431975160428792,
0.558462828085695,
0.19916731632770637,
1.0,
123.51344190707131,
22.368753242426347,
79.86295403283017,
173264.80375874366,
0.25736117191332675,
435636.77402945235,
389941.84503591515,
432399.5330873597,
0.3392136503327526,
44261.86086917189,
106.06236469581468,
24.362268530572912,
85.37603561474889,
84340.18813365103,
1.4442281045462682,
646928.7442307192,
525550.9737726098,
0.3431291415218137,
1.0
],
"feature_names": [
@ -328,10 +312,8 @@
"fwd_act_data_pkts",
"fwd_iat_std",
"bwd_iat_std",
"flow_iat_std",
"fwd_bwd_bytes_ratio",
"pkt_len_variance",
"fwd_iat_skewness"
"iat_cv"
]
},
"post_scaling_clip": {
@ -340,12 +322,15 @@
}
},
"attack_labels": {
"0": "Brute Force",
"1": "C2 Communication",
"2": "Cryptomining",
"3": "DoS\/DDoS",
"4": "Exploitation",
"5": "Normal",
"6": "Reconnaissance"
"0": "Bot",
"1": "Brute Force",
"2": "C2 Communication",
"3": "DNS Tunneling",
"4": "DoS\/DDoS",
"5": "Exploitation",
"6": "Malware",
"7": "Normal",
"8": "Reconnaissance",
"9": "Web Attack"
}
}

284
models/inference_config.json
View File

@ -29,75 +29,204 @@
"fwd_act_data_pkts",
"fwd_iat_std",
"bwd_iat_std",
"flow_iat_std",
"fwd_bwd_bytes_ratio",
"pkt_len_variance",
"fwd_iat_skewness"
"iat_cv"
],
"ae_clip_params": {
"flow_duration": { "lower": 0.0, "upper": 70550165.55999511 },
"fwd_packets": { "lower": 1.0, "upper": 120.0 },
"bwd_packets": { "lower": 0.0, "upper": 112.0 },
"fwd_bytes": { "lower": 0.0, "upper": 21320.685742187383 },
"bwd_bytes": { "lower": 0.0, "upper": 78556.0 },
"flow_bytes_per_sec": { "lower": 0.0, "upper": 1457941.3831249783 },
"flow_pkts_per_sec": { "lower": 0.0, "upper": 30612.244140625 },
"fwd_win_bytes": { "lower": 0.0, "upper": 65280.0 },
"bwd_win_bytes": { "lower": 0.0, "upper": 65535.0 },
"fwd_pkt_len_mean": { "lower": 0.0, "upper": 1500.0 },
"bwd_pkt_len_mean": { "lower": 0.0, "upper": 690.0833129882812 },
"fwd_iat_mean": { "lower": 0.0, "upper": 5468977.71249968 },
"bwd_iat_mean": { "lower": 0.0, "upper": 5162028.484999921 },
"flow_iat_mean": { "lower": 0.0, "upper": 166524640.0 },
"pkt_len_mean": { "lower": 0.0, "upper": 1312.2810998535142 },
"dst_port": { "lower": 0.0, "upper": 63375.0 },
"protocol": { "lower": 0.0, "upper": 17.0 },
"psh_flag_cnt": { "lower": 0.0, "upper": 1.0 },
"ack_flag_cnt": { "lower": 0.0, "upper": 1.0 },
"syn_flag_cnt": { "lower": 0.0, "upper": 1.0 },
"fin_flag_cnt": { "lower": 0.0, "upper": 1.0 },
"rst_flag_cnt": { "lower": 0.0, "upper": 0.0 },
"pkt_len_std": { "lower": 0.0, "upper": 1051.5718536376853 },
"fwd_pkt_len_std": { "lower": 0.0, "upper": 227.21978759765625 },
"bwd_pkt_len_std": { "lower": 0.0, "upper": 777.4441128540009 },
"fwd_seg_size_min": { "lower": 0.0, "upper": 1902198.5299999905 },
"fwd_act_data_pkts": { "lower": 0.0, "upper": 3.0 },
"fwd_iat_std": { "lower": 0.0, "upper": 4873774.342499985 },
"bwd_iat_std": { "lower": 0.0, "upper": 4677281.179999962 },
"flow_iat_std": { "lower": 0.0, "upper": 4679977.562499992 },
"fwd_bwd_bytes_ratio": { "lower": 0.0, "upper": 1.0 },
"pkt_len_variance": { "lower": 0.0, "upper": 483294.3096875 },
"fwd_iat_skewness": { "lower": 0.0, "upper": 0.0 }
"flow_duration": {
"lower": 0.0,
"upper": 115669365.2
},
"fwd_packets": {
"lower": 0.0,
"upper": 120.0
},
"bwd_packets": {
"lower": 0.0,
"upper": 126.0
},
"fwd_bytes": {
"lower": 0.0,
"upper": 19557.400390625
},
"bwd_bytes": {
"lower": 0.0,
"upper": 85164.0
},
"flow_bytes_per_sec": {
"lower": 0.0,
"upper": 1627586.8125000005
},
"flow_pkts_per_sec": {
"lower": 0.0,
"upper": 23809.5234375
},
"fwd_win_bytes": {
"lower": 0.0,
"upper": 65280.0
},
"bwd_win_bytes": {
"lower": 0.0,
"upper": 65535.0
},
"fwd_pkt_len_mean": {
"lower": 0.0,
"upper": 1500.0
},
"bwd_pkt_len_mean": {
"lower": 0.0,
"upper": 822.0007794189461
},
"fwd_iat_mean": {
"lower": 0.0,
"upper": 54051113.24
},
"bwd_iat_mean": {
"lower": 0.0,
"upper": 6912790.715000001
},
"flow_iat_mean": {
"lower": 0.0,
"upper": 166521472.0
},
"pkt_len_mean": {
"lower": 0.0,
"upper": 957.2035284423835
},
"dst_port": {
"lower": 0.0,
"upper": 63005.0
},
"protocol": {
"lower": 0.0,
"upper": 17.0
},
"psh_flag_cnt": {
"lower": 0.0,
"upper": 52.0
},
"ack_flag_cnt": {
"lower": 0.0,
"upper": 107.0
},
"syn_flag_cnt": {
"lower": 0.0,
"upper": 4.0
},
"fin_flag_cnt": {
"lower": 0.0,
"upper": 1.0
},
"rst_flag_cnt": {
"lower": 0.0,
"upper": 0.0
},
"pkt_len_std": {
"lower": 0.0,
"upper": 818.4579974365238
},
"fwd_pkt_len_std": {
"lower": 0.0,
"upper": 256.8401712036142
},
"bwd_pkt_len_std": {
"lower": 0.0,
"upper": 676.0667114257812
},
"fwd_seg_size_min": {
"lower": 0.0,
"upper": 1026743.0693750025
},
"fwd_act_data_pkts": {
"lower": 0.0,
"upper": 12.0
},
"fwd_iat_std": {
"lower": 0.0,
"upper": 6691987.085000001
},
"bwd_iat_std": {
"lower": 0.0,
"upper": 5136363.065000001
},
"fwd_bwd_bytes_ratio": {
"lower": 0.0,
"upper": 1.0
},
"iat_cv": {
"lower": 0.0,
"upper": 0.0
}
},
"ae_scaler_mean": [
553573.8261433974, 5.537481338484507, 4.545714712966507,
732.9122877032092, 1594.293060562387, 14524.457216310835,
408.40078292070046, 5041.6718942499765, 8858.56079223287,
293.4158400234335, 68.50546049610982, 48053.28191342106,
39629.174786987496, 2756276.585577172, 24.55453629422013,
13882.541797179327, 9.155290259001973, 0.02040285405796568,
0.04693573572753199, 0.009265432030886539, 0.005048852822986429,
0.0, 23.07985361268022, 2.8912962051498923, 10.050823938165351,
21807.221235950656, 0.027325504830147902, 47055.31297750816,
37633.95415201727, 49435.96380716072, 0.5572453787198782,
5243.747976892553, 0.0
1775639.8280735926,
5.542641564702501,
4.873551306800804,
673.3628917399571,
1776.7162625946232,
22595.98254433581,
457.7205079100132,
5370.204067202503,
9979.409366405764,
310.21111530262294,
64.0225296706552,
421007.8046985764,
74954.24060464761,
1927814.4699678936,
18.27810422291583,
10009.108501605231,
9.275900254913996,
0.6270530398000678,
1.4141691028300247,
0.08438195832759936,
0.0413846397252831,
0.0,
20.458150398533718,
3.321724142251631,
13.033036407393814,
8569.843223681366,
0.21485243990919378,
94146.99057411935,
68775.38334652747,
0.47595050130443944,
0.0
],
"ae_scaler_std": [
5769069.210865143, 12.731563443887879, 12.145072707978656,
2227.8956432424648, 7544.580451556596, 131574.08066204368,
3062.4073062866864, 11584.347904359805, 19321.807845687003,
456.85162824410736, 84.09080802725346, 457034.0398467031,
414969.2560970854, 21002348.667211507, 134.6784018236429,
20905.109391832277, 5.217401538588734, 0.13728916522249587,
0.21092403535986087, 0.09575684583550836, 0.07080745853335217,
1.0, 123.51344190707131, 22.368753242426347, 79.86295403283017,
173264.80375874366, 0.25736117191332675, 435636.77402945235,
389941.84503591515, 432399.5330873597, 0.3392136503327526,
44261.86086917189, 1.0
12196313.175317517,
13.15004546194127,
13.245688945052057,
1969.9160973703263,
8250.018585629565,
161540.2407042193,
2518.5714986775442,
12103.605209582642,
20308.80085611352,
476.8868336260097,
95.72217224515282,
4199427.656867863,
616719.9756782106,
16437665.614047276,
97.4688620675193,
18194.33523865822,
5.182633726939228,
4.994559084102198,
10.431975160428792,
0.558462828085695,
0.19916731632770637,
1.0,
106.06236469581468,
24.362268530572912,
85.37603561474889,
84340.18813365103,
1.4442281045462682,
646928.7442307192,
525550.9737726098,
0.3431291415218137,
1.0
],
"ae_post_clip_min": -5.0,
"ae_post_clip_max": 5.0,
"ae_threshold": 0.23287349939346313,
"ae_threshold": 0.23011694848537445,
"classifier_feature_names": [
"flow_duration",
"fwd_packets",
@ -128,25 +257,30 @@
"fwd_act_data_pkts",
"fwd_iat_std",
"bwd_iat_std",
"flow_iat_std",
"fwd_bwd_bytes_ratio",
"pkt_len_variance",
"fwd_iat_skewness",
"iat_cv",
"ae_anomaly_score"
],
"attack_labels": {
"0": "Brute Force",
"1": "C2 Communication",
"2": "Cryptomining",
"3": "DoS/DDoS",
"4": "Exploitation",
"5": "Normal",
"6": "Reconnaissance"
"0": "Bot",
"1": "Brute Force",
"2": "C2 Communication",
"3": "DNS Tunneling",
"4": "DoS\/DDoS",
"5": "Exploitation",
"6": "Malware",
"7": "Normal",
"8": "Reconnaissance",
"9": "Web Attack"
},
"anomaly_threshold": 0.5,
"c2_threshold": 0.5,
"anomaly_threshold": 0.9179317355155945,
"c2_threshold": 0.9085615873336792,
"model_type": "MultiTaskModel",
"output_names": ["anomaly", "class_probs", "c2_score"],
"output_names": [
"anomaly",
"class_probs",
"c2_score"
],
"ae_feature_weights": {
"flow_duration": 1.0,
"fwd_packets": 1.0,
@ -177,9 +311,7 @@
"fwd_act_data_pkts": 1.0,
"fwd_iat_std": 1.5,
"bwd_iat_std": 1.5,
"flow_iat_std": 0.1,
"fwd_bwd_bytes_ratio": 2.0,
"pkt_len_variance": 0.1,
"fwd_iat_skewness": 0.1
"iat_cv": 2.0
}
}
}

2
net-guardia-trainer

@ -1 +1 @@
Subproject commit 1f5cbb8b9ba69a5bd16cc15055c230715d6bb9ae
Subproject commit 344747288ec264a83997299a636959c4fe5989ef

6
net-guardia/src/core/ml/aggregator.rs
View File

@ -28,11 +28,11 @@ impl AttackAggregator {
detections.push((now, score));
// Per-attack-type adaptive min_detections:
// DDoS/DoS: high frequency, need more confirmations to avoid alert storms
// C2/Cryptomining: low frequency, alert on first detection
// DoS/DDoS: high frequency, need more confirmations to avoid alert storms
// C2/Bot/DNS Tunneling: low frequency, alert on first detection
let effective_min = match attack_type {
Some("DoS/DDoS") => self.min_detections.saturating_mul(2).max(1),
Some("C2 Communication") | Some("Cryptomining") => 1,
Some("C2 Communication") | Some("Bot") | Some("DNS Tunneling") => 1,
_ => self.min_detections,
};

8
net-guardia/src/core/system.rs
View File

@ -11,7 +11,6 @@ use crate::core::config_service::ConfigService;
use crate::core::dns_filter_service::DnsFilterService;
use crate::core::ebpf::EbpfServices;
use crate::core::email::scheduler::ReportScheduler;
use crate::model::system::config::MLInferenceConfig;
use crate::core::ml::drift_detector::DriftDetector;
use crate::core::notification_service::NotificationService;
use crate::core::playbook_service::PlaybookService;
@ -26,13 +25,14 @@ use crate::infrastructure::geoip::GeoIpService;
use crate::infrastructure::http_server::HttpServerParams;
use crate::infrastructure::secret_store::SecretStore;
use crate::infrastructure::service_factory::ServiceFactory;
use crate::model::detection::ml_detection::AlertMessage;
use crate::model::error::Error;
use crate::model::error::system::SystemError;
use crate::model::event::{DetectionEvent, DetectionSource, DriftDetectedEvent};
use crate::model::log::detection::DetectionLog;
use crate::model::log::ml::MLLog;
use crate::model::log::system::SystemLog;
use crate::model::detection::ml_detection::AlertMessage;
use crate::model::system::config::MLInferenceConfig;
use crate::model::system::readiness::ReadinessState;
/// API-triggered shutdown mode.
@ -346,9 +346,9 @@ impl System {
match raw {
"Brute Force" => "brute_force".to_string(),
"C2 Communication" => "c2_communication".to_string(),
"Cryptomining" => "cryptomining".to_string(),
"DoS/DDoS" => "threat_detected".to_string(),
"Exploitation" => "threat_detected".to_string(),
"Exploitation" | "Malware" | "Web Attack" => "threat_detected".to_string(),
"Bot" | "DNS Tunneling" => "threat_detected".to_string(),
"Reconnaissance" => "port_scan".to_string(),
"Normal" => "normal".to_string(),
other => {