NetGuardia/models/manifest.yaml

name: netguardia-v1
version: 1

runtime:
  pipeline_mode: dag
  normal_label: Normal

artifacts:
  - id: anomaly_detector_onnx
    file: deep_autoencoder.onnx
    kind: onnx
  - id: classifier_onnx
    file: classifier.onnx
    kind: onnx
  - id: preprocessing_sidecar
    file: inference_config.json
    kind: sidecar

stages:
  - id: anomaly_detector
    kind: autoencoder
    model_file: deep_autoencoder.onnx
    inputs:
      - { name: flow_duration, source: feature }
      - { name: fwd_packets, source: feature }
      - { name: bwd_packets, source: feature }
      - { name: fwd_bytes, source: feature }
      - { name: bwd_bytes, source: feature }
      - { name: flow_bytes_per_sec, source: feature }
      - { name: flow_pkts_per_sec, source: feature }
      - { name: fwd_win_bytes, source: feature }
      - { name: bwd_win_bytes, source: feature }
      - { name: fwd_pkt_len_mean, source: feature }
      - { name: bwd_pkt_len_mean, source: feature }
      - { name: fwd_iat_mean, source: feature }
      - { name: bwd_iat_mean, source: feature }
      - { name: flow_iat_mean, source: feature }
      - { name: pkt_len_mean, source: feature }
      - { name: dst_port, source: feature }
      - { name: protocol, source: feature }
      - { name: psh_flag_cnt, source: feature }
      - { name: ack_flag_cnt, source: feature }
      - { name: syn_flag_cnt, source: feature }
      - { name: fin_flag_cnt, source: feature }
      - { name: rst_flag_cnt, source: feature }
      - { name: pkt_len_std, source: feature }
      - { name: fwd_pkt_len_std, source: feature }
      - { name: bwd_pkt_len_std, source: feature }
      - { name: fwd_seg_size_min, source: feature }
      - { name: fwd_act_data_pkts, source: feature }
      - { name: fwd_iat_std, source: feature }
      - { name: bwd_iat_std, source: feature }
      - { name: fwd_bwd_bytes_ratio, source: feature }
      - { name: iat_cv, source: feature }
    preprocessing:
      - type: standard_scaler
        sidecar: inference_config.json
      - type: clip
        min: -5.0
        max: 5.0
    output_heads:
      - name: ae_anomaly_score
        index: 0
        shape: [1]
        semantic: anomaly_score
        threshold: 0.23011694848537445

  - id: classifier
    kind: classifier
    model_file: classifier.onnx
    depends_on:
      - anomaly_detector
    inputs:
      - { name: flow_duration, source: feature }
      - { name: fwd_packets, source: feature }
      - { name: bwd_packets, source: feature }
      - { name: fwd_bytes, source: feature }
      - { name: bwd_bytes, source: feature }
      - { name: flow_bytes_per_sec, source: feature }
      - { name: flow_pkts_per_sec, source: feature }
      - { name: fwd_win_bytes, source: feature }
      - { name: bwd_win_bytes, source: feature }
      - { name: fwd_pkt_len_mean, source: feature }
      - { name: bwd_pkt_len_mean, source: feature }
      - { name: fwd_iat_mean, source: feature }
      - { name: bwd_iat_mean, source: feature }
      - { name: flow_iat_mean, source: feature }
      - { name: pkt_len_mean, source: feature }
      - { name: dst_port, source: feature }
      - { name: protocol, source: feature }
      - { name: psh_flag_cnt, source: feature }
      - { name: ack_flag_cnt, source: feature }
      - { name: syn_flag_cnt, source: feature }
      - { name: fin_flag_cnt, source: feature }
      - { name: rst_flag_cnt, source: feature }
      - { name: pkt_len_std, source: feature }
      - { name: fwd_pkt_len_std, source: feature }
      - { name: bwd_pkt_len_std, source: feature }
      - { name: fwd_seg_size_min, source: feature }
      - { name: fwd_act_data_pkts, source: feature }
      - { name: fwd_iat_std, source: feature }
      - { name: bwd_iat_std, source: feature }
      - { name: fwd_bwd_bytes_ratio, source: feature }
      - { name: iat_cv, source: feature }
      - name: ae_anomaly_score
        source: stage_output
        stage: anomaly_detector
        output: ae_anomaly_score
    output_heads:
      - name: anomaly
        index: 0
        shape: [1]
        semantic: binary
        threshold: 0.9179317355155945
      - name: class_probs
        index: 1
        shape: [10]
        semantic: multiclass
        min_confidence: 0.4
      - name: c2_score
        index: 2
        shape: [1]
        semantic: binary
        threshold: 0.9085615873336792

outputs:
  - stage: anomaly_detector
    output: ae_anomaly_score
    alias: ae_anomaly_score
    role: anomaly_score
  - stage: classifier
    output: anomaly
    alias: anomaly
    role: binary_score
  - stage: classifier
    output: class_probs
    alias: class_probs
    role: class_probabilities
  - stage: classifier
    output: c2_score
    alias: c2_score
    role: c2_score

detection_rules:
  - id: classifier_anomaly_threshold
    type: threshold
    output: anomaly
    attack:
      source: predicted_class
      output: class_probs
      exclude_normal: true
  - id: class_confidence
    type: class_confidence
    output: class_probs
    attack:
      source: predicted_class
      output: class_probs
      exclude_normal: true
  - id: c2_threshold
    type: threshold
    output: c2_score
    attack:
      source: fixed_label
      label: C2 Communication

labels:
  "0": { name: Bot, confirmations: 1 }
  "1": { name: Brute Force }
  "2": { name: C2 Communication, confirmations: 1 }
  "3": { name: DNS Tunneling, confirmations: 1 }
  "4": { name: DoS/DDoS, confirmations: 2 }
  "5": { name: Exploitation, confirmations: 1 }
  "6": { name: Malware }
  "7": { name: Normal }
  "8": { name: Reconnaissance }
  "9": { name: Web Attack }

alert_rules:
  - condition: "anomaly > threshold"
    source_label: anomaly
  - condition: "class_probs.argmax != Normal AND class_probs.max > min_confidence"
    source_label: class_probs