mirror of
https://github.com/DaLaw2/NetGuardia.git
synced 2026-08-24 22:20:28 +09:00
75 lines
2.1 KiB
YAML
75 lines
2.1 KiB
YAML
# NetGuardia model manifest. Structural/semantic fields live here;
|
|
# preprocessing arrays (scaler mean/std, clip params, feature weights) stay
|
|
# in the JSON sidecar referenced by `preprocessing.scaler_sidecar`.
|
|
|
|
name: netguardia-v10
|
|
adapter: multi_task
|
|
|
|
models:
|
|
autoencoder: deep_autoencoder.onnx
|
|
classifier: classifier.onnx
|
|
|
|
# 31 AE-input features. Order matters — must match ONNX input column order
|
|
# and inference_config.json `ae_feature_names`. The classifier takes these
|
|
# plus `ae_anomaly_score` appended as the 32nd input (handled in code).
|
|
features:
|
|
- flow_duration
|
|
- fwd_packets
|
|
- bwd_packets
|
|
- fwd_bytes
|
|
- bwd_bytes
|
|
- flow_bytes_per_sec
|
|
- flow_pkts_per_sec
|
|
- fwd_win_bytes
|
|
- bwd_win_bytes
|
|
- fwd_pkt_len_mean
|
|
- bwd_pkt_len_mean
|
|
- fwd_iat_mean
|
|
- bwd_iat_mean
|
|
- flow_iat_mean
|
|
- pkt_len_mean
|
|
- dst_port
|
|
- protocol
|
|
- psh_flag_cnt
|
|
- ack_flag_cnt
|
|
- syn_flag_cnt
|
|
- fin_flag_cnt
|
|
- rst_flag_cnt
|
|
- pkt_len_std
|
|
- fwd_pkt_len_std
|
|
- bwd_pkt_len_std
|
|
- fwd_seg_size_min
|
|
- fwd_act_data_pkts
|
|
- fwd_iat_std
|
|
- bwd_iat_std
|
|
- fwd_bwd_bytes_ratio
|
|
- iat_cv
|
|
|
|
# `confirmations` sets the per-class aggregator firing threshold. Classes
|
|
# with single-shot semantics (C2 / Bot / DNS tunneling / exploit) use 1 so
|
|
# the aggregator alerts on the first detection; noisier classes can raise
|
|
# it (DoS/DDoS: 2). Absent entries fall back to the engine default.
|
|
labels:
|
|
"0": { name: Bot, confirmations: 1 }
|
|
"1": { name: Brute Force }
|
|
"2": { name: C2 Communication, confirmations: 1 }
|
|
"3": { name: DNS Tunneling, confirmations: 1 }
|
|
"4": { name: DoS/DDoS, confirmations: 2 }
|
|
"5": { name: Exploitation, confirmations: 1 }
|
|
"6": { name: Malware }
|
|
"7": { name: Normal }
|
|
"8": { name: Reconnaissance }
|
|
"9": { name: Web Attack }
|
|
|
|
thresholds:
|
|
anomaly: 0.9179317355155945
|
|
c2: 0.9085615873336792
|
|
class_min_confidence: 0.4
|
|
ae: 0.23011694848537445
|
|
# Average score must exceed `class_min_confidence * alert_multiplier`
|
|
# before the aggregator fires. Raising this suppresses borderline hits.
|
|
alert_multiplier: 1.2
|
|
|
|
preprocessing:
|
|
scaler_sidecar: inference_config.json
|