diff --git a/services/bot-detector/bot_detector/config.py b/services/bot-detector/bot_detector/config.py
index 3d9256d..10c8746 100644
--- a/services/bot-detector/bot_detector/config.py
+++ b/services/bot-detector/bot_detector/config.py
@@ -109,7 +109,8 @@ STRUCTURAL_EXCLUDED_FEATURES: dict[str, list] = {
'request_size_variance', 'mss_mobile_mismatch',
'ja3_diversity_ratio', 'syn_timing_cv', 'tls12_ratio', 'ip_df_variance',
'avg_ttl', 'ttl_std', 'no_window_scale_ratio',
- 'ja4_drift_ratio'],
+ 'ja4_drift_ratio',
+ 'true_window_size', 'window_mss_ratio'],
}
# ─── Imports optionnels (bibliothèques lourdes) ────────────────────────────
diff --git a/services/bot-detector/bot_detector/pipeline.py b/services/bot-detector/bot_detector/pipeline.py
index d62f2a8..a61b5bf 100644
--- a/services/bot-detector/bot_detector/pipeline.py
+++ b/services/bot-detector/bot_detector/pipeline.py
@@ -306,6 +306,23 @@ def run_semi_supervised_logic(df, features, name, cycle_id, recurrence_map):
if ENABLE_CLUSTERING:
anomalies = cluster_anomalies(anomalies, scoring_features, ae_model=ae_model)
+ # P2 — Escalade par taille de campagne : les IPs dans un cluster
+ # coordonné de grande taille sont plus menaçantes que des IPs isolées.
+ # Escalader HIGH → CRITICAL si cluster_size ≥ 5.
+ if 'campaign_id' in anomalies.columns:
+ cid_counts = anomalies['campaign_id'].value_counts()
+ for cid, size in cid_counts.items():
+ if cid < 0:
+ continue
+ if size >= 5:
+ mask = (anomalies['campaign_id'] == cid) & (anomalies['threat_level'] == 'HIGH')
+ n_escalated = mask.sum()
+ if n_escalated > 0:
+ anomalies.loc[mask, 'threat_level'] = 'CRITICAL'
+ anomalies.loc[mask, 'reason'] = anomalies.loc[mask, 'reason'] + \
+ f' [Escalade campagne #{cid}, {size} IPs coordonnées]'
+ log_info(f"[{name}] Escalade campagne #{cid}: {n_escalated} IP(s) HIGH→CRITICAL ({size} membres)")
+
anomalies['ja4'] = anomalies['ja4'].replace({'': 'HTTP_CLEAR_TEXT'})
for _, row in anomalies.iterrows():
log_decision('ANOMALY', cycle_id, name, {
@@ -330,6 +347,14 @@ def run_semi_supervised_logic(df, features, name, cycle_id, recurrence_map):
anubis_deny if not anubis_deny.empty else None,
] if df is not None], ignore_index=True)
+ # Propager campaign_id des anomalies clusterisées vers all_scored
+ # (all_scored a été capturé avant clustering, ses campaign_id sont tous -1)
+ if not anomalies.empty and 'campaign_id' in anomalies.columns:
+ cid_map = anomalies.set_index(anomalies.index)['campaign_id']
+ matched = all_scored.index.isin(cid_map.index)
+ if matched.any():
+ all_scored.loc[matched, 'campaign_id'] = cid_map
+
# Inclure anubis_allow dans all_scored pour traçabilité dans ml_all_scores.
# Ces IPs sont exclues de l'analyse IF mais doivent apparaître dans la table
# de scores avec threat_level='KNOWN_BOT' et anomaly_score=0.0.
diff --git a/services/bot-detector/bot_detector/preprocessing.py b/services/bot-detector/bot_detector/preprocessing.py
index 4adf085..d55ddc7 100644
--- a/services/bot-detector/bot_detector/preprocessing.py
+++ b/services/bot-detector/bot_detector/preprocessing.py
@@ -41,6 +41,12 @@ FEATURES = [
'cadence_cv', 'burst_ratio', 'pause_ratio',
'lag1_autocorrelation', 'benford_deviation',
'host_diversity', 'host_sweep_speed', 'host_coverage_uniformity',
+ # P0+P1 : features sous-exploitées (SQL existant ou ajouté)
+ 'is_fake_navigation',
+ 'true_window_size', 'window_mss_ratio',
+ # P1 : nouvelles features de détection
+ 'has_xff', 'unusual_content_type_ratio', 'non_standard_port_ratio',
+ 'login_post_concentration', 'sec_ch_mobile_mismatch',
]
# Features supplémentaires pour le modèle Complet (données TCP/TLS requises)
@@ -100,6 +106,7 @@ def preprocess_df(df: pd.DataFrame) -> pd.DataFrame:
'has_accept_language', 'has_cookie', 'has_referer', 'ua_ch_mismatch',
'is_ua_rotating', 'is_alpn_missing', 'sni_host_mismatch', 'alpn_http_mismatch',
'mss_mobile_mismatch', 'anubis_is_flagged', 'is_rare_ja4',
+ 'is_fake_navigation', 'has_xff', 'sec_ch_mobile_mismatch',
}
for col in df.columns:
if col in binary_features:
diff --git a/services/correlator/sql/migrations/02_detection_features.sql b/services/correlator/sql/migrations/02_detection_features.sql
new file mode 100644
index 0000000..cf82863
--- /dev/null
+++ b/services/correlator/sql/migrations/02_detection_features.sql
@@ -0,0 +1,17 @@
+-- =============================================================================
+-- 02_detection_features.sql — Ajout des features de détection P0+P1
+-- Colonnes supplémentaires dans agg_host_ip_ja4_1h et agg_header_fingerprint_1h
+-- NOTE : les MVs doivent être recréées (DROP + CREATE) car ALTER VIEW n'existe pas.
+-- Exécuter deploy_schema.sh pour recréer les MVs, ou relancer le schema complet.
+-- =============================================================================
+
+-- agg_host_ip_ja4_1h : nouvelles colonnes de comptage
+ALTER TABLE ja4_processing.agg_host_ip_ja4_1h
+ ADD COLUMN IF NOT EXISTS count_xff SimpleAggregateFunction(sum, UInt64) AFTER count_http_scheme,
+ ADD COLUMN IF NOT EXISTS count_unusual_ct SimpleAggregateFunction(sum, UInt64) AFTER count_xff,
+ ADD COLUMN IF NOT EXISTS count_non_std_port SimpleAggregateFunction(sum, UInt64) AFTER count_unusual_ct,
+ ADD COLUMN IF NOT EXISTS count_login_post SimpleAggregateFunction(sum, UInt64) AFTER count_non_std_port;
+
+-- agg_header_fingerprint_1h : mismatch mobile Sec-CH-UA
+ALTER TABLE ja4_processing.agg_header_fingerprint_1h
+ ADD COLUMN IF NOT EXISTS sec_ch_mobile_mismatch SimpleAggregateFunction(max, UInt8) AFTER ua_ch_mismatch;
diff --git a/services/dashboard/backend/routes/pages.py b/services/dashboard/backend/routes/pages.py
index 0e28ba7..511324d 100644
--- a/services/dashboard/backend/routes/pages.py
+++ b/services/dashboard/backend/routes/pages.py
@@ -71,3 +71,8 @@ async def ja4_detail_page(request: Request, fingerprint: str):
@router.get("/cluster/{cid}")
async def cluster_detail_page(request: Request, cid: int):
return templates.TemplateResponse("cluster_detail.html", _ctx(request, "cluster_detail", cid=cid))
+
+
+@router.get("/tactics")
+async def tactics_page(request: Request):
+ return templates.TemplateResponse("tactics.html", _ctx(request, "tactics"))
diff --git a/services/dashboard/backend/templates/base.html b/services/dashboard/backend/templates/base.html
index b1bbddf..df4ce41 100644
--- a/services/dashboard/backend/templates/base.html
+++ b/services/dashboard/backend/templates/base.html
@@ -151,6 +151,10 @@
Campagnes
+
+
+ Tactiques
+
Investigation
@@ -324,6 +328,10 @@
if (diff < 86400) return Math.round(diff/3600) + 'h';
return Math.round(diff/86400) + 'j';
}
+ function fmtDate(d) {
+ if (!d) return '—';
+ return String(d).substring(0, 16).replace('T', ' ');
+ }
// ── ECharts helpers ──
const EC_COLORS = ['#6366f1','#22c55e','#f97316','#ef4444','#3b82f6','#eab308','#ec4899','#14b8a6','#8b5cf6','#f43f5e'];
diff --git a/services/dashboard/backend/templates/tactics.html b/services/dashboard/backend/templates/tactics.html
new file mode 100644
index 0000000..03b1470
--- /dev/null
+++ b/services/dashboard/backend/templates/tactics.html
@@ -0,0 +1,199 @@
+{% extends "base.html" %}
+{% block page_title %}Tactiques d'attaque{% endblock %}
+
+{% block content %}
+
+
+
+
+
+
+
+
+
+
+
+ | IP | Host | POST/h | Paths distincts | Première vue | Dernière vue |
|---|
+ | Chargement… |
+
+
+
+
+
+
+
+
+ | IP | Host | JA4 distincts | Fingerprints | Hits | Fenêtre |
|---|
+ | Chargement… |
+
+
+
+
+
+
+
+
+ | IP | Récurrence | Pire score | Pire menace | Première vue | Dernière vue | JA4 top | Host top |
|---|
+ | Chargement… |
+
+
+
+
+
+
+
+
+ | Date | IP | Score | Menace | JA4 | Host | ASN | Hits | Raison |
|---|
+ | Chargement… |
+
+
+
+