code_public/ja4-platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ml): replace Autoencoder with RealNVP Normalizing Flow and add SessionTransformer embeddings

Browse Source 
Replace TrafficAutoEncoder (MSE reconstruction scoring) with TrafficNormalizingFlow
(RealNVP via FrEIA, 4 affine coupling blocks, anomaly score = -log p(x)) for
mathematically rigorous density estimation. Add SessionTransformer module producing
32-dimensional sequence embeddings from raw HTTP request sequences (path, method,
timing) via a lightweight TransformerEncoder, replacing path_transition_entropy and
cadence_cv features. Update thesis documentation sections 2.4.2b and 3.8 accordingly.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Jacquin Antoine
2026-04-13 15:11:21 +02:00
parent 0e5f94dd0d
commit c1821dcbc4
14 changed files with 515 additions and 3590 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
docs/services/bot-detector.md
View File

@ -430,8 +430,7 @@ Chaque anomalie reçoit un `campaign_id` (−1 = pas de cluster).
| Feature | Description |
|---------|-------------|
| `path_transition_entropy` | Entropie des transitions de chemins (§5.1) |
| `cadence_cv` | Coefficient de variation de la cadence de requêtes (§5.3) |
| `seq_emb_0`..`seq_emb_31` | Embeddings séquentiels via Transformer (§5.2, remplace path_transition_entropy + cadence_cv) |
| `burst_ratio` | Fraction de requêtes en rafale (§5.3) |
| `pause_ratio` | Fraction de pauses longues (§5.3) |
| `lag1_autocorrelation` | Autocorrélation lag-1 des inter-arrivées (§5.3) |