code_public/ja4-platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ml): replace Autoencoder with RealNVP Normalizing Flow and add SessionTransformer embeddings

Browse Source 
Replace TrafficAutoEncoder (MSE reconstruction scoring) with TrafficNormalizingFlow
(RealNVP via FrEIA, 4 affine coupling blocks, anomaly score = -log p(x)) for
mathematically rigorous density estimation. Add SessionTransformer module producing
32-dimensional sequence embeddings from raw HTTP request sequences (path, method,
timing) via a lightweight TransformerEncoder, replacing path_transition_entropy and
cadence_cv features. Update thesis documentation sections 2.4.2b and 3.8 accordingly.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Jacquin Antoine
2026-04-13 15:11:21 +02:00
parent 0e5f94dd0d
commit c1821dcbc4
14 changed files with 515 additions and 3590 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
docs/thesis/03_architecture.md
View File

@ -68,10 +68,10 @@
│ │ 3. browser_matcher scoring │ │
│ │ 3b. dynamic H2 profiling scoring │ │
│ │ 4. EIF bifurqué (complet/appli) │ │
│ │ 5. AE reconstruction scoring │ │
│ │ 5. NF log-likelihood scoring │ │
│ │ 6. XGBoost probabilité │ │
│ │ 7. Fusion LR fusion │ │
│ │ 8. HDBSCAN clustering (AE latent) │ │
│ │ 8. HDBSCAN clustering (NF latent) │ │
│ │ 9. Écriture résultats ClickHouse │ │
│ └──────────────────────────────────┘ │
└─────────┬─────────────────────────────┘
@ -240,7 +240,7 @@ Session entrante
├── asn_label == 'human' ?
│ ── OUI → baseline EIF training (sans étiquette bot)
│
└── Sinon → Triple-voix : EIF + AE + XGBoost + Fusion LR
└── Sinon → Triple-voix : EIF + NF + XGBoost + Fusion LR
```
#### Seuil adaptatif
@ -257,7 +257,7 @@ La valeur `percentile_5` du historique des scores négatifs (anomalies confirmé
|--------|----------|-------------------|------------|
| EIF Complet | ≈ 45 features L3→L7 | Données L3/L4 disponibles | eif_score_full |
| EIF Applicatif | ≈ 35 features L7 | L3/L4 absentes (CDN/proxy) | eif_score_app |
| AE | Même dimensionnalité que EIF actif | Toutes sessions | ae_reconstruction_error |
| NF | Même dimensionnalité que EIF actif | Toutes sessions | nf_log_likelihood |
| XGBoost | Ensemble complet 96 features | Toutes sessions | xgb_probability |
#### Niveaux de sévérité