|
|
c1821dcbc4
|
feat(ml): replace Autoencoder with RealNVP Normalizing Flow and add SessionTransformer embeddings
Replace TrafficAutoEncoder (MSE reconstruction scoring) with TrafficNormalizingFlow
(RealNVP via FrEIA, 4 affine coupling blocks, anomaly score = -log p(x)) for
mathematically rigorous density estimation. Add SessionTransformer module producing
32-dimensional sequence embeddings from raw HTTP request sequences (path, method,
timing) via a lightweight TransformerEncoder, replacing path_transition_entropy and
cadence_cv features. Update thesis documentation sections 2.4.2b and 3.8 accordingly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
2026-04-13 15:11:21 +02:00 |
|
|
|
039086a0b3
|
feat: nouvelles techniques de détection et page tactiques SOC
SQL:
- Ajout 5 colonnes d'agrégation (count_xff, count_unusual_ct,
count_non_std_port, count_login_post, sec_ch_mobile_mismatch)
- Exposition de 5 features calculées dans view_ai_features_1h
- Migration ALTER TABLE pour déploiements existants
Bot-detector:
- 7 nouvelles features ML (has_xff, unusual_content_type_ratio,
non_standard_port_ratio, login_post_concentration,
sec_ch_mobile_mismatch, true_window_size, window_mss_ratio)
- Propagation campaign_id vers ml_all_scores (était toujours -1)
- Escalade campagne : HIGH→CRITICAL si cluster ≥5 membres
Dashboard:
- Page Tactiques SOC : brute-force, rotation JA4, récurrence,
alertes temps réel — 4 KPIs + 4 panneaux + infobulles doc
- Ajout fmtDate() helper global
- Navigation sidebar mise à jour
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
2026-04-09 14:29:18 +02:00 |
|
|
|
1f103392ac
|
refactor(bot-detector): extract monolith into modular package
Split bot_detector.py (~1982 lines) into 10 focused modules:
- config.py: all configuration constants and optional imports
- log.py: logging utilities (log_info, log_decision, append_training_history)
- infra.py: ClickHouse client, health check HTTP server, shutdown
- browser.py: multifactorial browser identification (5 axes)
- scoring.py: drift detection, feature validation, SHAP, clustering
- models.py: EIF, Autoencoder, XGBoost model management
- preprocessing.py: data preprocessing and feature list definitions
- pipeline.py: core semi-supervised scoring loop
- cycle.py: main analysis cycle orchestration
- __main__.py: entry point with startup banner
Update Dockerfile to copy package directory and use python -m bot_detector.
All 36 existing tests pass unchanged.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
2026-04-09 01:02:04 +02:00 |
|
