Skip to content

Security Anomaly ML v0.1.0

Latest
Latest

Choose a tag to compare

View all tags
@ibondarenko1 ibondarenko1 released this 20 Aug 07:45
· 5 commits to main since this release
v0.1.0
bf70792
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

First usable public release of the label-free network-flow anomaly detection pipeline.

Security Anomaly ML converts unlabeled CICFlowMeter-compatible flows into deterministic, promoted analyst-facing incidents. This is a usable research/evaluation release, not a production-ready IDS or SOC replacement.

Run it

docker pull ghcr.io/ibondarenko1/security-anomaly-ml:0.1.0

docker run --rm --network none \
  -v $PWD:/data \
  ghcr.io/ibondarenko1/security-anomaly-ml:0.1.0 \
  analyze /data/flows.csv --output /data/incidents.jsonl

Immutable image:

ghcr.io/ibondarenko1/security-anomaly-ml@sha256:941872e8b208f7dfdf7072dc2d40c3b9290578e2aac35d326b22a2ddf8d0fb1d

What ships

  • label-free Python CLI and non-root offline-capable Docker image
  • frozen context-rf-v2 detector
  • cicflow-v2-128 causal temporal feature processing
  • deterministic Policy B incident aggregation
  • versioned incident-v1 JSONL output
  • deterministic synthetic regression fixture
  • public CI and pinned dependency audit

Docker includes the verified model. Python wheel users obtain the separate context-rf-v2.joblib asset from the immutable model release.

Model SHA-256: 4730a06506d8c5f2af93679c492e1544b3c2b11acd16fe74120d64d4dbfc5c72

Validation

Locked temporal holdout metric Result
Flow recall 98.3686%
Flow precision 67.5499%
Flow FPR 2.1190%
PR-AUC 0.898915
Aggregated incident recall 99.9917%
Promoted incident recall 99.9339%
Promoted incident precision 93.46%
Flow-alert to incident reduction 83.80%
FP-object reduction 96.74%

Verdict: acceptable but operationally noisy. Evaluation used one locked future capture day from an overlapping environment/network family. It does not establish production readiness or generalization across arbitrary networks.

Known limitations

  • CICFlowMeter-compatible CSV input only
  • Python 3.13 frozen serialization environment
  • batch mode; no streaming service or API
  • timezone-naive source timestamps
  • single-network-family validation
  • uncalibrated attack ranking score
  • remaining workload is too high for normal Tier-1 production use

Release commit: bf7079291519128238f6540f8494b5c02728d59d

Assets 5
Loading