IntraSpanNet v0.1.0

Technical report

The paper is at paper/IntraSpanNet.pdf (English, 6 pages) and paper/IntraSpanNet-zh.pdf (Chinese, 6 pages). Source is in paper/.

What this is

IntraSpanNet is a byte-level model that runs beside an intranet traffic probe. From the first five packets of a flow it returns the product that produced the flow, or an explicit unknown. The label set covers 18 items across three tiers: security appliances, endpoint security agents, and common software.

Results

Metric	Test (503 flows)	All validation (1006 flows)
Product accuracy	0.8787	0.8817
Tier accuracy	0.9245	0.9334
Macro-F1 (supported classes)	0.7621	0.8240
Gate AUROC	0.9784	0.9820 (dev)
Unknown rejection	18/18	18/18

Throughput

Configuration	Throughput	Batch-1 latency	Peak VRAM, batch 128
Single arm	1,017 flows/s	10.7 ms	3.37 GB
Four-arm ensemble	253 flows/s	43.1 ms	3.40 GB

Fine-tuning and RL hooks

intraspannet/train.py exposes SFTConfig, compute_sft_loss, compute_rl_loss, Trainer and load_backbone, which warm-starts a model whose product head has a different number of classes. The caller owns the optimizer and the data loader.

Runnable examples: examples/train_sft.py and examples/train_rl.py, driven by a JSONL manifest. Guides: docs/TRAINING.md (English) and docs/TRAINING.zh-CN.md (Chinese). The pip package 0.1.1 on PyPI carries the same code.

Checksums

52f3e431c129fb4de264821af6e8fd3e5598c3329089b42fc63c078b2e694f3c  intraspannet-v0.1.0-source.zip
bf1fed0d4f10f0d1cb5c391bfc36c18faff18cd28e9dc0edf6dee3ad60fa41ab  intraspannet-v0.1.0-weights.zip